Farnham Chiropractic Clinic Privacy Policy
Effective Date: July 2022
Last Updated: July 2026
At Farnham Chiropractic Clinic, we take your privacy seriously. This privacy policy describes how we collect, use, process, and protect your personal information and healthcare data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Farnham Chiropractic Clinic is the “data controller” for the purposes of data protection laws.
Clinic Address: 1 South Avenue, Farnham, Surrey GU9 0QY
Phone Number: 01252 710549
Email Address: info@farnhamclinic.co.uk
Data Privacy Contact: Mandy Hammond, Practice Manager
Information We Collect
We collect data to provide safe, effective chiropractic care. This includes:
Personal details: Full name, date of birth, gender, and contact details (address, phone, email).
Medical information: Health history, symptoms, previous injuries, lifestyle details (smoking/drinking habits), medications, and surgeries.
Clinical records: Examination notes, diagnosis details, treatment plans, X-rays, MRI scans, and progress reports.
Financial data: Billing information, payment methods, and treatment transaction history.
Legal Basis for Processing
We process your data under the following legal frameworks:
Contract: To establish a patient-practitioner relationship and deliver your requested chiropractic care.
Legal Obligation: To comply with statutory healthcare retention and reporting laws.
Legitimate Interests: To send appointment reminders, manage schedules, and process payments securely.
How We Share Your Information
Your information is kept strictly confidential. We will never sell or share your data with third parties for marketing purposes. We only share your data under the following strict conditions:
- With Your Explicit Consent: To update your GP, consultant, private medical insurer, or legal representative regarding your treatment.
- Referrals: To external diagnostic facilities if you require private X-rays, MRI scans, or blood tests.
- Third-Party Processors: Secure cloud-based Clinic Management Software (CMS) providers that host our patient records. These processors are contractually bound by strict data processing agreements.
- Legal Requirements: If required by law, court order, or to prevent a serious threat to life or public health.
Data Security and Storage
We protect your data using industry-standard technical and organisational security measures:
Physical records: Stored in locked filing cabinets, secure clinic premises.
Digital data (GP letter etc): Stored on encrypted, password-protected secure local computers.
Staff access: Restrictive access ensures only authorised clinical and administration staff view relevant files.
Data Retention
By health regulation standards, we have a legal obligation to retain adult patient clinical records for a minimum of 8 years after your last appointment. For children, records are retained until their 25th or 26th birthday, depending on their age at the conclusion of treatment.
Your Legal Rights
You have specific rights regarding your personal information:
Right of Access: You can request a free copy of your patient file at any time.
Right to Rectification: You can ask us to correct inaccurate or incomplete details.
Right to Erasure: You can request data deletion, provided the statutory 8-year healthcare retention period has passed.
Right to Object/Withdraw: You can withdraw marketing or communication consent at any time.
To exercise these rights, please contact our Practice Manager in writing. We will verify your identity before releasing any sensitive medical information.
Policy Updates
We may update this policy periodically to reflect changes in local laws or clinic procedures. The latest version will always be available on our website and at our clinic reception.
4. How We Share Your Information
Your information is kept strictly confidential. We will never sell or share your data with third parties for marketing purposes. We only share your data under the following strict conditions:
- With Your Explicit Consent: To update your GP, consultant, private medical insurer, or legal representative regarding your treatment.
- Referrals: To external diagnostic facilities if you require private X-rays, MRI scans, or blood tests.
- Legal Requirements: If required by law, court order, or to prevent a serious threat to life or public health.
5. Data Security and International Transfers
We implement robust physical and electronic security measures to safeguard your data:
- Physical files are kept in locked cabinets
- Electronic records are stored on encrypted, password-protected servers with restricted staff access.
- All data is stored within the UK or the European Economic Area (EEA. If any third-party software transfers data outside the UK, we ensure standard contractual clauses are in place to guarantee an equivalent level of protection.
6. Data Retention Periods
In line with UK statutory healthcare retention periods and GCC guidelines, we retain clinical records for the following minimum periods:
- Adult Patients: 8 years following your last recorded appointment.
- Children and Young People: Until the patient’s 25th birthday (or 26th birthday if they were 17 at the conclusion of their last treatment).
- Deceased Patients: 8 years following the date of death.
Once these retention periods expire, your physical records will be securely shredded, and digital records will be permanently deleted.
7. Your Legal Rights
Under the UK GDPR, you have the following rights regarding your personal data:
- Right of Access (Subject Access Request): You have the right to request a free copy of your medical records and personal data. We must provide this within one calendar month.
- Right to Rectification: You can ask us to correct any inaccurate or incomplete information.
- Right to Restriction: You can request that we restrict the processing of your data in certain circumstances.
- Right to Erasure (Right to be Forgotten): You can request the deletion of your data. Please note: We cannot delete active clinical records if they fall within the mandatory 8-year statutory retention period.
To exercise any of these rights, please contact our Data Protection Lead in writing using the contact details provided in Section 1.
8. How to Complain
If you have any concerns about how we handle your data, please contact us directly so we can resolve the issue. If you remain unsatisfied, you have the right to lodge a complaint with the UK supervisory authority:
- Information Commissioner’s Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113 / Website: https://ico.org.uk