Privacy Notice
How We Collect, Use and Protect Your Personal Data
Version 1.0 | Date: 24 June 2026 | Review date: 2027
1. Who We Are
Narberth Chiropractic Clinic is a chiropractic practice operating from Picton Terrace, Spring Gardens, Narberth, Pembrokeshire SA67 7AW.
The Data Controllers are Rebecca Stopp and Matthew Burden, trading as Narberth Chiropractic Clinic. We are registered with the Information Commissioner’s Office (ICO).
ICO Registration Number: 00014563337
Contact: info@narberthchiropractor.co.uk | 01834 860200
2. What Personal Data We Collect
As a healthcare provider, we collect and process personal data including special category health data. The information we collect includes:
2.1 Personal and contact information
- Full name, date of birth, gender
- Address, telephone number, email address
- Emergency contact details
- GP name and surgery
2.2 Health and clinical information
- Medical history, current medication, and relevant past treatments
- Clinical notes, examination findings, and treatment records
- X-rays or other imaging if applicable
- Outcome measures and progress notes
2.3 Administrative information
- Appointment history and booking records
- Payment and billing information (we do not store full card details)
- Communications with us by telephone, email, or online booking
3. Why We Process Your Data (Legal Basis)
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following legal bases to process your personal data:
Provision of healthcare (Article 9(2)(h) UK GDPR): Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of healthcare, and management of healthcare systems.
Legitimate interests (Article 6(1)(f) UK GDPR): For administrative purposes such as appointment reminders and managing our practice.
Legal obligation (Article 6(1)(c) UK GDPR): Where we are required to retain records to comply with GCC requirements or other applicable law.
Consent (Article 6(1)(a) UK GDPR): For marketing communications such as newsletters. You may withdraw consent at any time.
4. How We Use Your Information
We use your personal data to:
- Provide safe and effective chiropractic care
- Maintain accurate and up-to-date clinical records
- Manage appointments and send reminders via our practice management software (JaneApp)
- Process payments for treatment
- Communicate with your GP or other healthcare providers where clinically necessary and with your consent
- Comply with our GCC registration obligations and professional standards
- Send you newsletters or health information (only with your explicit consent)
- Investigate and respond to complaints
5. How Long We Keep Your Data
We retain clinical records in line with guidance from the GCC and recognised standards for healthcare providers in the UK. As a general guide:
- Adult patient records: retained for a minimum of 8 years from the date of last treatment
- Children’s records: retained until the patient reaches age 25, or for 8 years from the last treatment, whichever is longer
- Deceased patients: retained for a minimum of 8 years from the date of death
Administrative records (such as appointment history and billing records) are retained for 6 years from the date of the last transaction, in line with HMRC requirements.
After the relevant retention period, records are securely deleted or destroyed.
6. Who We Share Your Data With
We do not sell your personal data. We may share your data with third parties only in the following circumstances:
- With your GP or other treating clinician, where clinically necessary and with your knowledge
- With third-party service providers who process data on our behalf (e.g. JaneApp for practice management, our remote reception service) — all bound by data processing agreements
- With regulatory bodies such as the GCC, where we are legally required to do so
- With our accountant or legal advisers, only to the extent necessary
- In an emergency, with emergency services or next of kin, to protect vital interests
We do not transfer your data outside the UK or EEA unless adequate protections are in place.
7. How We Keep Your Data Secure
We take the security of your personal data seriously. Our security measures include:
- Clinical records stored securely within JaneApp, which uses industry-standard encryption
- Access to clinical records restricted to treating practitioners only
- Paper records, where held, stored securely on premises
- Staff (including reception and administrative support) are bound by confidentiality obligations
- Devices used to access patient data are password-protected
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access: You have the right to request a copy of the personal data we hold about you (Subject Access Request).
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: In certain circumstances, you can ask us to delete your personal data. Note that our obligation to retain clinical records for defined periods may limit this right.
Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
Right to object: You can object to processing carried out under legitimate interests.
Right to withdraw consent: Where processing is based on consent (e.g. newsletters), you can withdraw this at any time.
Right to data portability: Where technically feasible, you can request your data in a portable format.
To exercise any of these rights, please contact us using the details in Section 1. We will respond within one calendar month. We may need to verify your identity before fulfilling a request.
9. Cookies and Website
Our website (www.narberthchiropractor.co.uk) may use cookies to improve your experience. Please refer to our separate Cookie Policy on the website for details. Our online booking system is provided by JaneApp — please refer to JaneApp’s own privacy policy for information about how they process data.
10. Complaints About Data Handling
If you have concerns about how we handle your personal data, please contact us in the first instance using the details in Section 1. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk
11. Changes to This Notice
We will review and update this Privacy Notice periodically, or whenever there are significant changes to the way we process personal data or to applicable law. The current version will always be available on our website and at the clinic on request.