How I look after your information

1. Who I am

Gracie Jack Osteopathy is the data controller for the information described in this notice. That means I decide what is collected and what happens to it, and I am responsible for looking after it.

If you have any question about this notice, or about anything I hold, please email or ring me. You will be dealing with me directly. There is no call centre and no third party involved.

2. What I collect

When you book an appointment and come for treatment

• Your name, date of birth, address, telephone number and email address
• Your GP's details, if you give them to me
• Your medical history, current symptoms, medication and anything else relevant to treating you safely
• My clinical notes: what I found on examination, what I did, and what I advised
• Your consent to examination and treatment
• A record of appointments, payments and any cancellations

Most of this is health information, which the law treats as a special category needing extra protection. It is handled accordingly.

When you get in touch

If you telephone, email or message me on Instagram, I keep what you send and my reply for as long as it is useful, so that I can pick up where we left off. Please do not send detailed health information by Instagram message. It is not a private channel and I would rather discuss it with you directly.

When you leave a review

If you fill in the form at leave a review, I collect:

• Your name. Only your first name is ever published.
• Your occupation, if you give one, and what brought you in
• What you wrote, and your star rating
• A photograph, only if you choose to attach one
• A record that you gave permission, the exact wording you agreed to, and the date and time
• A one way scrambled version of your IP address, and your browser's description of itself. These are used only to stop the form being abused by spam software. The scrambling cannot be reversed, so your actual IP address is not stored.

When you use this website

• My hosting provider keeps standard server logs, including IP addresses, for security and to keep the site running. I do not use these for anything else.
• The site loads its typefaces from Google Fonts. Your browser has to contact Google to fetch them, and Google receives your IP address when it does.
• The booking panel on the home page is Cliniko's own booking system shown inside the page. When you use it, you are dealing with Cliniko as well as with me, and Cliniko may set its own cookies.
• There is no Google Analytics, no advertising pixel and no visitor tracking of any kind on this site.

3. Why I use it, and my lawful basis

Data protection law requires me to have a specific reason for each use of your information. Where health information is involved, a second condition is needed on top of the first. Mine are set out below.

I do not use your information to make any automated decision about you, and I do not profile you.

4. Reviews and testimonials

Reviews are entirely optional. Whether you leave one, and what you say, makes no difference at all to your treatment or to how you are looked after here.

• What is published: your first name, your occupation if you gave one, what brought you in, your words, your star rating, and your photograph if you attached one and I have your agreement to show it.
• What is never published: your surname, your email address, your contact details, and the technical information the form collects to block spam.
• Nothing appears automatically. Every review waits until I have read it. I correct obvious typing and spacing only. I do not reword what you said. If a review needs shortening, I would rather ask you first.
• You can change your mind. Email me and I will take it down. You do not need to give a reason, and I will not ask for one. Withdrawing your permission does not affect anything I did with it beforehand, and it has no bearing on your care.

5. Who I share it with

I do not sell your information, I do not trade it, and I do not use it for advertising. It is shared only in these situations:

• Cliniko, the practice management system I use, which holds your appointment details, your clinical records and your payment records on my behalf. Cliniko is provided by Red Guava Pty Ltd and my account's data is held on servers in the United Kingdom.
• Hostinger, who host this website and its email, and who therefore process server logs, anything you send through the review form and anything you email me.
• Google, which receives your IP address when your browser fetches the site's typefaces, as described above.
• Another healthcare professional, such as your GP or a consultant, but only if you ask me to or agree to it first.
• My insurer and, if it were ever needed, my legal advisers, in the event of a complaint or a claim.
• Where the law requires it, for example a court order, or where there is a serious risk to someone's safety. This is rare, and I would tell you unless I were prevented from doing so.

Everyone acting on my behalf is bound by a contract that requires them to keep your information secure and to use it only for what I have asked them to do.

6. Information sent outside the UK

My Cliniko account's records are stored in the United Kingdom. Cliniko's own company is based in Australia, and its staff may access the system for support purposes, which counts as a transfer. Google operates internationally and may process the request for typefaces outside the UK. Where information does leave the UK, it is protected by the safeguards the law requires, such as the UK's International Data Transfer Agreement or a finding that the receiving country offers adequate protection.

7. How long I keep it

The retention periods for clinical records come from the Osteopathic Practice Standards and the record keeping guidance osteopaths work to. They are an obligation on me rather than a choice, which is why I cannot delete a clinical record on request while that period is running.

8. How I keep it safe

• This website is served only over an encrypted connection, so anything you send through the review form is encrypted in transit.
• The review database is stored outside the part of the server the web can reach, so it cannot be downloaded even if its location were known.
• Photographs sent through the form are re-saved before they are stored, which removes the hidden data cameras and phones attach to images, including the location where the photo was taken.
• IP addresses connected with the form are stored only as a one way scramble that cannot be turned back into an address.
• Managing reviews requires a password, and only I have it.
• Clinical records are held in Cliniko, which is encrypted, access controlled and backed up.
• I am the only person who sees your records.

9. Your rights

Under UK data protection law you have the right to:

• Be told what I hold and what I do with it, which is what this notice is for
• See a copy of the information I hold about you
• Have it corrected if it is wrong or incomplete
• Have it deleted, in some circumstances
• Restrict what I do with it while a question about it is resolved
• Receive it in a portable form, or have it sent to someone else, where it was provided by you and is held by agreement or consent
• Object to my using it where I rely on legitimate interests
• Withdraw your consent at any time, where consent is what I relied on. Your review is the main example.

To exercise any of these, just email me. I do not charge for it, and I will reply within one month. If a request is especially complicated I may need longer, and I will tell you if so. I may need to check who you are before I send personal information out.

10. Cookies

This website sets no cookies of its own for visitors. There is no analytics, no advertising and no tracking. Two exceptions are worth naming:

• The booking panel on the home page is Cliniko's system displayed inside the page, and Cliniko may set cookies needed to make a booking work.
• A single session cookie is used when I sign in to manage reviews. It applies to me, not to you.

Because nothing here tracks you, there is no cookie banner to click through. That is deliberate.

11. Children

I treat children and young people. Where a patient is under 16, I take consent from a parent or guardian, who is normally present at the appointment. Children's records are kept for longer than adults' records, as set out above. A young person able to understand what is involved has the same rights over their own information as an adult does, and I will deal with them directly where that is appropriate.

12. Complaints

If you are unhappy with how I have handled your information, please tell me first. I would far rather hear it and put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's independent regulator, and you can do so without coming to me first:

Changes to this notice

If I change how I use your information, I will update this page and change the date at the top. If the change is a significant one and I hold your contact details, I will tell you directly rather than expecting you to notice.