Privacy Policy

Last updated: 28 September 2026

Introduction

Holme Valley Osteopathy and Healthcare Centre respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, why we use it, how long we retain it, who we may share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data-protection legislation.

Who We Are

Holme Valley Osteopathy and Healthcare Centre is the data controller responsible for the personal information covered by this policy.

Holme Valley Osteopathy and Healthcare Centre
132 Huddersfield Road
Holmfirth
West Yorkshire
HD9 3AS

Telephone: 01484 689050
Email: info@holmevalleyosteopathy.co.uk

If you have a question about this policy or how we use your information, please contact us using the details above.

Personal Information We Collect

The information we collect depends on how you interact with us and the services you receive. It may include:

  • Your name, title, date of birth and contact details
  • Your address, telephone number and email address
  • Emergency-contact, parent, guardian or representative details where appropriate
  • Appointment details and attendance history
  • Your medical history, current symptoms, previous treatment, medication and other health information relevant to your care
  • Examination findings, clinical assessments, treatment notes, advice, consent records and correspondence about your care
  • Information supplied by a GP, consultant, insurer or another healthcare professional, where appropriate
  • Payment, invoice and transaction information
  • Health-insurance or membership details where treatment is being claimed through a provider
  • Communications, enquiries, feedback and complaints
  • Information you provide through our website contact form, by email, telephone, social media or in person
  • Technical information associated with use of our website, such as your IP address, browser, device, pages viewed and cookie preferences

Health information is classed as special-category personal data and receives additional protection under data-protection law.

Please avoid including detailed or urgent medical information in the general website contact form. If you require urgent medical assistance, contact an appropriate healthcare or emergency service.

How We Obtain Your Information

We normally receive information directly from you. We may also receive relevant information from:

  • A parent, guardian, carer or person authorised to act for you
  • A GP, consultant, physiotherapist or other healthcare professional involved in your care
  • A health-insurance provider
  • An organisation funding or arranging your treatment, where you have been informed of the arrangement
  • Website, analytics and communications providers
  • Public authorities, regulators or law-enforcement bodies where disclosure is required or permitted by law

How We Use Your Information

We may use your information to:

  • Respond to enquiries and arrange, confirm or change appointments
  • Assess your needs and provide safe, appropriate osteopathic care
  • Maintain accurate clinical and consent records
  • Communicate with you about your treatment and ongoing care
  • Liaise with other healthcare professionals where this is appropriate and lawful
  • Process payments, invoices and authorised insurance claims
  • Manage the clinic, accounts and professional obligations
  • Respond to concerns, complaints, legal claims or regulatory enquiries
  • Protect patients, staff and others, including where a safeguarding or serious safety concern arises
  • Maintain the security and operation of our website and IT systems
  • Understand website use and improve our services, where the required cookie consent has been given
  • Send optional news or marketing communications where you have requested them or where otherwise permitted by law

We do not sell your personal information.

Our Lawful Bases

Under the UK GDPR, we must have a lawful basis for each way in which we use personal information. Depending on the purpose, we may rely on:

  • Contract: where processing is necessary to arrange or provide services you have requested
  • Legal obligation: where we must keep or disclose information to comply with legal, tax, regulatory or professional requirements
  • Legitimate interests: where processing is reasonably necessary to operate and protect the clinic, administer services, recover payments, deal with complaints or improve our service, provided your rights do not override those interests
  • Consent: for optional marketing, non-essential website cookies and particular disclosures where consent is the appropriate basis; you may withdraw consent at any time
  • Vital interests: in a genuine emergency where processing is necessary to protect someone’s life and consent cannot reasonably be obtained

Because health information is special-category data, we also need an additional condition under Article 9 of the UK GDPR. For clinical records and the provision of care, we generally rely on Article 9(2)(h): provision of health or social care, subject to the professional duty of confidentiality. Where appropriate, we may instead rely on explicit consent, vital interests, or the establishment, exercise or defence of legal claims.

We will not rely on consent where another lawful basis is more appropriate. Consent to treatment and consent for data processing are related but legally distinct matters.

