We take the privacy of our patients very seriously. We ask that you read this privacy policy (Policy) carefully as it contains important information about how we will use your personal data.

For the purposes of the Data Protection Act 1998, Laura Worsfold t/as Holmwood Clinic of Horsham Road, South Holmwood, Dorking, RH5 4NE ('we' or 'us') are the 'data controller' (ie the company who is responsible for, and controls the processing of, your personal data).

In order to create a patient record for you we have a legitimate interest to process the following data. Your name, address, contact telephone number, email address, GP name and contact details.

This data will be collected when you book appointments, or as part of your consultation or in correspondence with you.

Your personal data will be held by Jane App. For more information about how Jane App store your information please see their Cloud Security White Paper and Jane App Privacy Policy.

We also use the Rehab My Patient exercise prescription programme. You can view their GDPR Policy at http://www.rehabmypatient.com.

In order to ensure that you receive an appropriate course of treatment we may also obtain sensitive personal data about. As a member of the Institute of Osteopathy and holding a registration with the General Osteopathic Council I abide by their code of conduct and ethics. The lawful basis to process any sensitive data that you provide is for claims occurring insurance. This requires the retention of your data for the period specified elsewhere in this document. I also process any such data in order to fulfil my role as a healthcare practitioner.

Occasionally we may receive information about you from other sources, which we will add to the information we already hold about you in order to help us, improve and personalise our service to you.

We will use your personal data for the purposes described in the data protection notice that was given to you at the time your data were obtained. These purposes include:

• to help us identify you and any accounts you hold with us;
• administration;
• research, statistical analysis and behavioural analysis;
• marketing - see 'Marketing and opting out', below;
• fraud prevention and detection;
• billing and order fulfilment;
• to notify you of any changes to our services that may affect you;
• improving our services;

If you have given permission, we may contact you by email, SMS, mail, telephone, text/picture/video message about hints and tips, blogs, special offers, updates, new services that may be of interest to you. If you prefer not to receive any direct marketing communications from us, you can opt out at any time. See 'Your rights', below for further information.

We may disclose your personal data to:

• an alternative therapist within the clinic subject to your permission being obtained;
• a private medical provider who may require some details to make a payment on your behalf;
• law enforcement agencies in connection with any investigation to help prevent unlawful activity;
• our business partners in accordance with the 'Marketing and opting out' section above;

We will use technical and organisational measures to safeguard your personal data, for example:

• we store your personal data in a secure filing system where access to it is limited
• where a payment is made by card, the transaction is encrypted, made in your presence and requires your authorisation.

We may monitor and record communications with you (such as telephone conversations and emails) for the purpose of quality assurance, training, fraud prevention and compliance.

If you give us information on behalf of someone else, you confirm that the other person has appointed you to act on his/her behalf and has agreed that you can:

• give consent on his/her behalf to the processing of his/her personal data;
• receive on his/her behalf any data protection notices;
• give consent to the transfer of his/her personal data abroad; and
• give consent to the processing of his/her [insert category or categories of sensitive personal data, eg health information].

None of the data we hold about you will be transferred outside of the EEA zone.

You have the right to request access to personal data that we may process about you. If you wish to exercise this right, you should:

• put your request in writing to the data controller as detailed above;
• include proof of your identity and address (eg a copy of your driving licence or passport, and a recent utility or credit card bill);
• specify the personal data you want access to.

You have the right to require us to correct any inaccuracies in your data free of charge. If you wish to exercise this right, you should:

• put your request in writing;
• provide us with enough information to identify you and;
• specify the information that is incorrect and what it should be replaced with.

You have the right to ask us to stop processing your personal data for direct marketing purposes. If you wish to exercise this right, you should:

• put your request in writing;
• provide us with enough information to identify you ;
• if your objection is not to direct marketing in general, but to direct marketing by a particular channel (e.g. email or telephone), please specify the channel you are objecting to.

We will retain your data and consultation notes for a minimum period of 8 years following your last consultation, or if the patient is a child it will be retained until their 25th birthday. After this period has expired your data will be securely destroyed.

You have the right to request that the data we hold about you is destroyed before this time period expires and should you wish to exercise this option you should make a written request.

We welcome your feedback and questions. If you wish to contact us, please send an email to hello@holmwoodosteopath.co.uk or you can write to us at Holmwood Clinic, Horsham Road, South Holmwood, Dorking, RH5 4NE.

We may change this privacy policy from time to time. You should check this policy occasionally to ensure you are aware of the most up to date version.

If you do not agree to the processing of your data as detailed above then we may not be able to provide you with the treatment you require.