Privacy and Data Protection Policy

Last updated: September 2026

Head Shoulders Knees & Toes Chiropractic is committed to protecting your privacy and handling your personal information securely and responsibly.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, how long we keep it, and your rights.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and our professional obligations as chiropractic healthcare providers.

Who We Are

Data Controller:
Head Shoulders Knees & Toes Chiropractic Ltd
London, UK

Telephone: 020 3326 9386
Email: info@hsktchiropractic.co.uk

If you have any questions about this Privacy Policy or how your personal information is processed, please contact us using the details above.
 

Information We Collect

To provide appropriate and safe chiropractic care, we may collect and process information including:

Personal information

• Name

• Date of birth

• Address

• Telephone number

• Email address

• Emergency contact details
   

Health and clinical information

• Medical and health history

• Current and previous symptoms

• Relevant lifestyle information

• Examination and assessment findings

• Clinical impressions and diagnoses

• Treatment and rehabilitation records

• Imaging reports

• Referral information and correspondence with other healthcare professionals, where applicable

We normally obtain this information directly from you. Where appropriate, we may also receive relevant information from other healthcare professionals, imaging providers, parents or guardians, or other people involved in your care.
 

Payment Information

Payments may be processed through secure third-party payment providers. When this is the case, those providers process payment information securely.

We do not store full card details on our own systems.
 

How We Use Your Information

We may use your personal information to:

• Provide chiropractic consultations, assessments, treatment and rehabilitation

• Maintain accurate clinical records

• Communicate with you about your care

• Manage and confirm appointments

• Send appointment reminders

• Provide information relating to your treatment or rehabilitation

• Process payments and manage clinic administration

• Communicate with other healthcare professionals where appropriate

• Meet our legal, regulatory, insurance and professional obligations

Some personal and health information is necessary for us to assess whether chiropractic care is appropriate and safe for you. If you choose not to provide information that is necessary for your care, we may be unable to provide some or all of our services safely.
 

Our Legal Basis for Processing Your Information

Under UK GDPR, we must have a lawful basis for processing personal information.

Depending on the purpose for which your information is being processed, we may rely on lawful bases including:

Contract
Where processing is necessary to provide services that you have requested or to take steps at your request before providing those services.

Legal obligation
Where processing is necessary for us to comply with applicable legal, regulatory or professional requirements.

Legitimate interests
Where necessary for the appropriate administration and operation of the clinic, provided that these interests do not override your rights and interests.

Health information is classed as special category data under UK GDPR and receives additional protection.

Where applicable, we process health information under Article 9(2)(h) of UK GDPR, which permits the processing of special category information where necessary for health or care purposes, subject to the applicable safeguards and requirements under UK law.

We do not sell your personal information.

Communications and Marketing

We may contact you when necessary regarding appointments, your care, rehabilitation or other administrative matters relating to the services you have requested.

Where consent is required for promotional or marketing communications, we will obtain the appropriate permission. You can withdraw your consent to marketing communications at any time.
 

Sharing Your Information

We only share personal information where it is necessary, appropriate or legally required.

Depending on the circumstances, this may include:

• Healthcare professionals involved in your care

• Your GP or medical specialist where appropriate

• Regulatory or legal authorities where disclosure is required

• Professional indemnity insurers where necessary

• Service providers that help us operate the clinic

Where consent is required before information is shared, we will seek your consent unless there is another lawful basis for disclosure.

We do not share your clinical records with unrelated organisations for their own marketing purposes.
 

Service Providers

We use third-party services to help operate the clinic. These may include:

• Practice and patient-management software

• Online booking systems

• Payment processors

• Email and SMS communication services

• Exercise and rehabilitation platforms

• Website hosting and analytics services

Our patient-management and booking system is provided by Jane App.

Our website is provided through Wix.

These organisations process information in accordance with their own privacy obligations and, where they process personal information on our behalf, appropriate data-protection arrangements are used.

Some service providers may process or store information outside the United Kingdom. Where personal information is transferred internationally, we take appropriate steps to ensure that applicable UK data-protection requirements and safeguards are followed.
 

Website and Cookies

Our website may use cookies and similar technologies to operate correctly, understand how visitors use the website and improve the user experience.

Where required, non-essential cookies and analytics technologies will only be used after you have been given an appropriate choice through our cookie consent system.

More information about the cookies used on our website can be found in our cookie information or cookie settings.
 

How We Protect Your Information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Measures may include secure and password-protected systems, access controls and encrypted services where appropriate.

Access to patient information is limited to authorised individuals who require it to provide care or administer the clinic.
 

How Long We Keep Patient Records

We retain patient records in accordance with our professional and legal obligations.

Adult chiropractic patient records are normally retained for eight years from the date of the patient's last visit.

Records relating to children are normally retained until their 25th birthday, or their 26th birthday if they were 17 when treatment ended.

Records may be retained for longer where there is a legal, regulatory, insurance or other legitimate requirement to do so.

When records are no longer required, they will be securely deleted or destroyed as appropriate.
 

Your Data Protection Rights

Depending on the circumstances and the lawful basis for processing, you may have the right to:

• Be informed about how your personal information is used

• Request access to personal information we hold about you

• Ask us to correct inaccurate or incomplete information

• Request restriction of processing in certain circumstances

• Object to certain processing

• Request deletion of information where the law permits

• Request transfer of your information where the right to data portability applies

• Withdraw consent where processing is based on consent

These rights are not absolute. In particular, professional or legal requirements may require us to retain clinical records even if you request their deletion.

To exercise any of these rights, please contact us at info@hsktchiropractic.co.uk.

Automated Decision-Making

We do not use your clinical information to make decisions about your care solely through automated decision-making or profiling.
 

Complaints

If you have concerns about how we use your personal information, please contact us first so that we have an opportunity to address your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

Information Commissioner's Office
Website: ico.org.uk
Telephone: 0303 123 1113

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, professional requirements or data-protection law.

The most recent version will be available on our website.
 

Contact Us

Head Shoulders Knees & Toes Chiropractic Ltd
London, UK

Telephone: 020 3326 9386
Email: info@hsktchiropractic.co.uk

Please contact us if you would like to:

• Request a copy of information we hold about you

• Correct or update your personal information

• Exercise a data-protection right

• Ask a question about how we use your information