Amersham Osteopathic Clinic (AOC) respects your privacy and is committed to protecting your personal and health information. This notice explains what information we collect, why we use it, how it is stored and protected and your rights in relation to it.
For the purposes of UK data protection law, Karen Carroll is the data controller for the personal information described in this notice. This notice relates principally to information collected when you contact or attend Amersham Osteopathic Clinic for consultation or treatment.
Information about the use of this website and cookies is available in our separate Website Privacy and Cookies Notice.
Information we collect
To provide safe and appropriate care, your Osteopath needs information about your health. This may include your:
- medical history and current health
- medication
- previous and current treatment
- symptoms
- examination and assessment findings
- treatment provided
- other information relevant to your health and wellbeing
We also collect information needed to administer your care, including your name, date of birth, address and contact details and records of relevant correspondence, appointments and payments.
Where appropriate, we may also receive relevant information from other healthcare professionals, medical insurers, parents or guardians or others involved in your care.
We only collect information that is relevant and reasonably necessary for your care or the administration of the clinic.
Why we use your information
We use your information to:
- assess, provide and document your osteopathic and other clinical care;
- maintain an appropriate clinical record and provide continuity of care;
- communicate with you about your treatment and appointments;
- administer the clinic and your account;
- respond to enquiries; and
- meet our professional, regulatory and legal obligations.
We do not rely on your consent as the legal basis for creating and maintaining the clinical record necessary to provide your care.
Depending on the purpose for which we use your information, we rely on one or more lawful bases under UK data protection law. These include processing that is necessary to provide services under our contract with you, to comply with applicable legal obligations and for our legitimate interests in providing, documenting and administering safe clinical care.
Health information is special category personal data. We process this where necessary for the provision and management of healthcare and treatment in accordance with Article 9(2)(h) UK GDPR and applicable UK data protection law. Osteopaths are also subject to professional duties of confidentiality.
Where we rely on consent for a particular activity, you may withdraw that consent at any time. This does not affect our ability or obligation to retain and process your clinical records under another applicable legal basis.
We need sufficient relevant information to assess and treat you safely. If you choose not to provide information that is necessary for your care, we may be unable to provide some or all of the consultation or treatment requested.
We do not use your clinical information for automated decision-making or profiling.
Who has access to your information
Your clinical records are accessible only to clinicians involved in your care and other authorised persons where access is reasonably necessary.
Clinic administrative staff may access the contact, appointment and account information required to carry out their duties but do not routinely access your clinical history.
We will not sell your personal information or disclose it to third parties for marketing purposes.
There may be circumstances where relevant information needs to be shared with another healthcare professional, such as your GP or consultant, or with a medical insurer. We will normally discuss this with you first and obtain permission where appropriate.
Information may also be disclosed where required by law or regulation, or where there is another overriding legal or professional justification.
How we store and protect your information
Clinical and administrative information is stored using appropriate physical, electronic and organisational security measures.
Electronic clinical records are held on access-controlled devices and are backed up securely for continuity of care and disaster recovery. Access to patient information is restricted to authorised persons and devices.
We use selected third-party service providers where necessary for functions such as IT, communications, secure storage and backup and clinic administration.
Some electronic services may involve personal information being processed or stored outside the UK. Where this involves an international transfer under UK data protection law, an appropriate lawful transfer mechanism is used, such as applicable UK adequacy arrangements or appropriate contractual safeguards. You may contact us for further information about the safeguards applying to international transfers of your information.
How long we keep your clinical records
The General Osteopathic Council requires patient records to be retained for a minimum of eight years after the last consultation, or, where the patient is a child, until at least their 25th birthday.
AOC may retain clinical records beyond these minimum periods where there remains a reasonable clinical, professional, regulatory or legal need to do so. This may include continuity of care if you return to the clinic after a prolonged interval; responding to a complaint or regulatory matter and establishing, exercising or defending legal claims.
Retention is reviewed periodically. Information will not be retained for longer than there is a reasonable clinical, professional, regulatory or legal purpose for keeping it and will be securely disposed of when no longer required.
Arrangements are maintained for the secure retention and appropriate access to clinical records should an Osteopath cease practising, die or become unable to practise. Information about how records may be accessed in those circumstances will be made available through the clinic or, where applicable, its nominated records custodian.
Your rights
Under UK data protection law you have rights concerning your personal information. Depending on the circumstances, these include the right to:
- request access to the information we hold about you
- ask us to correct inaccurate or incomplete information
- ask us to restrict the way information is processed
- request erasure of information where the legal requirements for erasure are met
- receive or transfer certain personal information in a portable format where the right to data portability applies
These rights are not all absolute and which rights apply may depend upon the purpose and legal basis for processing.
In particular, we may need to retain clinical records despite a request for erasure where there is an ongoing clinical, professional, regulatory or legal reason to do so.
Your right to object
Where we rely on legitimate interests as our lawful basis for processing your personal information, you have the right to object to that processing. We will consider any objection in accordance with UK data protection law.
If you wish to exercise any of your data protection rights, please contact us using the details below.
Questions, concerns and complaints
If you have any questions about the information we hold about you, wish to exercise your data protection rights or wish to make a complaint about the way AOC collects, uses, stores, shares or otherwise handles your personal information, please contact:
Karen Carroll
Amersham Osteopathic Clinic
Caer Sidhe, Chiltern Road
Amersham HP6 5PH
Telephone: 01494 434 651
or by email
You may make a data protection complaint to us using any of the contact details above. We will acknowledge a data protection complaint within 30 days and investigate it without undue delay, keeping you informed as appropriate.
We would welcome the opportunity to investigate and address any concern directly.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO) if you are dissatisfied with the way your personal information has been handled.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: Information Commissioner’s Office
Keeping this notice up to date
We review this privacy notice periodically and may update it where our services, legal obligations or the way we process personal information change.
Last updated: August 2026
