PRIVACY NOTICE
(Why we collect your personal data and what we do with it)
When you supply your personal details to this clinic they are stored and processed for 4 reasons (the bits in bold are the relevant terms used in the General Data Protection Regulation – ie the law):
- We need to collect personal information about your health in order to provide you with the best possible treatment. Your requesting treatment and our agreement to provide that care constitutes a contract. You can, of course, refuse to provide the information, but if you were to do that we would not be able to provide treatment.
- We have a “Legitimate Interest” in collecting that information, because without it we couldn’t do our job effectively and safely.
- We also think that it is important that we can contact you in order to confirm your appointments with us or to update you on matters related to your medical care. This again constitutes “Legitimate Interest”, but this time it is your legitimate interest.
- Provided we have your consent, we may occasionally send you general health information in the form of articles, advice or newsletters. You may withdraw this consent at any time – just let us know by any convenient method.
We have a legal obligation to retain your records for 8 years after your most recent appointment (or age 25, if this is longer), but after this period you can ask us to delete your records if you wish. Otherwise, we will retain your records indefinitely in order that we can provide you with the best possible care should you need to see us at some future date.
Your records are stored on paper, in locked filing cabinets and the offices are always locked and alarmed out of working hours.
We will never share your data with anyone who does not need access without your written consent. Only the following people/agencies will have routine access to your data:
- Your practitioner(s) in order that they can provide you with treatment
- We also use Mailchimp to coordinate our messages, Schedul our online booking system and Rehab My Patient to create exercise sheets. These service providers do not have access to your medical notes, just your essential contact details so your name and email address may be saved on their server.
- We use payment processing company named iZettle to process credit and debit card payments.
From time to time, we may have to employ consultants to perform tasks which might give them access to your personal data (but not your medical notes). We will ensure that they are fully aware that they must treat that information as confidential, and we will ensure that they sign a non-disclosure agreement.
You have the right to see what personal data of yours we hold and you can also ask us to correct any factual errors. Provided the legal minimum period has elapsed, you can also ask us to erase your records.
We want you to be absolutely confident that we are treating your personal data responsibly, and that we are doing everything we can to make sure that the only people who can access that data have a genuine need to do so.
Of course, if you feel that we are mishandling your personal data in some way, you have the right to complain. Complaints need to be sent to what is referred to in the jargon as the “Data Controller”. Here are the details you need for that:
Miss Bethany Garrett
Cambridgeosteopathy@gmail.com
07986 767702
Vision Fitness, Oakington Road, Girton, Cambridge CB3 0QH
If you are not satisfied with our response, then you have the right to raise the matter with the Information Commissioner’s Office.
COOKIES
We use “cookies” to enable our systems to recognize browsers and help us to track visitors to our site, so we can better understand what portions of our site are of most relevance to visitors. Cookies are small pieces of information sent by a web server to a web browser, which enables the server to collect information from the browser. You can find out more about the way cookies work on www.allaboutcookies.org. Most browsers allow you to turn off the cookie function. If you want to know how to do this please look at the help menu on your browser.
COMPLIMENTS, COMMENTS AND COMPLAINTS
I do my best to deliver the best possible care to all my patients. It’s my aim try to make your experience, from the moment you walk through the clinic door, as pleasant and successful as I can.
Hopefully that’s evident to you, so if you’d like to leave a review I’d really appreciate it! It’s always reassuring to hear that I’ve helped.
Obviously, I can’t think of everything, so if there’s an aspect of your treatment, or anything about the whole process from booking to discharge where you think I could make any improvements, then please drop me a line so that I can look into it. Here’s the email address to use:
cambridgeosteopathy@gmail.com
Complaints
Very occasionally, something might not go according to plan and you might wish to complain. I take complaints very seriously, so if you have concern about any aspect of your treatment, please let me know the full details as soon aspossible. I will do my best to deal with it as quickly as I can.
Where necessary, I will also make appropriate changes to the way I conduct my treatments.
You can make your complaint to me either in person, by phone, by letter or in an email. Here are the contact details to use:
| Address | Telephone | |
| Cambridge OsteopathyInside Vision Fitness GymCamboro Business ParkOakington RoadGirtonCB3 0QH | 07986767702 | cambridgeosteopathy@gmail.com |
I will investigate look into your concern over the following few days and will aim to:-
- Find out what gave rise to your concern
- Explain or apologise, if this is appropriate
- Reflect on what I can do to ensure that this problem does not arise again
Mediation
If you feel uncomfortable complaining directly to me or do not feel that your complaint has been resolved to yoursatisfaction, you can speak to the Academy of Physical Medicine on:
01933 328150
or by emailing them at:
hello@academyofphysicalmedicine.co.uk.
The Academy is an independent organisation who will try to help you resolve your complaint.
The General Osteopathic Council
If you wish to instigate a formal complaint with the regulatory body for osteopaths, the General Osteopathic Councilcan be contacted on 0207 3576655.
This will initiate a formal, legal process which can take up to 2 years to complete. They will first assess your complaint to discover whether:
- it falls under their jurisdiction
- it is serious enough to merit formal action
- there is sufficient evidence to support the complaint
Once the assessment process has been completed, and where appropriate, your complaint will be passed on to a tribunal, known as the Professional Conduct Committee.
This committee will conduct a hearing, usually in public, which you may attend. Both parties will be represented by solicitors or barristers.
You should note that, no matter what the outcome, the General Osteopathic Council cannot award compensation.
Data Protection Complaints
References:
A. Data Protection Act 2018 (DPA)
B. UK GDPR
C. Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 (DUAA) came in to force in June 2025. It does not replace the DPA or GDPR, but amends certain areas. One area is the requirement to have a policy specifically related to data protection complaints.
Principles
The Practice will take all data protection complaints seriously, treat complainants fairly and respectfully, investigate complaints impartially, respond within reasonable timescales and take corrective action where appropriate.
How to Make a Complaint
Complaints may be submitted by email, post, telephone, or in person. Where a complaint is made orally, staff should document the complaint and seek confirmation from the complainant that the record is accurate.
Information Required
Complainants should provide their name, contact details, a description of the concern, relevant dates, supporting evidence, and their desired outcome where known.
Complaint Handling Procedure
Complaints will be acknowledged within five working days, investigated appropriately, and a written response will normally be provided within one calendar month. Complex matters may be extended by up to two further months where permitted by law.
Personal Data Breaches
Where a complaint identifies a potential breach involving sensitive or personal data, the Practice will assess the breach and comply with applicable ICO notification requirements.
Subject Access Request Complaints
The Practice will ensure searches are reasonable and proportionate in accordance with current legislation.
Escalation
If dissatisfied, complainants should first contact the Practice Manager/Clinic Director. If their issue cannot be resolved this way, then they may contact the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, http://www.ico.org.uk.
Complaint Records
The Practice will maintain a Data Protection Complaints Register and retain complaint records for a minimum of six years from closure unless a longer period is required by law.
Learning and Improvement
The Practice will periodically review complaints to identify trends, training needs and opportunities for improvement.
Responsibilities
The Clinic Director is responsible for overall compliance. All staff (including assistants, associates and consultants working as part of the Practice) must recognise and report complaints, cooperate with investigations and maintain confidentiality.
Policy Review
This policy will be reviewed annually, following significant legislative changes, significant incidents or updated regulatory guidance.