Privacy Policy
Last updated: 19 October 2026
Who we are
Haddenham Osteopaths is run by a company registered in England and Wales (company number 06852942) with its registered office at 26 Station Road, Watford, England, WD17 1JU. We are the data controller for the personal information described in this policy, which means we decide how and why it is used. You can contact us using the details on our Contact page.
This policy covers this website and the information we collect when you contact us or book an appointment. It explains how we use your information in line with the UK GDPR and the Data Protection Act 2018.
What information we collect
Depending on how you deal with us, we may collect:
- Contact details and messages. Your name, email address, phone number and the message you send through our contact form, by email or by phone.
- Booking details. Your name, contact details, date of birth and appointment times, held in our booking and records system, Cliniko.
- Health information. Your health history, symptoms, examination findings, treatment notes and consent records, collected when you become a patient. This is special category data and we treat it with extra care.
- Website usage information. Your IP address, browser and device type and the pages you visit, collected through cookies and similar technologies, depending on your cookie choices.
- Review information. Reviews that appear on our site come from Google and are public. We do not collect them from you directly.
Why we use your information and our lawful bases
What we do | Why | Lawful basis |
Reply to enquiries from the contact form, email or phone | To answer your questions and help you book | Legitimate interests, or steps taken at your request before a contract |
Book and manage appointments, send reminders | To provide the service you asked for | Contract |
Keep patient records and provide treatment | To give you safe, appropriate care and meet professional standards | Contract and legal obligation. For health data, the provision of health care (UK GDPR Article 9(2)(h)) |
Take payment and keep accounts | To process payments and meet tax and accounting duties | Contract and legal obligation |
Understand how the website is used | To improve the site | Consent, through our cookie banner |
Send you appointment or service updates | To keep you informed about your care | Contract or legitimate interests |
Send marketing emails (only if we offer this) | To tell you about our services | Consent, which you can withdraw at any time |
We do not sell your personal information, and we do not use it for automated decision making.
Who we share your information with
We only share information when we need to, and only with organisations that help us run the clinic or that we are legally required to tell. These include:
- Cliniko, our booking and clinical records provider
- WP Engine, which hosts our website
- Google, for the Maps embed, Google Reviews and, if enabled, analytics
- Our email, payment and IT support providers
- Your GP or another healthcare professional, but only with your agreement, unless the law requires or permits us to share without it (for example to protect someone from serious harm)
- Regulators, insurers, professional advisers or the authorities, where the law requires it
Where a provider is based outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.
We use cookies and similar technologies. Essential cookies make the site work and cannot be switched off. Other cookies, such as analytics and embedded content from Google, are only used if you agree through our cookie banner. You can change your choice at any time using the cookie settings link in the footer, or through your browser settings.
How long we keep your information
- Patient records: 8 years after your last treatment, or until a child patient reaches the age of 25, whichever is longer.
- Enquiries that do not become appointments: up to 12 months.
- Accounting records: 6 years, as required for tax purposes.
- Website analytics data: up to 14 months, depending on our analytics settings.
When the time is up, we securely delete or anonymise the information.
Keeping your information safe
We use sensible technical and organisational measures to protect your information, including secure hosting, access controls, encrypted connections (HTTPS) and a managed security service on our website. Records are kept in a secure system and only staff who need them can see them. No online system is completely secure, so please avoid sending sensitive health details through the contact form or by ordinary email. Talk to us or use our booking system instead.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct anything that is wrong or incomplete
- ask us to delete your information, although we may have to keep clinical records for the periods above
- ask us to restrict or object to how we use your information
- ask for your information in a portable format, where this applies
- withdraw your consent at any time, where we rely on it
To use any of these rights, contact us using the details below. We will normally reply within one month.
Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, and the date at the top shows when it was last changed.
Contact us
For any privacy question or request, please contact us using the details on our Contact page, or by post at 26 Station Road, Watford, England, WD17 1JU.