Privacy Policy
Privacy Policy
It supplements any additional privacy information we may provide when collecting particular information and should be read alongside any other relevant notices.
Data Controller
We take our data protection responsibilities seriously and aim to handle your personal information in accordance with applicable data protection legislation and the professional standards relevant to our practitioners.
If you have any questions about this Privacy Notice or how we handle your personal data, please contact us.
You also have the right to raise concerns with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at www.ico.org.uk.
Depending on the services you receive and how you interact with us, we may collect, use and store the following categories of personal data.
Identity and contact data– Your name, address, email address, telephone number and, where required, date of birth.
Medical and health data– Your medical history, current symptoms, relevant diagnoses, medication, allergies, clinical assessments, consultation notes, treatment plans and information about the treatment provided and your progress. Health information is special-category personal data under the UK GDPR and receives additional protection.
Photographs and videos– With appropriate permission, we may take photographs or short videos to demonstrate exercise techniques, assess movement or monitor treatment progress. Any use beyond your care, such as marketing or publicity, will be considered separately and will require an appropriate lawful basis and permissions.
Financial and payment data– Information relating to payments, invoices and transactions. Card details may be processed directly by our payment provider, depending on the payment method used.
Insurance and referral data– Information from your nominated insurer, NHS services or other healthcare professionals where relevant to your treatment, referral, authorisation or reimbursement.
Marketing and communication data– Your newsletter preferences, communication preferences and correspondence with us.
Website and technical data– Information submitted through website contact forms and online booking facilities, details of transactions and bookings, information about technical problems, and information about your visits to our website and the resources you access. Technical data and cookie information may also be collected where applicable.
How We Collect Your Data
We primarily collect information directly from you, including when you:
- Register with us or complete patient and medical history forms.
- Book an appointment online or contact us directly.
- Attend a consultation, assessment or treatment session.
- Make a payment or purchase a service or product.
- Contact us with a question, concern or complaint.
- Subscribe to our newsletter or use our website.
Where information is provided by another healthcare professional or organisation, it should be shared in accordance with applicable law and the relevant confidentiality and information-sharing arrangements.
We do not buy personal data lists from third parties.
How We Use Your Personal Data
We process your personal information for purposes including:
- Arranging, managing and confirming appointments.
- Carrying out medical and therapeutic assessments.
- Providing appropriate treatment and maintaining clinical records.
- Recording the treatments provided and monitoring progress.
- Communicating with you about appointments, changes and relevant services.
- Preparing invoices and processing payments.
- Supporting insurance claims and referrals where applicable.
- Meeting legal, regulatory and professional obligations.
- Managing complaints, enquiries and concerns.
- Administering and improving our website and online booking facilities.
- Maintaining the security of our systems and preventing misuse.
- Supporting clinical documentation using AI-enabled tools, where applicable, as explained below.
- Contract– Where processing is necessary to arrange or provide services you have requested.
- Legal obligation– Where we must comply with legal, accounting, regulatory or record-keeping requirements.
- Legitimate interests– Where processing is necessary for legitimate business purposes, provided your rights and interests do not override those interests.
- Consent– Where you have freely agreed to a specific use of your information, such as certain optional marketing activities or photographs and videos where consent is the appropriate basis.
We may use, or introduce, artificial intelligence (AI)-enabled tools to assist with clinical documentation, notes transcribing and related administrative tasks.
These tools may help practitioners prepare, organise or summarise clinical notes. They are intended to support practitioners and do not replace professional clinical judgement or responsibility.
Where an AI-enabled tool processes personal or health information, we will take appropriate steps to ensure that its use complies with applicable data protection law, confidentiality obligations and relevant professional standards. This includes assessing the tool’s suitability, security, data handling practices and contractual arrangements, and establishing an appropriate lawful basis and special-category condition for the processing.
Depending on the tool used, information may be processed by an external technology provider. We will apply appropriate safeguards and provide further information where required about how personal data is processed.
AI-generated material will be managed in accordance with our clinical and professional responsibilities. We will not treat AI output as a substitute for the practitioner’s own professional assessment and responsibility.
