Patient Privacy Notice

Who Is Responsible For Your Information?

Ad Infinitum Health Ltd trading as Integra Chiropractic is the data controller for information used to run our clinic and provide your care. This means the business is responsible for deciding why and how that information is used. The Clinic Director is your contact for privacy questions and requests.

You can contact us at info@integrachiro.co.uk, or write to the Clinic Director at St Martins Medical Centre, 21 Eastcote Road, Ruislip, HA4 8BE. This is our clinic correspondence address.

Our company registration details and registered office address are available on our Legal information page.

Information We Collect And Where It Comes From

We collect information you provide when you enquire, book, attend an appointment, make a payment or contact us afterwards. Depending on the service, this may include:

• Your name, date of birth, contact details and appointment history.
• Relevant symptoms, medical history, medicines, examination findings, clinical notes, care plans, consent records and correspondence about your care.
• Parent or guardian details and their relationship to a child patient, where relevant.
• Invoices, payment records, communications, feedback, complaints and communication preferences.

Where appropriate, information may also come from a parent, guardian, authorised representative or healthcare professional involved in your care, such as a GP or referring clinician. We only seek information relevant to your care or the service you request. Please tell us if your details change.

We need sufficient identity, contact and relevant health information to arrange appointments and assess you safely. If you choose not to provide necessary information, we may be unable to book an appointment or provide appropriate care; we will explain this to you. Marketing consent is optional.

Why We Use Information And Our Lawful Bases

• Care, bookings and payments: to arrange and provide services you request and administer appointments and fees, on the basis of a contract or steps you ask us to take before one (UK GDPR Article 6(1)(b)). For a child who is not a party to that contract, we rely on our legitimate interest in providing and administering appropriate care, taking account of the child’s rights (Article 6(1)(f)).
• Legal duties: to meet applicable accounting, tax and other legal requirements (Article 6(1)(c)).
• Running and protecting the clinic: to answer enquiries, handle complaints, maintain necessary records, protect our systems and establish or defend legal claims, where necessary for our legitimate interests and balanced against your rights (Article 6(1)(f)).
• Optional marketing, photographs and testimonials: with your consent (Article 6(1)(a)), including explicit consent where the material reveals health information (Article 9(2)(a)).

Health information receives additional protection. For assessment, care and the management of healthcare, we rely on Article 9(2)(h) and the healthcare condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, with professional confidentiality safeguards. Where necessary for legal claims, Article 9(2)(f) may apply. Any exceptional disclosure, such as to protect someone from serious harm, must also have an applicable lawful basis and condition for health information.

Consent to treatment is separate from the lawful basis for keeping the clinical records needed to provide and document your care.

Who We Share Information With

Access is limited to people who need information for their role. This may include authorised clinic staff, healthcare professionals involved in your care and service providers supporting bookings, clinical administration, communications, IT, payments and accounting. Providers acting for us must protect information and use it only for the agreed service.

Where necessary and lawful, relevant information may be shared with professional advisers, indemnity insurers, regulators, safeguarding services or public authorities. We consider confidentiality, the reason for disclosure and the minimum information needed. We seek permission for care-related disclosures where appropriate, unless another lawful justification applies.

We do not sell patient information. Family members and friends do not automatically have access to your records. We check identity and authority before responding to requests on someone else’s behalf.

Semble And Online Booking

Bookings are not open yet. When bookings open, online appointment booking will be provided through Semble. Information submitted through a Semble booking link will be handled through that service. The website waiting list is separate and is explained below. Semble acts as a processor for patient data handled on our behalf; Integra remains responsible as controller for our use of that information.

See Semble’s privacy information (opens in a new tab) and its list of sub-processors (opens in a new tab). Contact Integra about your patient records or privacy rights.

Card payments involve the payment provider used for the transaction. Please do not send card details or detailed medical information in a general booking email. Ask us how to share sensitive information appropriately.

Website, Cookies And External Links

Our website uses OpenAI Sites hosting and Cloudflare infrastructure. Hosting and security services may process technical request information, such as IP addresses, browser details, pages requested and access times, to deliver and protect the website.

Our website code does not add advertising or analytics cookies. Essential hosting or security technology may be used. Links to Semble, Google Maps and other websites open separate services, which have their own privacy and cookie information.

The appointment guide runs in your browser. Your selections are not sent to the clinic or added to the Semble booking link. The guide does not diagnose symptoms, decide clinical suitability or make automated decisions about your care.

