Privacy Policy

Bure Valley Osteopaths
6 Penfold Street, Aylsham, Norfolk, NR11 6ET
Email: [email protected]
Telephone: 07555 348631

Last updated: November 2026

1. Introduction

At Bure Valley Osteopaths, we take your privacy seriously and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect your information when you visit our website, contact us, book an appointment or receive treatment at our clinic.

We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

Bure Valley Osteopaths is responsible for the personal information it controls. Where treatment is provided by a self-employed associate, responsibility for clinical information may be shared or held separately, depending on the arrangements in place.

2. What Information Do We Collect?

Depending on the services you use, we may collect:

Your name, address, telephone number and email address.
Your date of birth and relevant personal details.
Information about your medical history, symptoms, health conditions and medication.
Clinical assessment findings, treatment notes and relevant correspondence.
Appointment details and booking history.
Payment, deposit and transaction information.
Information you provide through our website, contact forms, telephone calls or emails.
Your preferences regarding newsletters and marketing communications.
Technical information collected when you visit our website, where applicable.

Health information is classified as special category personal data and is subject to additional legal protection.

We only collect information that is relevant and necessary for providing our services and operating the clinic.

3. How Do We Use Your Information?

We use personal information to:

Arrange, confirm and manage appointments.
Assess your symptoms and health concerns.
Provide appropriate treatment and advice.
Maintain accurate and confidential clinical records.
Contact you about appointments, treatment and follow-up care.
Process payments, deposits, invoices and refunds.
Respond to enquiries and requests.
Meet our legal, professional and regulatory obligations.
Manage the day-to-day administration of the clinic.
Send newsletters, health information, clinic updates and special offers where permitted by law.

We do not sell your personal information to third parties.

4. Our Legal Basis for Processing Your Information

Under UK GDPR, we must have a lawful basis for collecting and using personal information.

Depending on the circumstances, we may rely on:

Contract: Where processing is necessary to arrange appointments, provide services and manage payments.

Legitimate interests: Where processing is necessary for the effective administration and operation of the clinic, provided these interests do not override your rights and freedoms.

Legal obligations: Where information must be retained or disclosed to comply with applicable laws and regulations.

Consent: Where we rely on your permission, including for certain marketing communications and optional website cookies.

For sensitive health information, we also rely, where applicable, on Article 9(2)(h) of UK GDPR, which permits processing necessary for the provision of healthcare or treatment, together with the relevant safeguards under the Data Protection Act 2018.

Clinical information is handled in accordance with applicable professional confidentiality obligations.

Consent to receive treatment is separate from the legal basis used to process your personal information.

5. How Do We Store and Protect Your Information?

We take appropriate steps to protect your personal information against unauthorised access, loss, misuse or disclosure.

Patient records are maintained electronically using Cliniko, a specialist healthcare practice management system.

Some practitioners also maintain paper clinical notes. These are stored securely, with access restricted to authorised individuals who require the information for legitimate professional purposes.

Electronic records are protected through appropriate security measures, including password-protected access and access controls.

We take reasonable steps to ensure that any organisations processing personal information on our behalf provide appropriate data protection safeguards.

6. Self-Employed Associates and Independent Practitioners

Bure Valley Osteopaths provides osteopathy and offers additional treatments through self-employed associates.

Our associates may be independently responsible for some aspects of their patients' clinical information, depending on the nature of the service and the arrangements in place.

Where practitioners use the clinic's appointment management or record-keeping systems, personal information is handled in accordance with applicable data protection legislation and professional confidentiality requirements.

Some practitioners may also maintain their own paper clinical notes.

Independent practitioners who solely rent rooms at the premises operate separately from Bure Valley Osteopaths and are responsible for their own patient information and privacy arrangements.

7. Who Has Access to Your Information?

We treat your personal information confidentially and only share it where there is an appropriate reason and legal basis.

