Privacy Policy

1. Introduction

This Privacy Policy explains how Coventry Osteopathic & Sports Injury Clinic ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website, contact the clinic, book an appointment, or receive treatment at our clinic.

We are committed to handling your personal data in an open, transparent, and lawful manner, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We may update this policy from time to time. Please check this page periodically to ensure you are satisfied with any changes.

2. Who We Are

Coventry Osteopathic & Sports Injury Clinic is the Data Controller responsible for your personal data.

Data Controller: Coventry Osteopathic & Sports Injury Clinic
Data Protection Contact: Wendy Cook
Email: info@coventryosteopaths.co.uk
Phone: 02476 501923
Address: 312A Charter Avenue, Coventry, CV4 8DA

3. What Personal Data We Collect

Standard Personal Data

We may collect and process the following personal data:

• Full name

• Contact information, including email address, postal address and telephone number

• Date of birth

• Demographic information, such as postcode

• Information relevant to customer surveys or service improvements

• Appointment and attendance information

• Payment and billing information

• Correspondence with the clinic

Special Category Data: Health Information

As a healthcare provider, we collect and process health-related information. This is classified as Special Category Data under UK GDPR Article 9.

This may include:

• Medical history and health conditions

• Treatment records and clinical notes

• Details of medications, allergies and relevant lifestyle factors

• Information provided during consultations

• Information from other healthcare professionals, where relevant

• Information relating to injuries, symptoms, pain, mobility or function

We handle all Special Category Data with strict confidentiality and appropriate safeguards.

4. How and Why We Process Your Data: Lawful Basis

We only process your personal data where we have a lawful basis to do so.

Treatment and Clinical Care

Article 6 lawful basis: Contract — processing is necessary to provide you with treatment and fulfil our agreement with you.

Article 9 condition: Article 9(2)(h) — processing is necessary for the provision of health care by a qualified professional.

Appointment Booking and Reminders

Article 6 lawful basis: Legitimate Interests — it is in your interest and ours to manage appointments effectively, send appointment information and ensure continuity of care.

Clinical Record Keeping

Article 6 lawful basis: Legal Obligation — we are required to retain clinical records in accordance with healthcare, professional and regulatory requirements.

Article 9 condition: Article 9(2)(h) — processing is necessary for the provision of health care.

Health Newsletters and Marketing

Article 6 lawful basis: Consent — we will only send marketing communications where you have given consent, which you may withdraw at any time.

Website Analytics and Improvement

Article 6 lawful basis: Legitimate Interests — we use website data to understand how our website is used and to improve user experience. Where possible, this data is anonymised or aggregated.

If you do not provide necessary clinical information, we may be unable to provide treatment safely.

5. How We Use Your Information

We use your personal data to:

• Provide osteopathic and sports injury treatment

• Assess your health, symptoms and treatment needs

• Maintain accurate clinical records

• Manage appointments and appointment reminders

• Communicate with you about your care

• Send health information or clinic updates where consent has been given

• Improve our services and website

• Meet legal, regulatory and professional obligations

• Carry out administrative, billing and record-keeping tasks

• Respond to enquiries, requests, complaints or concerns

6. Data Retention

We retain personal data only for as long as necessary.

Our usual retention periods are:

• Clinical records: Minimum 8 years after your last appointment, or until age 25 if longer

• Marketing data: Until consent is withdrawn

• Website enquiries: 12 months unless treatment begins

• Financial records: 7 years, in line with HMRC requirements

• Complaint records: Kept securely for as long as necessary to manage the complaint, evidence our response and meet legal or regulatory obligations

After the relevant retention period, data is securely destroyed or deleted.

7. Who We Share Your Data With

We do not sell or distribute your personal data.

We only share data where necessary, and only with appropriate safeguards in place.

This may include:

Cliniko

Used to manage clinical records and appointments.

PepTalkr

Used to send newsletters, clinic updates and appointment communications.

Your name and email address may be stored and processed on secure servers located outside the UK, including Australia.

Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses under UK GDPR Article 46 where required.

Reception and Administrative Staff

Access is limited to the information needed to manage appointments, enquiries, payments and clinic administration.

Bookkeeper and Administrative Support

Access is limited to essential billing, payment and contact data only.

Treating Practitioners

Treating practitioners have access to relevant clinical records where this is necessary to provide safe and appropriate care.

