Privacy notice

Who we are

The data controller is Khaled Ben Moussa, trading as Osteopath Lancing, 60 Sompting Road, Lancing, West Sussex BN15 9LD. Khaled is a sole practitioner and is responsible for deciding how your personal data is used.

If you have any questions about this notice or your personal data, email kbmosteopath@gmail.com or write to us at the address above.

What information we collect

We only collect the information we need to provide our services. This includes:

• Booking form: your name, email address, phone number, whether you are a new or returning patient, the treatment you're interested in, your age, gender, current GP, your main complaint (the reason for your visit) and, if you choose to tell us, how you heard about us.
• Contact form: your name, email address, phone number and the content of your message.
• Clinical records: notes made by your practitioner during your appointments, including your case history, examination findings, treatment and advice given.
• Basic technical information: our website host keeps short-term server logs (such as IP address, browser type and the pages requested) to keep the site secure and working properly.

Cookies and analytics

We do not use advertising or tracking cookies. To understand how our website is used, we use privacy-friendly analytics that do not use cookies and do not identify individual visitors.

The only cookie we set is a strictly necessary cookie used when the clinic owner logs in to the website's admin area. It is not set for patients or other visitors.

Health information

Information about your health, such as your main complaint and clinical notes, is 'special category' data under UK data protection law. We handle it with extra care, keep it confidential and only use it to provide and manage your care.

Our lawful bases for using your information

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following lawful bases:

• Contract (Article 6(1)(b)): to take steps at your request before providing treatment, such as booking your appointment, and to provide that treatment.
• Legitimate interests (Article 6(1)(f)): to run the clinic effectively, for example answering enquiries, keeping our website secure and keeping appropriate business records.
• Legal obligation (Article 6(1)(c)): to meet our legal, regulatory and professional obligations, including keeping clinical records.
• Consent (Article 6(1)(a)): to send you occasional news or marketing emails, only if you have opted in.
• For health information, we rely on Article 9(2)(h) (the provision of health care, by or under the responsibility of a health professional bound by a duty of confidentiality), together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. We also ask for your explicit consent to store and use your information for your treatment when you book.

How we use your information

We use your information to:

• Manage your appointments, including booking, rescheduling and cancelling.
• Send you booking confirmations and appointment reminders by email.
• Prepare for your visit and provide safe, appropriate treatment.
• Respond to your enquiries.
• Meet our legal and regulatory obligations, including those set by the General Osteopathic Council.
• Send you news or marketing emails, only if you have opted in. You can unsubscribe at any time using the link in any email or by contacting us.

Who we share your information with

We never sell your personal data. We use a small number of trusted service providers (data processors) to run our website and booking system. They only process your data on our instructions and must keep it secure:

• Supabase: secure database for bookings and enquiries, hosted in the London (UK) region.
• Resend: email delivery for booking confirmations, reminders and enquiry notifications.
• Netlify: website hosting.

Other sharing

We may also share information where the law requires it, or where it is necessary to protect you or someone else from serious harm. We would only share your health information with another health professional, such as your GP, with your consent unless there is a legal or safety reason to do so.

International transfers

Some of our service providers are US-based companies, so your data may sometimes be accessed from or processed outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US data bridge where the provider is certified under it.

How long we keep your information

We keep your information only for as long as we need it:

• Clinical records are kept in line with General Osteopathic Council and professional guidance: for adults, generally at least 8 years after your last treatment; for children, until their 25th birthday or 8 years after their last treatment, whichever is longer.
• Booking details for enquiries or appointments that were never attended are deleted after 2 years.
• Contact form messages are kept only as long as needed to deal with your enquiry, and no longer than 2 years.
• Marketing preferences are kept until you unsubscribe.

How we keep your information secure

We use appropriate technical and organisational measures to protect your information. This includes encrypted connections (HTTPS) on our website, restricted, password-protected access to booking data, and choosing service providers with strong security standards. Paper records, if any, are stored securely at the clinic.

Your rights

Under UK data protection law, you have the right to:

• Access the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete (rectification).
• Ask us to delete your information (erasure), where we are not required to keep it.
• Ask us to restrict how we use your information.
• Object to us using your information, including for direct marketing.
• Ask for your information in a portable format (data portability).
• Withdraw your consent at any time, where we rely on consent. This won't affect anything we did before you withdrew it.

How to exercise your rights

To make a request, email kbmosteopath@gmail.com or write to us at 60 Sompting Road, Lancing, West Sussex BN15 9LD. We may need to confirm your identity. We will respond within one month, and there is usually no charge.

Please note that we may not be able to delete clinical records before the end of the retention period, because we have a professional and legal duty to keep them.

Complaints

If you have a concern about how we handle your information, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or by calling 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last updated. If we make significant changes, we will let you know where appropriate.