Opening Waiting List

If you join our opening list, we collect your name and email address, where you signed up, the date and wording of your consent, and whether you have been contacted or opted out. With your consent, we use this information to email you about the clinic opening and our £55 introductory adult consultation. Joining is optional and does not book an appointment or sign you up for unrelated marketing.

Your details are stored using our OpenAI Sites hosting and Cloudflare database infrastructure. The live list and Excel exports are restricted to the clinic owner. Please do not include health information in the form. We use short-lived, hashed technical identifiers to limit spam; these expire within two hours and are removed during subsequent form processing.

To withdraw consent, use the unsubscribe link in an opening email or email info@integrachiro.co.uk. We keep the list while arranging and communicating the introductory offer, which runs for the first six calendar months after opening, then review and remove information no longer needed. A minimal opt-out record may be kept to respect your preference. Our privacy contact and rights are explained below.

Processing Outside The UK

Some service providers and their sub-processors operate outside the UK. Semble publishes processing locations in its sub-processor list and explains its international-transfer safeguards in its privacy information.

Where a restricted international transfer is necessary, the applicable UK transfer requirements must be met, for example through UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum. Contact the Clinic Director for information about the providers and safeguards relevant to your data, or to request a copy of applicable safeguards.

How Long We Keep Information

We keep information only for as long as there is a justified need. The criteria depend on the record:

• Adult clinical records: eight years from your last visit, in line with GCC confidentiality guidance.
• Children’s clinical records: until the patient’s 25th birthday, or their 26th birthday if they were 17 when treatment ended. This applies to patients under 18, regardless of the appointment fee category.
• Invoices and payment records: applicable tax and accounting requirements.
• Enquiries, correspondence and complaints: the time needed to resolve the matter and any associated care, legal or regulatory requirements.
• Consent and communication preferences: the time needed to evidence your choices and respect them, including a minimal record of an opt-out where necessary.

These clinical retention periods follow the GCC’s confidentiality guidance, effective from January 2026 (PDF, opens in a new tab). Records may need to be kept longer where there is a documented and justified need, such as an ongoing complaint or claim, safeguarding concern, applicable legal requirement or insurance condition. We review that need rather than keeping records indefinitely.

At the end of the relevant period, we review the records and securely delete, destroy or anonymise information that is no longer needed. You can ask us about the retention period and any reason for extended retention that applies to your records. Ending treatment or withdrawing marketing consent does not automatically require deletion of clinical records. Waiting-list information is handled separately as explained above; it is not automatically kept for the clinical-record period.

If The Practice Closes Or Changes Hands

Patient records must continue to be protected for the applicable retention period. If the practice closes or responsibility for records changes, we will explain the arrangements for their safe keeping and how patients can request access.

Security, Confidentiality And Children

We use appropriate access controls and organisational safeguards for electronic and paper information. Access must be relevant to a person’s responsibilities and subject to confidentiality. We check recipients before sharing information and take care to keep records accurate.

Children have privacy rights of their own. When involving a parent or guardian, or responding to a request for a child’s records, we consider parental responsibility, the child’s understanding, their wishes and welfare, and applicable confidentiality rules. Please ask if you or your child would like this explained.

Your Rights

Depending on the lawful basis and circumstances, you can ask us to:

• Explain how we use your information and provide access to a copy.
• Correct inaccurate information or complete an incomplete record.
• Erase information or restrict its use where the relevant conditions apply.
• Provide certain information in a portable format where that right applies.

These rights are not absolute. For example, clinical information may need to be retained for healthcare or legal reasons. We will explain any limitation. To make a request, email or write to the Clinic Director using the contact details below. We may need to check your identity or authority. We normally respond to an access request within one month and explain any extension permitted by law.

Your Right To Object

You can object to processing based on legitimate interests for reasons relating to your circumstances. You can object to direct marketing at any time.

Withdrawing Consent

You can withdraw consent for optional uses, such as marketing or publication of a testimonial, by emailing us. This does not affect lawful use before withdrawal or your access to care. It does not remove records that we need to keep on another lawful basis.

Questions, Requests Or Complaints

Email: info@integrachiro.co.uk

You can raise a privacy concern with us or complain to the Information Commissioner’s Office (ICO) (opens in a new tab). You do not have to complete our complaints process before contacting the ICO.

We will update this notice when our information handling changes and explain material changes where appropriate.