Your Body In Harmony - Privacy Notice

1. Introduction

This Privacy Notice explains the types of personal data we may collect about you when you interact with us. It also explains how we’ll store and handle that data, and keep it safe.

‘We’ refers to Your Body in Harmony, 1A Wilga Road, Welwyn, Herts, AL6 9PT

GDPR – the EU law on data protection – sets out a number of different reasons for which an organisation may collect and process your personal data. We are allowed to collect your data with:

Contract – if we need to process your data in order to fulfil our contractual obligations or because you have asked us to do something before entering into a contract, (such as to provide information to you to answer an enquiry).

Consent – In specific situations, we can collect and process your data with your consent – such as when you provide your email address so that we can send you our email updates, (we only do this with your permission).

Legitimate Interest

In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our osteopathy practice – such as details of any illnesses, injuries or conditions that may affect which treatments we are able to offer you. (Some treatments may not be suitable for certain medical conditions, for example.)

The other lawful bases for processing your data are:

• Vital Interest – if we need to process your personal data to protect your life, (such as during a medical emergency).
• Public Interest – this basis enables us to process your data if we need to perform a specific task in the public interest that is set out in law, (such as reviewing our operation as part of a HMRC investigation).
• Legal Obligation – we are able to process your personal data to comply with a common law or statutory obligation, (such as complying with a court order)

2. When your data is collected

• When you contact us with an enquiry
• When you book an appointment with us
• When you engage with us on social media
• When you enter our prize draws or competitions
• When you attend exhibitions and engage with us at our stand

3. What data is collected

• Medical Information

For the purposes of providing treatment, we require detailed medical information. We will only collect what is relevant and necessary for your treatment. When you visit our clinic, we will make notes which may include details concerning your medication, treatment and other issues affecting your health. This data is always held securely, and is not shared with anyone.

It is a condition of any treatment that you give your explicit consent to allow us to document and process your personal medical data. Contact details provided by you such as telephone numbers, email addresses, postal addresses may be used to remind you of future appointments and provide reports or other information concerning your treatment.

We may also use the contact details provided by you to respond to your enquiries, including making telephone contact and emailing information which we believe may be of interest to you, such as changes to appointment availability at our various clinic locations.

• If you enter our prize draws or meet us an exhibition, we will ask for your name, contact details and permission to send you our updates by email.
• If you win a prize we may use your contact details to ask you about any illness/condition to ensure that any prizes offered, such as treatments for example, are suitable for you.
• Your social media username, if you interact with us through those channels, to help us respond to your comments, questions or feedback.

4. How we use your personal data

We will only collect the information needed so that we can provide you with the treatment you require. We may use this data to:

• Respond to your enquiries and requests
• Book appointments for you
• With your consent, we will keep you informed by email of news and tips
• Administer any of our prize draws or competitions which you enter, based on your consent given at the time of entering.
• Develop and improve the systems and services we provide to you. (We’ll do this on the basis of our legitimate business interests, which falls within the remit of the General Data Protection Regulation.)
• To send you survey and feedback requests to help improve our services. These messages will not include any promotional content and do not require prior consent when sent by email or text message. We have a legitimate interest to do so as this helps make our products or services more relevant to you.

5. How we protect your personal data

Our electronic data is held on secure computer systems. Any information held on paper forms is kept in locked cabinets on site at our clinic locations.

Marketing related data is held in online systems which are password protected and are GDPR-compliant (EU-based) or have certified compliance with the EU-US Privacy Shield Framework, (US-based).

6. How long will we keep your personal data?

We will process personal data during the duration of any treatment and will continue to store only the personal data needed for seven years after the contract has expired to meet any legal obligations. After seven years all personal data will be deleted, unless basic information needs to be retained by us to meet our future obligations to you. Records concerning a minor who has received treatment will be retained until the child has reached the age of 25.

At the end of that retention period, your data will be deleted from our online systems and/or shredded confidentially.

7. Who we share your personal data with

We will never share your data externally without your consent and do not share your data for marketing purposes.

8. Where your data may be processed

We use paper and online systems to progress enquiries, manage bookings and store data. Our online systems comply with the security requirements of the General Data Protection Regulation. Paper records are processed securely at our clinic locations.

9. Your rights

You have the right to request:

• Access to the personal data we hold about you.
• The correction of your personal data when incorrect, out of date or incomplete.
• That we stop using your personal data for direct marketing (either through specific channels, or all channels).
• That we stop any consent-based processing of your personal data after you withdraw that consent.

Your right to withdraw consent:

• Whenever you have given us your consent to use your personal data, you have the right to change your mind at any time and withdraw that consent.
• You have the right to stop the use of your personal data for direct marketing activity through all channels, or selected channels. We must always comply with your request. You can stop direct marketing communications from us by clicking the ‘unsubscribe’ link in any email we send you, or by writing to: Your Body in Harmony, 1A Wilga Road, Welwyn, Herts, AL6 9PT.
• In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop at any time. However – we will not be able to keep you informed of important, relevant updates about our services. For example – you will need to know about any changes to our pricing or appointment availability.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

10. Enquiries and concerns

If you think that there is a problem with the way we are handling your data you have the right to complain to us. If you do not get a response within 30 days, you can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

The Data Protection Officer is Christina Raven who can be contacted via email at christina@yourbodyinharmony.co.uk  or by writing to Your Body in Harmony, Wilga Road, Welwyn, Herts, AL6 9PT.