Privacy Policy

Last updated: August 2026

Who we are

Natasha Osgood Chiropractic Ltd is the data controller for the personal information described in this policy. That means we decide what information is collected about you and how it is used.

Company name: Natasha Osgood Chiropractic Ltd
Company number: 13531358
Registered office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF
Clinic address: 8 Farrell Court, Elephant Road, London, SE17 1L
Email: contact@osgoodmovement.com

General Chiropractic Council registration number: 04892

In this policy, “we”, “us” and “our” mean Natasha Osgood Chiropractic Ltd. “You” means you, whether you are a patient, a website visitor, or someone who has contacted us.

If you have any questions about this policy or about how we handle your information, email us at contact@osgoodmovement.com.

What this policy covers

This policy explains what personal information we collect, why we collect it, what we do with it, who we share it with, and what rights you have. It covers the care we provide at the clinic, our website, and any contact you have with us by email, phone or social media.

We take particular care with health information. Health information is treated as a special category of personal data under UK data protection law, which means it has extra legal protection. We treat it that way in practice too.

The information we collect

Information you give us when you get in touch. Your name, email address, phone number, and anything you choose to tell us in an enquiry, a form on our website, a message on social media, or a phone call.

Information you give us when you book. Your name, contact details, date of birth, address, appointment preferences, and payment details.

Health information. Your medical history, current symptoms, previous injuries, medication, lifestyle information, the results of physical examinations and assessments, your treatment plan, clinical notes recorded at each visit, and your progress over time. We may also record information about your GP or other healthcare professionals involved in your care.

Payment information. Records of what you have paid, when, and for what. We do not store your full card number. Card payments are handled by our payment providers, who process the card details directly.

Correspondence. Emails, text messages, appointment reminders, social media messages and any notes we make about conversations with you.

Website information. Technical information about how you use our website, including your IP address, browser type, device type, the pages you visit and how you arrived at the site. This is collected through cookies and similar technologies. Our Cookie Policy explains this in detail and sets out how you control it.

Where we get your information from

Most of the information we hold comes directly from you, either when you book, when you complete our intake forms, or during your appointments.

We may also receive information about you from:

• Your GP or another healthcare professional, where you have asked us to liaise with them
• A family member or friend who books on your behalf, with your knowledge
• Your insurer or a solicitor, where your care relates to a claim
• The person who referred you to us, where they have given us your contact details with your agreement

Why we use your information and our legal basis for doing so

Under UK data protection law, we need a lawful basis for using your information, and a second, higher basis for using health information. Here is what we rely on.

To provide chiropractic care to you. This includes assessing you, planning and delivering treatment, and keeping accurate clinical records. Our lawful basis is that it is necessary to perform our contract with you, and for health information, that it is necessary for the provision of health care by a health professional who owes a duty of confidentiality. This is set out in Article 9(2)(h) of the UK GDPR and paragraph 2 of Schedule 1 to the Data Protection Act 2018.

To manage your appointments. Booking, rescheduling, sending reminders and following up. Our lawful basis is performance of our contract with you.

To take and record payment. Processing payments, issuing receipts, chasing unpaid fees and keeping accounting records. Our lawful basis is performance of our contract with you, and compliance with our legal obligations under tax and accounting law.

To keep clinical records for the period we are required to. Our lawful basis is compliance with a legal obligation and our legitimate interest in being able to defend a claim, and for health information, the provision of health care.

To respond to your enquiries. Our lawful basis is our legitimate interest in responding to people who contact us, and in some cases, taking steps at your request before entering into a contract.

To send you marketing. Newsletters, clinic updates, offers and educational content. Our lawful basis is your consent, or in some cases our legitimate interest in marketing similar services to existing patients. You can opt out at any time using the unsubscribe link in any email, or by emailing us.

To ask you for a review. Our lawful basis is our legitimate interest in understanding and improving how we are doing. You never have to leave one, and we will never publish anything that identifies you as a patient without your agreement.

To understand and improve our website and advertising. Our lawful basis is your consent, which you give or withhold through our cookie banner.

To handle complaints, insurance matters and legal claims. Our lawful basis is our legitimate interest in protecting our position, our legal obligations, and, for health information, that it is necessary for establishing, exercising or defending legal claims.

