Privacy Policy
Last updated: September 2026
1. About this policy
AM Osteopathy respects your privacy and is committed to protecting the personal and health information that I hold about you. This Privacy Policy explains what personal information I collect, how and why I use it, how it is stored, who it may be shared with, how long I keep it, and the rights you have in relation to your information. AM Osteopathy is operated by Adam Mackintosh, Osteopath, at Church Farm, St Briavels, GL15 6QE. Adam Mackintosh is the data controller for personal information processed in connection with AM Osteopathy.
2. Information I collect
Depending on the circumstances, I may collect and hold the following information:
• your name, date of birth and contact details
• your address and GP surgery details
• appointment and treatment information
• payment and transaction information
• medical history, symptoms, diagnoses, medication, previous treatment, injuries, operations and other information relevant to your health
• clinical records relating to assessment, treatment, consent, progress and clinical communications
• correspondence and communications relating to your care
• information provided through patient forms and questionnaires
• information necessary to manage the administration and operation of the practice
Health information is classed as special category personal data under UK data protection law and is therefore subject to additional protection.
3. How I use your information
I use your personal information where necessary to:
• arrange and manage appointments
• provide safe and appropriate osteopathic assessment and treatment
• obtain relevant medical and health information
• maintain accurate and contemporaneous clinical records
• communicate with you about your appointments and care
• provide information, reports or correspondence relating to your care where appropriate
• process payments and manage the administration of the practice
• maintain appropriate professional, legal and regulatory records
• deal with enquiries, complaints or other matters relating to the practice
• comply with legal, professional and regulatory obligations
I will only collect and use information that is reasonably necessary for these purposes.
I do not use your clinical information for unrelated purposes.
4. Lawful basis for processing your information
Personal information must be processed on a lawful basis under UK data protection law. Different lawful bases may apply depending on the purpose for which information is being used.
For AM Osteopathy, these may include:
• processing necessary to provide and manage the healthcare services you have requested
• processing necessary to comply with legal, professional or regulatory obligations
• processing necessary for the legitimate interests of running and administering the practice, where those interests are not overridden by your rights and interests
• consent, where consent is the appropriate lawful basis for a particular activity
Health information is special category data and requires an additional condition for processing. Where health information is processed for the provision of healthcare, I rely on the relevant health and social care provisions under UK data protection law, together with the applicable Article 6 lawful basis.
Consent is therefore not necessarily the legal basis for all processing of your health information. Where consent is used for a particular purpose, you may withdraw that consent, although this will not affect processing that is carried out on another lawful basis.
5. Clinical transcription and Heidi Health
AM Osteopathy uses Heidi Health to assist with clinical documentation. With your permission, Heidi transcribes the consultation in real time and uses the resulting text to assist in producing clinical notes. The notes are reviewed and edited by Adam before being incorporated into the clinical record.
Heidi does not retain an audio recording of the consultation when using real-time transcription. Heidi states that consultation transcripts and generated notes are not used to train, develop or improve its AI models. As part of the AM Osteopathy consultation process, direct identifying information such as your name, date of birth, address and contact details is not entered into Heidi.
The purpose of using Heidi is to assist with accurate and efficient clinical documentation. The final clinical record is maintained within the practice management system.
You will be informed during your initial consultation that Heidi is being used and there is a sign reminding you it is in use. You may ask for it not to be used and any time and choosing to do so will not affect your care.
Heidi is a third-party service provider and processes information on behalf of healthcare practitioners subject to its own privacy, security and data-processing arrangements.
6. Practice management, bookings and website
AM Osteopathy uses Cliniko to manage appointments, patient information and clinical records.
Cliniko processes personal information on behalf of healthcare practices and provides measures intended to support compliance with data protection requirements, including UK GDPR. Cliniko also uses contractual safeguards for relevant international data transfers.
The AM Osteopathy website is hosted by Wix. The website provides access to information about the practice and to the Cliniko online booking system. Wix acts as a data processor in relation to personal information processed through a website owner's site and provides a Data Processing Agreement and mechanisms for international data transfers where required.
These providers may therefore process personal information on behalf of AM Osteopathy in order to provide the services described above. They are not the same as healthcare professionals or other organisations with whom your clinical information may be shared for the purposes of your care.
7.Confidentiality and sharing information
Your personal and clinical information is treated as confidential.
I will not normally disclose information about you to another person or organisation without your permission unless there is a lawful reason or legal or professional obligation to do so.
Where appropriate, relevant health information may be shared with your GP or another healthcare professional involved in your care where this is necessary to support your care. Where information is to be shared with another healthcare professional, I will discuss this with you beforehand and explain what information is intended to be shared and why. Only information that is reasonably necessary will be disclosed.
Information may also be disclosed without your permission where this is required by law, where necessary to comply with a legal or regulatory obligation, or in circumstances where disclosure is necessary to protect someone from serious harm. I will not sell your personal or clinical information.
8. Data security
I take reasonable and appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Access to patient information is restricted to what is reasonably necessary for the operation of the practice and provision of care. Electronic information is stored using secure systems and appropriate account and access controls. No system can be guaranteed to be completely secure. If a personal data breach occurs, I will take appropriate steps to investigate, contain and address the breach and will notify affected individuals and/or the Information Commissioner's Office where required by law.
9. Retention of clinical records
Clinical records are kept for a minimum of 8 years after the patient's last consultation.
For patients who are under 18, records are kept until their 25th birthday. These retention periods reflect the minimum periods set out in the General Osteopathic Council's Osteopathic Practice Standards. Records may be retained for longer where there is a legitimate reason to do so, including where necessary to deal with an ongoing matter, complaint, legal requirement or other professional obligation. When information is no longer required, it will be securely deleted, destroyed or otherwise disposed of in accordance with the practice's record retention and disposal procedures.
10. Your rights
Under UK data protection law, you have a number of rights in relation to your personal information.
Depending on the circumstances, these may include:
• the right to request access to the personal information I hold about you
• the right to request that inaccurate or incomplete information is corrected
• the right to request deletion of your personal information in certain circumstances
• the right to request restriction of processing in certain circumstances
• the right to object to certain types of processing
• the right to withdraw consent where processing is based on consent
• the right to data portability in circumstances where this applies
These rights are subject to certain legal conditions and exemptions and therefore may not apply in every situation.
If you wish to exercise any of your rights, please contact Adam Mackintosh at AM Osteopathy, Church Farm, St Briavels, GL15 6QE.
11. Access to your clinical records
You may request access to the personal and clinical information held about you.
Requests should be made to Adam Mackintosh at AM Osteopathy, Church Farm, St Briavels, GL15 6QE.
I may need to verify your identity before providing access to your information.
In some circumstances, access to particular information may be restricted where an applicable legal exemption applies.
12. Complaints about data protection
If you have concerns about the way your personal information has been handled, I would encourage you to contact AM Osteopathy first so that I can investigate and try to resolve the matter. You also have the right to complain directly to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection.
Further information about making a complaint is available from the Information Commissioner's Office.
13. Changes to this policy
This Privacy Policy may be updated from time to time to reflect changes in the practice, the systems used by AM Osteopathy, or applicable legal and professional requirements. The latest version will be made available on the AM Osteopathy website and will show the date on which it was last updated.