Depending on the services involved, relevant information may be accessed or processed by:

Your treating practitioner.
Authorised reception staff who manage appointments and enquiries.
Cliniko, which provides our electronic practice management and record-keeping system.
Cliniq Apps, where used for patient communications and clinic administration.
Best Reception, our external telephone answering and reception service.
Stripe and other relevant payment providers.
Authorised administrative staff and professional advisers, where necessary.
Other healthcare professionals, where appropriate and with a suitable legal basis.
Regulatory bodies or other authorities where disclosure is required by law.

Reception and administrative staff are only authorised to access information necessary for their duties. They do not routinely require access to detailed clinical records.

We do not disclose your medical information to unrelated third parties for marketing purposes.

Where external service providers process information on our behalf, we seek appropriate contractual and security safeguards.

8. Appointment Reminders and Communications

We may contact you by telephone, email or text message to:

Confirm or rearrange appointments.
Send appointment reminders.
Notify you of cancellations or changes.
Provide relevant information about your treatment or follow-up care.
Respond to enquiries.
Communicate about payments or outstanding balances.

These are service-related communications and are separate from promotional marketing.

We aim to avoid including unnecessary sensitive medical information in ordinary emails or text messages.

9. Email Newsletters and Marketing

We may occasionally send newsletters containing general health information, clinic news, advice, service updates and special offers.

We only send electronic marketing where permitted by applicable data protection and electronic marketing laws.

Where consent is required, we will obtain it before sending promotional communications.

You can unsubscribe at any time by using the unsubscribe link included in our marketing emails or by contacting [email protected].

Withdrawing consent or unsubscribing from marketing will not affect necessary appointment or treatment-related communications.

10. Online Bookings and Payments

When you book an appointment online, we collect the information necessary to arrange and manage your booking.

Online bookings and appointment information are managed through Cliniko.

Where a deposit or payment is required, payment information is processed through our payment service providers, including Stripe where applicable.

We retain relevant transaction records for accounting, refund, dispute resolution and legal purposes.

We do not need to store full payment card details within your clinical records.

11. How Long Do We Keep Your Information?

We retain personal information for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, professional, regulatory and insurance requirements.

Clinical records are retained in accordance with the requirements and guidance applicable to the relevant practitioner and type of treatment.

Different retention periods may apply to records relating to children.

Financial and administrative records are retained for the periods required by applicable law.

When personal information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.

Requests for deletion will be considered in accordance with applicable data protection legislation. Certain information, including clinical records, may need to be retained even where deletion is requested.

12. Website Cookies

Our website may use cookies and similar technologies to support essential website functions, remember preferences and understand how visitors use the website.

Cookies are small files stored on your device when you visit a website.

Some cookies are necessary for the website to function correctly. Other cookies, including certain analytics and marketing cookies, may require your consent.

Where consent is required, you should be able to accept or reject those cookies and change your preferences.

You can also manage or disable cookies through your browser settings, although this may affect certain website features.

Further information about the cookies used on our website should be available through our cookie information or consent controls.

13. Links to Other Websites

Our website may contain links to other websites, including external booking services and third-party resources.

Once you leave our website, we are not responsible for the privacy practices or content of those websites.

We recommend reviewing their privacy policies before providing personal information.

14. Your Data Protection Rights

Under UK data protection law, you may have the right to:

Request access to the personal information we hold about you.
Ask us to correct inaccurate or incomplete information.
Request deletion of personal information in certain circumstances.
Request restrictions on how your information is processed.
Object to certain types of processing.
Request transfer of your information where the right to data portability applies.
Withdraw consent where processing is based on consent.

These rights are subject to legal conditions and exceptions, particularly where clinical records must be retained for professional or legal reasons.

If you would like to exercise any of these rights, please contact [email protected].

We will respond in accordance with applicable data protection requirements, normally within one calendar month.

15. Complaints

If you have any concerns about how your personal information is handled, please contact us so that we can investigate.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Website: https://ico.org.uk

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, our services or how we handle personal information.

Any changes will be published on this page, together with the date of the latest update.

17. Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact:

Bure Valley Osteopaths
6 Penfold Street
Aylsham
Norfolk
NR11 6ET

Email: [email protected]
Telephone: 07555 348631