Privacy Notice

Leyton Osteopaths

Last Updated: October 2026

1. Introduction

Leyton Osteopaths respects your privacy. This Privacy Notice explains what personal information we collect,

why we use it, who we may share it with, how long we keep it and the rights available to you when you

contact us, use our website or receive treatment from us.

We process your personal information in accordance with the UK General Data Protection Regulation (UK

GDPR), the Data Protection Act 2018 and other applicable privacy legislation.

2. Who We Are

Leyton Osteopaths is the Data Controller responsible for your personal information.

Contact Details

Leyton Osteopaths

Suite 214 Legacy Business Centre

2A Ruckholt Road

Leyton

London E10 5NP

Telephone: 02030 961 900

Email: leytonosteopaths@gmail.com

If you have any questions regarding this Privacy Notice or how we handle your information, please contact

us using the details above.

3. The Information We Collect

We may collect and process the following categories of personal information:

Category Information we may collect

Identity and Contact Information

Name; date of birth; address; email address; telephone number; emergency

contact details.

Health Information Medical history; current and previous health conditions; medications; treatment

records; consultation notes; referral information; correspondence with other

healthcare professionals.

We collect this information to provide safe and effective treatment. It is classified

as Special Category Personal Data under UK GDPR.

Financial Information

Where applicable: payment records; insurance information; billing details.

Website Information

When you visit our website: IP address; browser type; device information; website usage data; cookie data.

4. How We Collect Your Information

We may collect information directly from:

 You

 Appointment booking forms

 Consultation forms

 Email correspondence

 Telephone conversations

 Website enquiry forms

We may also receive information from:

 General Practitioners (GPs)

 Consultants

 Other healthcare professionals

 Medical insurers

 Family members where appropriate and authorised

5. Why We Process Your Information

We use your information to:

 Provide osteopathic treatment and healthcare services

 Assess your suitability for treatment

 Maintain accurate clinical records

 Arrange and manage appointments

 Communicate with you regarding your care

 Process payments

 Meet legal and regulatory obligations

 Respond to complaints and enquiries

 Improve our services

 Protect the safety of our patients and staff

Where we need personal information to provide treatment, manage an appointment, comply with a legal

obligation or enter into a contract with you, we will explain what information is required. If you do not

provide the information, we may be unable to provide some or all of the requested services.

6. Our Lawful Basis for Processing

We process personal data on the following legal bases:

Activity Lawful Basis

Providing treatment Performance of a contract

Maintaining patient records Legal obligation and legitimate interests

Communicating regarding treatment Contractual necessity and legitimate interests

Responding to enquiries Legitimate interests

Managing complaints Legal obligation and legitimate interests

Marketing communications Consent where required

Health information is special category personal data. We process it only where we have an Article 6 lawful

basis and where processing is necessary for the provision of health care or treatment under Article 9(2)(h)

of the UK GDPR, subject to applicable professional confidentiality requirements.

7. Marketing Communications

We may occasionally communicate information regarding our services.

Where consent is required, we will obtain your consent before sending marketing communications.

You may withdraw your consent or unsubscribe from marketing communications at any time by:

 Clicking the unsubscribe link in emails;

 Contacting us directly; or

 Informing a member of staff.

We will never sell your personal information to third parties.

8. Who We Share Information With

We will only share your information where necessary and lawful to do so.

Recipients may include:

Recipient category Who this may include

Healthcare

Professionals

General Practitioners; consultants; surgeons; physiotherapists; other healthcare

providers involved in your care.

Service Providers Practice management software providers; secure IT and hosting providers;

payment service providers; professional advisers.

Regulators and Authorities

Information Commissioner's Office (ICO); courts and law enforcement agencies;

regulatory authorities where required by law.

Where we use service providers to process personal information on our behalf, we require them to protect

the information, maintain confidentiality and process it only in accordance with our instructions and

applicable data protection law.

9. International Transfers

We primarily store and process personal information within the United Kingdom.

We primarily store and process personal information in the United Kingdom. If a service provider transfers

personal information outside the UK, we will ensure that the transfer is permitted by data protection law and

protected by an appropriate safeguard, such as UK adequacy regulations or an approved transfer

mechanism. You may contact us for further information about the safeguard used.

10. Data Security

We use appropriate technical and organisational measures to protect your personal information from

unauthorised access, accidental loss, destruction, alteration or disclosure.

 Unauthorised access

 Loss

 Destruction

 Alteration

 Disclosure

Access to patient records is restricted to those who require it for legitimate business or clinical purposes.

All staff are subject to confidentiality obligations.

11. How Long We Keep Information

We keep personal information only for as long as necessary for the purpose for which it was collected,

including to meet legal, regulatory, professional, insurance and accounting requirements. The periods below

describe how long we generally retain clinical records.

Adult Patient Records

Clinical records are generally retained for a minimum of eight years following your last treatment.

Children's Records

Records relating to individuals under 18 years of age are generally retained until the individual reaches 25

years of age.

Retention periods may be extended where necessary to:

 Meet legal obligations;

 Defend legal claims;

 Satisfy insurance requirements; or

 Comply with professional guidance.

Following expiry of the applicable retention period, records will be securely destroyed or anonymised.

We do not use your personal information to make solely automated decisions that have legal or similarly

significant effects on you.

12. Your Rights

Under the UK GDPR, you may have the following rights in relation to your personal information. These rights

are not absolute and may apply only in certain circumstances.

Your right What it means

Right of Access Request a copy of the personal information we hold about you.

Right to Rectification Request correction of inaccurate or incomplete information.

Right to Restriction Request restriction of processing in certain circumstances.

Right to Object Object to specific types of processing, including direct marketing.

Right to DataPortability

Receive your personal information in a commonly used electronic format where applicable.

Right to Withdraw Consent

Where processing is based on consent, you may withdraw that consent at

any time.

Right to Erasure Request deletion of your information in certain circumstances.

Please note that healthcare providers are required to retain certain clinical records and therefore the right

to erasure may not always apply.

13. Making a Subject Access Request

If you wish to obtain a copy of the personal information we hold about you, please contact us using the

details provided in this Privacy Notice.

We may request proof of identity before releasing personal information.

We will normally respond within one month of receiving your request. If a request is complex or you make

several requests, the law may allow us additional time. We will tell you if an extension applies.

14. Cookies and Website Analytics

Our website may use cookies and similar technologies to:

 Improve website functionality

 Analyse website usage

 Enhance user experience

You can manage cookies through our website controls, where available, and through your browser settings.

Disabling some cookies may affect how the website works.

Further information is available in our Cookie Policy.

15. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so that we

can investigate and attempt to resolve your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO). We would appreciate

the opportunity to address your concerns first, but you may contact the ICO at any time. You may also be

able to complain to the data protection supervisory authority in the country where you live or work, or

where you believe an infringement occurred.

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk

16. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in legal requirements, business

practices or the services we provide.

When we make material changes to this Privacy Notice, we will publish the updated version on our website

and revise the “Last Updated” date at the top of the notice.

If you have any questions regarding this Privacy Notice, please contact Leyton Osteopaths using the

contact details provided above.