Who is responsible for your information
Warwick Health Ltd, company number 16916623, is responsible for the personal information it controls. Contact our privacy lead through reception@warwickhealth.co.uk, on 01926 356631, or at Northgate House, Northgate South Side, Warwick, CV34 4JH. Please mark privacy enquiries for the attention of the Privacy Lead.
What we collect and where it comes from
We collect information you provide when you enquire, book, complete forms, attend appointments, pay or contact us. This may include your name, date of birth, address, contact details, appointment and payment history, communication preferences and access needs.
For care, we record relevant health information, symptoms, medical history, medicines, examination findings, assessments, care plans, consent discussions, referrals and progress. We may receive relevant records or reports from your parent or authorised representative, GP, another treating clinician, imaging provider, laboratory or insurer, where sharing is appropriate and lawful.
For children, we may record parent or guardian contact details and relevant information about parental responsibility. An emergency contact is used when appropriate to the circumstances, rather than for routine marketing.
Our website and booking services may also receive technical information such as IP address, browser information and security logs. The specific cookies and local-storage technologies used are described separately below. Please avoid sending detailed medical information through social media; ask reception about an appropriate route for sharing records.
Why we need information
We use relevant information to respond to enquiries, arrange appointments, assess and provide care, communicate with you, coordinate appropriate referrals, take payment, maintain records, resolve concerns and meet legal and professional obligations.
Information needed for safe assessment or to administer your booking is necessary to provide the service. If you choose not to provide it, we will explain whether we can proceed or need to limit or postpone care. Optional marketing and media permissions are not conditions of receiving treatment.
Children and confidentiality
We explain information use in a way suited to a child’s understanding. A parent’s request for access to a child’s information is considered in light of parental responsibility, the child’s capacity, wishes, welfare and confidentiality. Parents do not automatically have unrestricted access to every record.
How we use and share information
Our lawful bases
Appointments and the care you request: we use information needed to arrange and fulfil our contract with you under UK GDPR Article 6(1)(b). When the patient is not the contracting person, such as a child, we rely on legitimate interests under Article 6(1)(f), where appropriate, to arrange and provide their requested care while protecting their rights.
Professional records, accounting and other applicable legal duties: Article 6(1)(c), where a specific legal obligation applies. Service administration, proportionate security, quality review and handling ordinary concerns: Article 6(1)(f), for our legitimate interests in running a safe and accountable clinic. We consider the effect on your rights before relying on this basis.
Health information used for assessment, treatment and healthcare management is additionally handled under Article 9(2)(h) and the relevant UK health or social care provisions, subject to professional confidentiality. Information necessary for legal claims may be processed under Article 9(2)(f). Safeguarding or exceptional disclosures require the particular legal basis and special-category condition appropriate to the circumstances; they are not a general permission to share records.
Optional marketing uses consent under Article 6(1)(a). Identifiable media containing health information requires explicit consent under Article 9(2)(a) as well. Consent to treatment is a separate clinical requirement; withdrawing optional marketing consent does not require us to erase records we must retain.
Who may receive information
Access is limited to relevant clinicians, authorised administrative staff and service providers who need it for their role. Suppliers may support booking and clinical records, secure IT and hosting, communications, payments and professional accounting or legal advice. They must have appropriate confidentiality and data-protection arrangements.
PracticeHub supports our online booking. The booking address includes Kenilworth’s name, so please check the selected clinic. Relevant information may also be shared with your GP, referral clinician, imaging provider or another professional involved in your care. We explain routine referral sharing and respect confidentiality requirements. We may disclose information where required by law, for regulatory duties, safeguarding or the defence of legal claims.
Where a service provider processes information outside the UK, appropriate UK data-protection transfer requirements must be met. You can contact our privacy lead for information about the providers used for your care and any applicable transfer safeguards.
Recordings and publicity
Participation in identifiable photographs, video, teaching material or publicity is optional and needs separate permission for the stated use. We explain the audience and retention period before recording. Refusal will not affect care. You may withdraw permission for future use; we explain any practical limits on retrieving material already distributed. Clinical recording must never be assumed from a booking.
Keeping information and your rights
How long we keep information
Chiropractic patient records are retained for eight years after the last visit. For children, records are retained until their 25th birthday, or 26th birthday if they were 17 at the end of treatment. A longer period may be justified, for example by an unresolved claim or another applicable requirement; we document and review the reason.
When information is no longer needed, we securely destroy it or irreversibly anonymise it. We use access controls and appropriate technical and organisational safeguards, and review who needs access to patient information.
For other records, we determine retention by the reason they were collected, applicable professional and legal requirements, and any unresolved complaint or claim. Enquiries are kept only while needed to respond and administer the enquiry; financial records for applicable accounting and tax requirements; and consent records while needed to demonstrate and manage the permission given. Contact our privacy lead for information about your particular records.
Your data protection rights
You can ask for access to your personal information and correction of inaccuracies. Depending on the purpose and lawful basis, you may also request erasure, restriction of use or a portable copy. These rights are not absolute: for example, we may need to keep a clinical record despite a request to delete it.
You have the right to object to processing based on legitimate interests because of your particular circumstances. You can object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting the lawfulness of earlier use.
Contact our privacy lead through reception to exercise your rights. We may need proportionate evidence of identity or authority. We normally respond to access requests within one month and without charge. If a lawful extension or another exception applies, we will explain it and your options.
If you are unhappy with our use of information, contact us so we can investigate. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not have to complete our complaints procedure before contacting the ICO.
Website technologies and communications
Our embedded booking form connects to PracticeHub when you choose to load it. The booking service uses browser storage for booking functions and marketing attribution, including information about how you reached the booking page. You can use the separate booking page instead, which also operates under the booking provider’s technology settings, or arrange your appointment by telephone or email. Links to social media take you to those providers’ websites, where their own privacy and cookie information applies.
Booking confirmations, appointment reminders and messages about your care are service communications. Optional promotional emails or texts require a separate choice, and each will explain how to unsubscribe. Choosing not to receive marketing will not affect your care.
We review this notice when our services or information practices change. The current version and effective date will be available on our website and from reception.