Sharing Your Information

We only share personal information where there is a legitimate and lawful reason to do so. Depending on the circumstances, recipients may include:

  • Osteopaths, authorised clinic staff and other professionals involved in your care
  • Your GP, consultant or another healthcare professional, normally with your knowledge or consent unless another lawful reason applies
  • Health insurers or organisations funding treatment, where you have authorised this or it is otherwise lawful
  • Providers supporting our appointment, clinical-record, email, telephone, website, IT, payment or accounting systems
  • Accountants, insurers, professional advisers and legal representatives
  • The General Osteopathic Council, Information Commissioner’s Office or another regulator or public authority where required
  • Emergency services, safeguarding authorities or law-enforcement bodies where disclosure is necessary and lawful

Our service providers may only use information for the services they provide to us and must protect it appropriately.

We will normally ask for your permission before sharing identifiable clinical information for purposes outside your direct care, unless the law allows or requires disclosure without consent. This may apply where there is a serious risk of harm, a safeguarding concern, a court order or another legal obligation.

Storing and Protecting Your Information

We use appropriate organisational and technical safeguards to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Access is restricted to people who need the information for an authorised purpose and who are subject to confidentiality requirements.

Information may be stored in secure electronic systems and, where applicable, secure paper records.

No internet or email system can be guaranteed to be completely secure. Please do not send highly sensitive or urgent medical information through an unsecured general enquiry message.

International Transfers

Some technology providers may process information outside the United Kingdom. Where this happens, we will ensure that an appropriate legal safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any additional safeguards required.

Using our services does not, by itself, amount to consent to an international transfer.

How Long We Keep Information

We retain information only for as long as necessary for the relevant purpose and to meet our legal, regulatory, insurance and professional obligations.

  • Adult osteopathic patient records: at least eight years after the patient’s last consultation
  • Records relating to a child: until the patient’s 25th birthday
  • Payment, invoice and accounting records: for the period required by applicable tax and accounting requirements
  • General enquiries that do not result in treatment: only for as long as reasonably necessary to respond and deal with any follow-up
  • Complaints, incidents and legal matters: for as long as reasonably necessary in light of the matter and any applicable limitation or regulatory period
  • Marketing records: until consent is withdrawn or the information is no longer required, with a minimal suppression record retained where necessary to respect an opt-out
  • Website analytics information: according to the retention settings explained through our cookie information

Information may be retained for longer where required by law, a regulator, an insurer, a court order or the establishment, exercise or defence of legal claims. When information is no longer required, it will be securely deleted, destroyed or anonymised.

Your Data-Protection Rights

Depending on the circumstances, you may have the right to:

  • Ask for access to your personal information and receive a copy
  • Ask us to correct inaccurate or incomplete information
  • Ask us to delete information where the right to erasure applies
  • Ask us to restrict how information is used
  • Object to processing based on legitimate interests or to direct marketing
  • Receive certain information in a portable format
  • Withdraw consent at any time where processing is based on consent
  • Complain about how we handle your information

These rights are not absolute. For example, we may need to retain clinical records to meet professional, legal or insurance requirements even if erasure is requested. If an exemption applies, we will explain this when responding.

We may ask for proof of identity before responding to a request. We will normally respond within one month, although the law permits an extension in certain circumstances. We do not normally charge a fee, but a reasonable fee may be permitted for requests that are manifestly unfounded, excessive or repetitive.

To exercise a right, email info@holmevalleyosteopathy.co.uk.

Complaints

Please contact us first if you have a concern about how we use your information so that we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

Make a complaint to the Information Commissioner’s Office

Cookies and Website Analytics

Our website uses cookies and similar technologies. Some are strictly necessary for the website to operate. Others, including analytics and cookies connected with embedded third-party content, are used only where the required consent has been obtained.

With your consent, Google Analytics may collect information about how visitors use the website, including device and browser information, approximate location derived from an IP address, pages visited and interactions with the site. We use this information to understand website performance and improve the user experience. We do not use Google Analytics with the intention of identifying individual visitors.

Embedded content or feeds from services such as Facebook or Instagram may allow the relevant provider to collect information or set cookies. These services have their own privacy policies.

Our cookie controls allow you to accept or reject non-essential cookies and change your choices later. Rejecting non-essential cookies will not prevent you from accessing the main content of the website.

Third-Party Websites

Our website may link to websites operated by other organisations. We are not responsible for their privacy practices. Please read the relevant third party’s privacy information before providing personal data.

Changes to This Policy

We may update this policy to reflect changes in our services, systems or legal obligations. The latest version will be published on this page and the date at the top will be updated.