Essential Osteopathy - Privacy Policy

This Privacy Policy explains how Essential Osteopathy collects, uses, stores, processes and protects your personal information when you attend for Osteopathic treatment.

I am committed to handling your information securely, confidentially and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the General Osteopathic Council’s Standards of Practice.

Essential Osteopathy
2nd Floor
4 Lynedoch Place
Glasgow
G3 6AB

What information I collect

To provide safe and effective Osteopathic care I collect information including:

• Your name, address, telephone number, email address and date of birth
• Medical history and current symptoms
• Details of previous injuries, operations, illnesses and medication
• Lifestyle information relevant to your condition
• Clinical findings, examination results, treatment provided and progress notes
• Appointment history and billing information
• Communication preferences
• Information you provide through online intake forms, email, telephone or during appointments

Where appropriate, I may also receive relevant information from other healthcare professionals where you have requested this or provided your consent.

Why I collect your information

Your information is collected to:

• Assess your suitability for Osteopathic treatment
• Provide safe and effective Osteopathic assessment and treatment
• Maintain accurate clinical records
• Monitor your progress
• Contact you regarding appointments and other administrative matters
• Prepare written exercises, advice and follow-up information
• Process payments and manage practice administration
• Meet my professional, legal and regulatory obligations

Your personal information is not used for automated decision-making or profiling. Clinical decisions are always made by your Osteopath.

Legal basis for processing your information

Under UK GDPR I process your personal information under one or more of the following lawful bases:

• Provision of healthcare and management of health records
• Performance of a contract to provide Osteopathic treatment
• Compliance with legal and regulatory obligations
• Legitimate interests in managing and administering the practice and providing continuity of care
• Vital interests where necessary to protect you or another person
• Consent where required, including optional marketing communications

You may withdraw your consent for marketing communications at any time.

How your information is stored and protected

I take confidentiality and information security seriously.

To help protect your information:

• Electronic clinical records are securely stored within Jane, a password-protected clinical records system.
• Clinic computers and mobile devices are password protected and protected using recognised security measures.
• Older paper records, where applicable, are stored in a locked filing cabinet with restricted access.
• Access to personal information is restricted to information necessary for providing your care.
• Appropriate technical and organisational measures are used to help protect your information against unauthorised access, loss, misuse or disclosure.

I do not sell your personal information or share it for marketing or commercial purposes.

Use of secure digital documentation tools

To support efficient clinical administration I may use secure digital documentation tools, including Whispr Flow, to assist with preparing clinical notes during or following your appointment.

Whispr Flow is used solely to assist with documenting clinical information. It does not make clinical decisions, diagnose medical conditions or determine your treatment. All clinical decisions remain the responsibility of your Osteopath and all information is reviewed before becoming part of your clinical record.

I may also use secure AI-assisted tools, including ChatGPT, to assist with preparing written exercises, patient advice, correspondence and other administrative documents. Where ChatGPT is used, patient information is anonymised or de-identified before being processed and direct identifiers such as names, dates of birth, addresses and contact details are not included.

These digital tools are used only to support documentation and administrative tasks. They do not replace professional judgement and do not determine diagnosis or treatment.

Who your information may be shared with

Your personal information is treated as confidential and will only be shared where it is lawful and appropriate to do so.

Routine access may include:

• Your treating Osteopath
• Jane, which provides appointment booking, billing and clinical record management
• Mailchimp, if you have chosen to receive newsletters or marketing communications
• Secure digital service providers used to support clinical documentation and administration where appropriate

Your information may also be shared:

• Where required by law
• Where necessary to protect you or another person from serious harm
• With another healthcare professional involved in your care where you have requested this or provided your consent

Your information is never sold or shared with third parties for marketing purposes.

Marketing communications

If you choose to receive newsletters or practice updates these will be sent using Mailchimp.

Marketing communications are entirely optional. You may unsubscribe at any time using the link provided within the email or by contacting Essential Osteopathy directly.

How long your information is kept

Clinical records are retained in accordance with professional and legal requirements.

This is currently:

• Eight years after your last appointment
• Until your 25th birthday if you were under 16 at the time of your last treatment
• Until your 26th birthday if you were aged 17 at the time of your last treatment

Following the relevant retention period your records will be securely destroyed or permanently deleted where appropriate.

Your rights

Under UK GDPR you have the right to:

• Request access to the personal information held about you
• Request correction of inaccurate or incomplete information
• Request erasure of information where this is legally appropriate
• Request restriction of processing where applicable
• Object to certain processing where permitted by law
• Withdraw consent for optional marketing communications
• Request a copy of your clinical records

Requests can be made by contacting:

Email: fiona@essentialosteopathy.co.uk

Telephone: 07887 655007

If you remain dissatisfied with how your personal information has been handled, you have the right to complain to the Information Commissioner’s Office (ICO).

Data Protection Lead

Fiona McIntosh, Registered Osteopath, is responsible for data protection within Essential Osteopathy.

Essential Osteopathy is registered with the Information Commissioner’s Office (ICO).