Legal, Regulatory or Professional Authorities

We may share information where required by law, regulation, professional standards, safeguarding obligations, court order or insurance requirements.

All third parties are expected to maintain confidentiality and appropriate data protection standards.

8. Data Security

We implement appropriate safeguards to protect your data.

These include:

• Paper records stored securely in locked premises

• Electronic records stored in secure, password-protected systems

• Access restricted to those who need it

• Office systems secured and maintained

• Staff and practitioners expected to follow confidentiality and data protection requirements

• Appropriate safeguards when using third-party systems

No system can be guaranteed to be completely secure, but we take reasonable and proportionate steps to protect the personal data we hold.

9. Use of AI-Assisted Tools

We are currently assessing the use of secure, clinically appropriate AI-assisted tools to support administrative and clinical processes within the clinic.

This may include the future use of AI technology to assist practitioners with clinical note-taking during consultations.

If and when such tools are implemented:

• They will be used solely as assistive technology

• They will not make clinical decisions or replace professional judgement

• All outputs will be reviewed and validated by your treating practitioner

• They will operate under strict confidentiality and data protection controls

• They will only be introduced where they meet UK GDPR requirements

• Appropriate safeguards will be put in place, including data processing agreements and lawful international transfer mechanisms where required

We will update this Privacy Policy once any AI-assisted tools are actively in use.

If you have any questions about this, please contact us using the details in Section 2.

10. International Data Transfers

Some systems we use may process personal data outside the UK.

Cliniko

Cliniko may process data internationally depending on system configuration and service arrangements.

PepTalkr

PepTalkr processes and stores data on servers located in Australia.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses under UK GDPR Article 46 where required.

We assess the providers we use and take reasonable steps to ensure appropriate data protection standards are maintained.

11. Cookies

We use cookies to:

• Analyse website traffic

• Improve functionality and user experience

• Remember your preferences

Some data may be anonymised or aggregated and may not identify you personally.

You can control cookies through your browser settings.

More information is available at: www.allaboutcookies.org

12. External Links

Our website may contain links to other websites. We are not responsible for the privacy practices, security or content of those external websites.

13. Your Rights Under UK GDPR

You have the right to:

• Access your personal data

• Correct inaccurate data

• Request deletion, subject to legal and clinical record-keeping obligations

• Restrict processing

• Request data portability

• Object to processing

• Not be subject to automated decision-making

• Withdraw consent, where processing is based on consent

We will respond to valid requests within one calendar month. In some circumstances, we may need to verify your identity before responding.

Some rights may be limited where we have a legal, professional or clinical obligation to retain certain information.

14. Controlling Your Information

Direct Marketing

You may withdraw consent to marketing at any time by:

• Clicking “unsubscribe” in emails

• Emailing us

• Calling or writing to us

Subject Access Requests

Subject access requests can be made by email or post.

We may need to verify your identity before releasing information.

15. Data Protection Complaints

If you are concerned about how we have collected, used, stored, shared or otherwise handled your personal data, you may make a data protection complaint to us.

You can contact us by:

Email: info@coventryosteopaths.co.uk
Phone: 02476 501923
Post: Coventry Osteopathic & Sports Injury Clinic, 312A Charter Avenue, Coventry, CV4 8DA

Please mark written complaints clearly as “Data Protection Complaint” where possible.

We will acknowledge receipt of a data protection complaint within 30 days. Wherever possible, we aim to acknowledge complaints sooner than this.

We will investigate the complaint, make appropriate enquiries, keep you informed where necessary, and provide an outcome without undue delay.

If your concern forms part of a wider patient complaint, we may consider the issues together. However, where the data protection issue can be responded to separately or sooner, we will not delay that response unnecessarily.

If you are not satisfied with our response, or you remain concerned about how your personal data has been handled, you may contact the Information Commissioner’s Office:

Website: www.ico.org.uk
Phone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

16. General Complaints

If your complaint relates to your care, treatment, service experience, fees, communication or any other matter not specifically about data protection, please contact us using the details above.

We aim to resolve general complaints within 28 days where possible.

Further details are set out in our clinic complaints procedure.

17. Changes to This Policy

We may update this policy at any time. Changes will be posted on this page.

Coventry Osteopathic & Sports Injury Clinic
312A Charter Avenue
Coventry
CV4 8DA

Email: info@coventryosteopaths.co.uk
Phone: 02476 501923

Last updated: June 2026