Privacy Policy

Last updated: 30 October 2025
Controller: Andy Breakspear at Breakspear Osteopathy & Pilates Clinic

Address:
The Pippin, Cherry Close
Prestwood
Great Missenden
Bucks HP16 0QD
United Kingdom

Email: breakspearclinic@osteopilates.co.uk
Telephone: 01494 813700
Data Protection Officer / Data Lead: Andy Breakspear

Breakspear Osteopathy & Pilates Clinic ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, share, and protect your personal information, and your rights under UK data-protection law.

1. Legal Basis

We process personal data under the UK-GDPR and Data Protection Act 2018. Health information is special-category data and receives enhanced safeguards.

2. Information We Collect

We collect only what is necessary to provide safe and effective osteopathy and Pilates services:

  • Contact details (name, address, telephone, email)

  • Date of birth and identity information

  • Medical history & clinical notes (special category data)

  • Appointment history & consent forms

  • Payment information (card details processed securely; we do not store full card numbers)

  • Emergency contact information

  • Marketing preferences (only with consent)

  • Website usage data (cookies, analytics)

  • CCTV footage, where applicable

3. Purpose & Legal Basis for Processing

We process your data for the following purposes and legal bases:

  • Provide treatment & clinical records — Contract; healthcare provision (special category)

  • Appointment booking & reminders — Contract; legitimate interest

  • Payment processing & accounting — Contract; legal obligation

  • Referrals to other healthcare professionals — Consent for routine referrals; legitimate interest where necessary for safeguarding or urgent care

  • Marketing communications — Consent only

  • Legal / regulatory obligations & safeguarding — Legal obligation

  • Service improvement / anonymised audit — Legitimate interest / healthcare purposes

We never sell your data. We do not use automated decision-making or profiling in connection with your data.

4. Data Sharing

We may share relevant data with:

  • Healthcare professionals (with your consent or where necessary)

  • Booking & practice-management systems

  • Payment service providers

  • Secure IT / cloud providers

  • Regulators or authorities where required by law

All processors operate under data-processing agreements with proper security controls. Where any processor stores or accesses data outside the UK or EEA, this is safeguarded through appropriate legal mechanisms, such as Standard Contractual Clauses or a UK adequacy decision, as required by the UK-GDPR.

5. Data Retention

We retain your data for the following periods:

  • Adult clinical records — minimum 8 years after your last treatment

  • Children's clinical records — until age 25

  • Appointment and booking records — for as long as your account remains active, and in line with clinical record retention where linked to treatment

  • Financial / accounting records — 6–7 years

  • Marketing information — until you withdraw consent

Records may be retained longer if required for legal reasons or ongoing claims.

6. Your Rights

You have the right to request:

  • Access to your data

  • Correction of inaccurate data

  • Erasure (where legally permitted)

  • Restriction or objection to processing

  • Data portability (where applicable)

  • Withdrawal of consent for marketing

We will respond to any request within one month, as required by UK-GDPR.

To exercise your rights, contact:
breakspearclinic@osteopilates.co.uk or 01494 813700

If unsatisfied, you may contact the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

7. Data Security

We use:

  • Encrypted electronic systems

  • Secure physical storage

  • Controlled access to clinical records

  • Secure disposal procedures

We will notify you and relevant authorities of any data breach where legally required.

8. Cookies

We use cookies to operate our website and analyse performance. Non-essential cookies are used only with your consent via our cookie banner. For more detail on the specific cookies we use, please refer to our cookie banner preferences on our website.

9. Marketing

We only send marketing updates if you opt in. You may unsubscribe at any time.

10. CCTV

Where CCTV is in use at our premises, signs are displayed to inform visitors, and footage is retained only as long as necessary for security purposes, and no longer than required to resolve any incident.

11. Children & Vulnerable Adults

We follow strict safeguarding and confidentiality standards and retain children's records in line with healthcare-professional guidance.

12. Professional Standards

We comply with General Osteopathic Council professional, confidentiality, and record-keeping standards.

13. Changes to This Policy

We may update this policy; the latest version will always appear on our website.

14. Contact Us

Breakspear Osteopathy & Pilates Clinic
The Pippin, Cherry Close
Prestwood
Great Missenden
Bucks HP16 0QD
United Kingdom

01494 813700
breakspearclinic@osteopilates.co.uk

Data Lead: Andy Breakspear