02/03/2025
Privacy Policy
Last updated: [21.10.2026]
Who we are
Flourish Chiropractic (“we”, “us”, “our”) is the data controller for the personal information we collect about you. This means we decide how and why your information is used, and we are responsible for looking after it.
Practice name: [Legal name of business / practitioner]
Address: [Clinic address]
Email: adjust.flourish@gmail.com
ICO registration number: [ZXXXXXXX]
This policy explains how we collect, use, store and protect your personal information when you visit our website, contact us or receive treatment. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Information we collect
Information you give us:
Contact details: name, address, email address, phone number and date of birth
Appointment and booking details
Payment information (card payments are handled by our payment provider, and we do not store full card details)
Messages you send us by email, phone, contact form or social media
Health information:
To treat you safely, we collect details about your health, medical history, symptoms, medication, examination findings, treatment notes and any relevant information from your GP or other healthcare professionals. Health information is “special category data” under UK GDPR and is given extra protection.
Information collected automatically:
When you visit our website we may collect your IP address, browser type, device information and how you use the site, through cookies and similar technologies (see section 9).
How we use your information and our lawful basis
The law says we must have a lawful basis for using your personal information. Ours are:
Booking and managing appointments, and providing treatment: performance of a contract with you.
Keeping clinical records: legal obligation. Chiropractors are required by the General Chiropractic Council to keep accurate records.
Processing your health information to assess and treat you: provision of health care by a regulated health professional.
Taking payments and keeping financial records: contract and legal obligation (tax and accounting).
Sending appointment reminders and service updates: our legitimate interest in running the practice efficiently.
Sending newsletters, offers and promotions: your consent. You can unsubscribe at any time.
Improving our website through analytics cookies: your consent.
Handling complaints, legal claims and insurance matters: legitimate interests and legal obligation.
We will only send you marketing if you have opted in, and every marketing message will include an easy way to unsubscribe.
Sharing your information
We do not sell your personal information. We only share it where necessary:
With your consent, for example with your GP or another healthcare professional if a referral is needed.
With service providers who help us run the practice, such as our booking and clinical records system (Practice Hub), email provider, payment processor, website host and accountant. They may only use your data on our instructions and must keep it secure.
With our regulator, professional bodies or insurers where required, for example the General Chiropractic Council or in the event of a claim.
Where the law requires it, or to protect someone’s vital interests in an emergency.
International transfers
Some of our service providers may store data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as a UK adequacy decision or the ICO-approved International Data Transfer Agreement or Addendum.
How long we keep your information
Clinical records (adults): at least 8 years after your last treatment.
Clinical records (under 18s): until the patient’s 25th birthday, or 8 years after their last treatment if that is later.
Financial records: 6 years, to meet HMRC requirements.
Enquiries from people who do not become patients: up to 12 months.
Marketing lists: until you unsubscribe.
After these periods, records are securely deleted or destroyed.
Your rights
Under UK data protection law you have the right to:
Access the personal information we hold about you (a “subject access request”).
Have inaccurate or incomplete information corrected.
Ask us to delete your information. We may need to keep clinical records for the legally required period.
Restrict how we use your information.
Object to us using your information on the basis of legitimate interests, and to direct marketing at any time.
Receive your information in a commonly used format (data portability).
Withdraw your consent at any time, where we rely on consent.
To exercise any of these rights, email adjust.flourish@gmail.com. There is normally no charge, and we will respond within one month. We may need to confirm your identity first.
How we keep your information safe
We use appropriate technical and organisational measures to protect your data, including secure, access-controlled clinical systems, encryption where appropriate and confidentiality obligations on anyone who handles patient records. No method of sending data over the internet is completely secure, but we take reasonable steps to protect your information. If a data breach could affect you, we will tell you and the ICO where the law requires it.
Cookies
Our website uses essential cookies so the site works properly. With your permission, we also use analytics cookies [e.g. Google Analytics] to understand how visitors use the site. Non-essential cookies are only set if you accept them through our cookie banner, and you can change your choice at any time.
Complaints
If you are unhappy with how we have handled your information, please contact us first at adjust.flourish@gmail.com and we will do our best to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
Website: ico.org.uk
Helpline: 0303 123 1113
Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with a new “last updated” date.
