Privacy & GDPR Notice

Taylor Clifford Health ("the practice", "we", "us") operates from 42 The High Street, Charing, Ashford, Kent, TN27 0HX and Bannatynes Health Club and Spa, Unit 2, Lower Terrace, Eureka Leisure Park, Ashford, Kent, TN25 4BN. This notice explains what personal data we collect, why, how we use it, and the rights you have over it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Our registered osteopaths diagnose and treat musculoskeletal health conditions, in accordance with the Institute of Osteopathy's patient charter. Holly Taylor-Clifford is the data controller responsible for your personal data.

2. The Data We Hold

To provide safe treatment, we collect the personal data necessary for your care, including your name, date of birth, contact details, GP details, medical history, and clinical notes made at each appointment. We only collect what is relevant to your treatment, and clinical notes are only ever seen by staff involved in delivering your care. Our administration team can see contact details in order to book and manage appointments.

Contact details you provide (phone number, email, postal address) may also be used to send appointment reminders and information relevant to your treatment, and, where you've agreed to this, to let you know about services we think may be of interest to you. You can opt out of this at any time by contacting us using the details below.

3. Our Lawful Basis for Processing

We process your personal data under the lawful bases of contract (to provide the treatment you've booked), legal obligation (to keep clinical records as required by the General Osteopathic Council), and, for marketing communications, your consent, which you can withdraw at any time.

4. How We Store Your Data

Paper records are kept in locked storage at our clinics. Electronic records are stored on secure, access-controlled systems, with industry-standard security measures in place. We do not sell or broker your data, and we do not share it with third parties except where needed to provide your care (for example, writing to your GP with your consent) or where we're legally required to.

5. How Long We Keep It

Adult records are retained for eight years after your last appointment, in line with guidance from our regulator. Records relating to minors are kept until they reach the age of 25. After these periods, personal data is securely deleted unless we need to retain limited information to meet a legal obligation.

6. Our Website Enquiry Form

If you contact us through the enquiry form on our booking page, we collect the details you enter — your name, phone number, email address, preferred clinic, and your message — solely to respond to your enquiry and, where relevant, to arrange an appointment. We ask you not to include any medical, symptom, or health information in this form; anything clinical is discussed with you directly by phone or at your appointment.

These submissions are handled on our behalf by Forminit (operated by UXPLUS LTD, a company registered in the United Kingdom), acting as our data processor under a written data processing agreement. Data submitted through the form is stored on secure servers within the European Economic Area (in Ireland); it is not transferred outside the UK or EEA. We keep enquiry messages for up to 12 months, after which they are deleted — unless you go on to become a patient, in which case the relevant details are added to your clinical record and kept as described in section 5.

Our lawful basis for this processing is taking steps at your request before entering into a contract for treatment, together with our legitimate interest in responding to enquiries.

7. Cookies & This Website

This website does not currently use analytics, advertising, or tracking cookies. If that changes in the future, this notice will be updated to explain what's used and how to manage your preferences.

8. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data, where certain conditions apply.
• Restriction — ask us to limit how we use your data, where certain conditions apply.
• Portability — ask us to transfer your data to another organisation.
• Object — object to certain types of processing, such as direct marketing.

To exercise any of these rights, contact us using the details below. To protect your data, we may ask for proof of identity (such as a driving licence, passport, or a recent utility bill) before releasing or amending any personal information.

9. Making a Complaint

If you're unhappy with how we've handled your personal data, please contact us first so we can try to put things right. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or by calling 0303 123 1113.

10. Contact Us

For any questions about this notice, or to exercise your data protection rights, please contact: info@tchealth.co.uk or call 01233 878 100.