Privacy Policy

1. Introduction

Mason Family Chiropractic Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect and process the following types of personal data:

2.1 Identity Data

• Name, title, date of birth
• Gender

2.2 Contact Data

• Address, email address, telephone numbers
• Emergency contact details

2.3 Health Data (Special Category Data)

• Medical history and current health conditions
• Information about your complaint and symptoms
• Clinical notes, examination findings, and diagnosis
• Treatment records and progress notes
• X-rays and other diagnostic images (if applicable)

2.4 Financial Data

• Payment card details (processed securely, not stored)
• Transaction history
• Insurance membership details (if applicable)

2.5 Technical Data

• IP address, browser type and version
• Device information
• Pages visited and how you interact with our website

3. How We Use Your Data

We use your personal data for the following purposes:

Purpose	Lawful Basis
To provide chiropractic treatment and care	Performance of a contract; Explicit consent (health data)
To manage appointments and bookings	Performance of a contract
To process payments and issue receipts	Performance of a contract
To communicate with you about your care	Legitimate interest; Performance of a contract
To send appointment reminders	Legitimate interest
To comply with professional and regulatory obligations	Legal obligation
To respond to complaints and legal claims	Legal obligation; Legitimate interest
To send marketing communications (with consent)	Consent
To improve our website and services	Legitimate interest

4. Health Data

Health data is classified as "special category data" under UK GDPR and requires additional protection. We process your health data on the following legal bases:

• Explicit consent: You provide explicit consent when you agree to receive treatment
• Healthcare purposes: Processing is necessary for the provision of health care (Article 9(2)(h))
• Vital interests: In an emergency, to protect your vital interests

5. Who We Share Your Data With

We may share your personal data with:

5.1 With Your Consent

• Your GP or other healthcare providers (for referrals or shared care)
• Health insurance providers (to process claims)
• Other practitioners involved in your care

5.2 For Business Operations

• Our online booking system provider (Jane App)
• Payment processors (for secure card transactions)
• IT service providers (for system maintenance)
• Professional advisers (accountants, lawyers)

5.3 When Required by Law

• Regulatory bodies (e.g., General Chiropractic Council)
• Courts or tribunals
• HMRC (for tax purposes)

We never sell your personal data to third parties.

6. Data Retention

We retain your personal data in accordance with professional and legal requirements:

Data Type	Retention Period
Adult clinical records	8 years from last appointment
Children's clinical records	Until patient's 25th birthday (or 26th if 17 at last appointment)
Financial records	7 years (HMRC requirement)
Consent forms	Same as clinical records
Website analytics	26 months
Marketing preferences	Until consent is withdrawn

7. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: You can request a copy of your personal data
• Right to rectification: You can request correction of inaccurate data
• Right to erasure: You can request deletion of your data in certain circumstances
• Right to restrict processing: You can request we limit how we use your data
• Right to data portability: You can request your data in a portable format
• Right to object: You can object to certain processing activities
• Right to withdraw consent: You can withdraw consent at any time

To exercise any of these rights, please contact us using the details above. We will respond within one month.

Note: Some rights may be limited where we have overriding legitimate interests or legal obligations to retain data (e.g., clinical records for ongoing care or legal claims).

8. Data Security

We take the security of your data seriously and have implemented appropriate measures to protect it:

• Secure, encrypted systems for storing electronic records
• Password protection and access controls
• Secure disposal of paper records
• Staff training on data protection
• Regular security reviews
• SSL encryption on our website

9. Cookies

Our website uses cookies to enhance your experience. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

10. International Transfers

We primarily store and process your data within the UK and European Economic Area (EEA). Where data is transferred outside the UK/EEA (e.g., by our service providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

11. Children's Privacy

We provide chiropractic care to children with parental or guardian consent. We collect personal and health data about children in the same way as adults, and apply the same protection measures. Parents/guardians can exercise data rights on behalf of their children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: