Data Protection / Privacy Policy for Back in Action Chiropractic Limited
Last reviewed: June 2026
Why we collect your personal data and what we do with it
Your personal details are stored and processed for four reasons (noted in inverted commas below) under the Data Protection Act 2018, which includes the General Data Protection Regulation (GDPR):
- Your requesting treatment and our agreement to provide that care constitutes a “Contract”. We need to collect personal information about your health in order to provide you with the best possible treatment.
- We have a “Legitimate Interest” in collecting that information because without it we could not perform our duties under the Contract effectively and safely.
- We also have a “Legitimate Interest” in being able to contact you to confirm your appointments with us or to update you on matters related to your health care.
- If we have your “Consent” we may occasionally send you general health information in the form of articles, advice or newsletters. You may withdraw your consent at any time — just let us know in writing or by email.
We have a Legal Obligation under the Chiropractors Act 1994 to retain your records for eight years after your most recent appointment (or until age 25 if this is longer). After this period you can ask us to delete your records if you wish. If not, we will retain your records indefinitely in order that we can provide you with the best possible care should you need to see us at some future date.
Confidentiality
We will never pass your personal information to third parties without prior notice and written consent from you, save for the rare circumstance when your data is requested by a government agency in relation to, for example, a public health emergency, crime, or reasons of national security.
Confidential patient information is only accessible to staff at this clinic with a direct and appropriate need to do so:
- Your practitioner(s) or therapist(s), in order that they can provide you with treatment
- Our reception staff, because they organise our practitioners’ and therapists’ diaries, prepare patient files, and coordinate appointments and reminders
- Our administrative staff, such as our bookkeeper and database staff
Financial transactions
A record of receipts and payments for services and products supplied is maintained in the clinic software. We do not collect any credit or debit card information directly, as this is processed via [PAYMENT PROVIDER NAME]’s secure payment service. However, in accordance with finance industry practice we are required to keep a copy of the paper card receipt (which contains part of your card number) for two years from the date of the transaction, after which it is securely destroyed.
Storage
Registration forms and manual notes are stored in the clinic. Most of the information on registration forms is entered in the clinic software and is the responsibility of Back in Action Chiropractic Limited, as are the details of those who have requested articles or newsletters by email or via the website.
[PRACTITIONER RECORDS CLAUSE — include only if this still applies; otherwise delete this paragraph. Suggested wording: “Some of our practitioners and therapists are self-employed and act as separate data controllers for their own patients. The registration forms and manual notes relating to their patients are retained by them. This currently applies to: NAME(S).”]
Manual notes made by our chiropractors and therapists are currently kept in patient files but will, in time, be scanned into the clinic software. Paper records are kept in locked filing cabinets or offices. Computers are password-protected, backed up regularly, and the building is alarmed out of working hours.
Off-site backups
The clinic software is backed up daily to our software supplier (data processor), who uses third-party hosting companies.
Website
We keep lists of email addresses and the corresponding first name in the website software, which is maintained by another of our data processors. In the event of a request to unsubscribe an email address, or if an address fails (the message “bounces”), the address is deleted from the current list.
Cookies and website analytics
Our website uses cookies — small text files placed on your device — to help the site function and to understand how visitors use it so that we can improve it.
We use Google Analytics, a web analytics service provided by Google, to collect information about how visitors use our website, such as which pages are visited, the approximate (non-precise) location, the type of device used, and how visitors arrived at the site. This information is aggregated and is not used to identify you personally. Google processes this data on our behalf as a data processor and may store it on servers outside the UK; Google’s own use of data is governed by its own privacy policy.
Non-essential cookies, including those set by Google Analytics, are only used with your consent. When you first visit the site you can choose which cookies to accept via our cookie banner, and you can change your choice or withdraw consent at any time. You can also control or block cookies through your browser settings, and you can opt out of Google Analytics on all websites using Google’s official browser add-on. Please note that blocking some cookies may affect how parts of the website work.
Request for data held
In accordance with the Data Protection Act 2018 you may request a copy of the personal data we hold about you, including your patient record, at any time. We will provide this free of charge and within one month of your request. We may only charge a reasonable fee, or decline a request, where the request is manifestly unfounded, excessive or repetitive, or where you ask for further copies, as permitted by law.
Opting out
We want to make sure that the information we hold about you is correct and up to date. If you believe the information we have for you is inaccurate, you can ask us to correct or remove it (subject to the legal requirements mentioned above). Please either write to us at 28 Cop Lane, Penwortham, Preston, PR1 0SR or email us at reception@back-in-action.com.
If you are not satisfied with our response you have the right to raise the matter with the Information Commissioner’s Office.
© Back in Action Chiropractic Ltd. All Rights Reserved.