To meet our regulatory obligations. Including our obligations to the General Chiropractic Council. Our lawful basis is compliance with a legal obligation.

Who we share your information with

We do not sell your information. We do not share your health information for advertising purposes, and we do not upload patient information or medical records to advertising platforms.

We share information with the following organisations, who act as our service providers and process information on our instructions under a written contract.

• Cliniko Our practice management system. This is where your clinical records, appointments and contact details are held.
• Heidi An AI clinical documentation tool used to help produce clinical notes. Where this is used during your appointment, we will tell you and ask for your agreement first, and you can decline without it affecting your care.
• Google Workspace Our email and document storage.
• Stripe and Square Our payment providers. They handle card payments and hold payment records.
• Mailchimp Our email marketing platform. Contact details are shared with Mailchimp where you have agreed to receive marketing from us.
• Hostinger and WordPress Our website hosting and website platform.
• Google Analytics and Meta Analytics and advertising services used on our website, and only where you have given consent through our cookie banner. These do not give your health information or your clinical records.
• 262 Studios Our marketing and client communications partner, who manages enquiries and messages that come in through our social media accounts and website on our behalf.

We may also share your information with:

• Other healthcare professionals involved in your care, where you have asked us to or where it is necessary for your care
• Your insurer or solicitor, where your care relates to a claim, and you have asked us to
• Our professional indemnity insurer and legal advisers, where there is a complaint or a claim
• Our accountants, for the purpose of preparing our accounts
• The General Chiropractic Council or another regulator or public authority, where we are required to
• The police, courts or other authorities where we are legally required to, or where there is a serious risk of harm

Sending information outside the UK

Some of the services we use are based outside the UK, or store information outside the UK. Where information is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or a finding by the UK government that the country in question provides adequate protection.

If you would like more detail about the safeguards in place for a specific transfer, email us at contact@osgoodmovement.com.

How long we keep your information

Clinical records. We keep adult clinical records for eight years after your last appointment. This follows the retention guidance applied across UK healthcare and the expectations of our regulator and insurer.

Financial records. Six years from the end of the financial year they relate to, as required by tax law.

Enquiries that do not become appointments. Twelve months, unless you have asked to hear from us.

Marketing contact details. Until you unsubscribe, and then we keep a minimal record of your unsubscribe so we do not contact you again by mistake.

Website and analytics information. As set out in our Cookie Policy.

When we no longer need your information, we delete it or anonymise it securely.

How we keep your information secure

We use systems that encrypt information in transit and at rest. Access to clinical records is restricted, and practitioners can only see the records of patients under their own care. Accounts are protected by individual logins and multi-factor authentication where available. Our team is bound by a duty of confidentiality.

No system is completely secure, but we take these obligations seriously, and we will tell you and the Information Commissioner’s Office if there is a breach that is likely to affect your rights.

Children

We do not provide care to anyone under the age of 18, and our website is not directed at children.

Automated decision making

We do not make any decisions about your care using automated processing alone, and we do not carry out profiling that produces legal or similarly significant effects on you.

Your rights

Under UK data protection law, you have the following rights.

• The right to be informed. To know how your information is used, which is what this policy is for.
• The right of access. To ask for a copy of the information we hold about you, including your clinical records. We will respond within one month. This is normally free.
• The right to rectification. To ask us to correct information that is inaccurate or incomplete. With clinical records, we cannot remove a clinical opinion that was properly recorded at the time, but we can record your disagreement alongside it.
• The right to erasure. To ask us to delete your information. This right is limited where we are legally required to keep clinical records.
• The right to restrict processing. To ask us to pause the use of your information in certain circumstances.
• The right to data portability. To ask for the information you gave us in a portable electronic format, where we are processing it on the basis of consent or contract.
• The right to object. To object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
• The right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
• To exercise any of these rights, email contact@osgoodmovement.com. We may ask you to confirm your identity before we act, to make sure we are not disclosing your information to someone else.

How to complain

If you are unhappy with how we have handled your information, please tell us first at contact@osgoodmovement.com so we have a chance to put it right.

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

If your complaint is about your care rather than your information, our Terms of Service explain how to raise it, and you can also contact the General Chiropractic Council at gcc-uk.org.

Changes to this policy

We review this policy regularly and will update it when our systems or the law change. The date at the top shows when it was last updated. Where a change is significant, we will let you know directly.