If you have questions about AI-assisted clinical documentation and your personal information, please contact us at info@theforgeclinic.com.
We may send newsletters or other marketing communications where you have consented to receive them or where another lawful basis and the applicable electronic marketing rules permit us to do so.
You can stop receiving newsletters at any time by:
- Clicking the unsubscribe link in the email, where available; or
- Emailing info@theforgeclinic.com.
Opting out of marketing will not prevent us from sending essential communications about your appointments, treatment, payments or other services you have requested.
We may share relevant personal data where necessary and lawful with:
- Healthcare professionals involved in your care, including your nominated health professional.
- Your nominated insurance company, where relevant to your treatment or claim.
- NHS services where applicable.
- Other healthcare providers or diagnostic service providers involved in your care.
- Booking, payment, clinical-record, IT and other service providers acting on our behalf.
- Professional regulators, courts, law enforcement agencies or other authorities where required or permitted by law.
We only share information that is appropriate and necessary for the relevant purpose and apply suitable safeguards where required.
We do not sell or rent your personal information to third parties. We do not share your information with third parties for their own marketing purposes.
We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure.
Access to personal information is restricted to people who need it for legitimate purposes, subject to appropriate confidentiality and professional obligations.
Where we use external service providers, we take appropriate steps to ensure that personal information is handled securely and in accordance with applicable requirements.
If a personal data breach occurs, we will assess and manage it in accordance with the law, including notifying the ICO and affected individuals where required.
Retention periods may vary depending on the type of information and the circumstances.
- Adult medical records- retained eight years from the date of last treatment.
- Child medical records- retained eight years after their 18th birthday or until 25 years of age (providing they have not had any further treatments in that time).
- Financial records: retained for seven years to comply with tax regulations.
- Booking and correspondence records- retained for as long as necessary to manage appointments, respond to enquiries and meet relevant obligations.
- Marketing records- retained as necessary to manage subscriptions and preferences, including records needed to respect opt-out requests.
- Website and technical data- retained according to the purposes for which it was collected and the arrangements of the relevant systems.
Under the UK GDPR, you have rights in relation to your personal data. Depending on the circumstances, these include:
Access- You can request a copy of the personal data we hold about you.
Correction– You can ask us to correct inaccurate or incomplete information.
Erasure– You can request deletion of your personal data in certain circumstances. This right is not absolute, and we may need to retain clinical records to meet legal, professional or other lawful obligations.
Objection– You can object to certain types of processing, including processing based on legitimate interests. You have an absolute right to object to the use of your data for direct marketing.
Restriction– You can ask us to restrict the processing of your personal data in certain circumstances.
Data portability– Where the legal requirements are met, you can request certain personal data in a structured, commonly used and machine-readable format or ask for it to be transferred to another organisation.
Withdrawal of consent– Where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing carried out before you withdrew consent.
These rights are subject to applicable legal conditions and exemptions. For example, we may be required to retain some healthcare records even if you request their deletion.
To exercise your rights, please contact info@theforgeclinic.com. We may need to verify your identity before responding.
Our website or online booking facilities may use cookies and similar technologies to support functionality, remember preferences, understand website usage and improve your experience.
You can manage cookies through your browser settings and any cookie preference tool made available on our website. Non-essential cookies will be used in accordance with applicable consent requirements.
Disabling certain cookies may affect the functionality of our website.
How We May Use the Information We Collect
When you use our website, we may use relevant information to:
- Provide information or services that you request.
- Administer our website and online booking facilities.
- Troubleshoot technical problems and maintain website security.
- Understand website usage and help improve the content and functionality of our site.
- Remember preferences and recognise returning visitors where appropriate.
- Keep you informed about relevant changes to our services.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, data processing practices, technology, professional requirements or applicable law.
The latest version will be made available on our website. Please check it periodically for updates.
Contact Us
If you have any questions about this Privacy Policy, how we process your personal information or how to exercise your data protection rights, please contact:
The Forge Health Clinic Ltd (trading as The Forge Clinic)
Email: info@theforgeclinic.com
You can also raise a concern with the Information Commissioner’s Office at www.ico.org.uk.