Privacy Notice

Website, patient and clinical information

Data controller	Jessica Brown trading as One Health Osteopathy Clinic
Effective from	1 October 2026
Last reviewed	2 October 2026
Version	1.2
Contact	je**@****************co.uk
Address	Oxford House, 15–17 Mount Ephraim Road, Tunbridge Wells, Kent TN1 1EN
Website	www.onehealthclinic.co.uk

1. Who we are

From 1 October 2026, Jessica Brown, a sole trader trading as One Health Osteopathy Clinic (referred to in this notice as “One Health”, “we”, “us” or “our”), is the data controller for the personal information covered by this notice. This means Jessica Brown decides why and how that information is used and is responsible for protecting it.

This notice applies to personal information collected from 1 October 2026 and to relevant patient and business records transferred to Jessica Brown as the successor to the former One Health Osteopathy Clinic partnership. Before that date, the partnership remains responsible for information processed under the previous arrangements.

This notice explains how we collect and use personal information about patients, prospective patients, parents and guardians, website visitors and people who contact the clinic. It applies to our website, booking and patient-record systems, clinical services and related administration.

Our processing is governed by the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), and those laws as amended by the Data (Use and Access) Act 2025.

Independent practitioners

This notice applies where Jessica Brown determines why and how personal information is used. A self-employed practitioner or room hirer working from the clinic may sometimes operate as a separate data controller for their own patients and clinical records. If so, they are responsible for providing their own privacy information. We will make the position clear when you book or before information is shared.

2. The information we collect

Depending on your relationship with us, we may collect:

• identity and contact details, including your name, title, date of birth, address, email address and telephone number;
• details of a parent, guardian, representative, emergency contact, GP, referrer or other healthcare professional;
• appointment, booking and attendance information;
• payment, invoice, refund and health-insurance information. Card payments are processed by our payment provider and we do not normally retain full card details;
• health and clinical information, including your medical history, current and previous symptoms, diagnoses, medication, allergies, pregnancy or postnatal information where relevant, lifestyle information, assessment findings, treatment plans, consent discussions, treatment notes, exercise programmes, correspondence, reports and referrals;
• a real-time consultation transcript and an AI-generated draft clinical note where you agree to the relevant practitioner or osteopath using Heidi Scribe. Heidi states that consultation audio is processed as it is transcribed but is not retained as an audio recording;
• special category information where relevant to safe and appropriate care, which may include information about physical or mental health, disability, racial or ethnic origin, religious or philosophical beliefs, sex life or sexual orientation;
• clinical photographs, videos or other images where they are relevant to your care and you have been appropriately informed. We will obtain separate explicit consent before using an identifiable patient image for marketing or publicity;
• communications with us, including emails, forms, feedback, reviews, complaints and data-rights requests;
• your communication, marketing and cookie preferences;
• website and device information, such as your IP address, browser and device type, pages visited, referring website, approximate location, cookie identifiers, consent choices and security logs; and
• information submitted through website forms. Our anti-spam service may check technical information and the contents of a submission to decide whether it is genuine.

We do not intentionally collect information that is not relevant to the purpose for which it is required.

Please do not include detailed medical histories, clinical records or other unnecessary health information in a general website contact form. We will tell you how to provide information securely where it is needed for your care.

3. Where we obtain information from

We usually obtain information directly from you when you contact us, book an appointment, complete a questionnaire, attend the clinic, make a payment or use our website.

We may also receive information from:

• a parent, guardian, carer or authorised representative;
• another healthcare professional, referrer or service involved in your care;
• an insurer or claims administrator where you ask us to deal with them;
• our booking, patient-record, payment and exercise-prescription systems;
• the former One Health Osteopathy Clinic partnership as part of the change in data controller on 1 October 2026; or
• another lawful source, including a regulator, public authority or publicly available professional source where relevant.

Where somebody provides information to us on your behalf, we will take reasonable steps to confirm their authority where appropriate.

4. Why we use your information and our lawful bases

We do not rely on consent for all processing. In particular, we generally need to retain an accurate clinical record even if you later withdraw consent to treatment or marketing. The lawful bases most relevant to our work are set out below.

Purpose	UK GDPR Article 6 lawful basis	Additional condition for special category information
Responding to enquiries, arranging appointments and taking steps at your request before providing services	Contract: Article 6(1)(b); and, where appropriate, legitimate interests: Article 6(1)(f)	Not normally applicable unless health information is included; where it is, healthcare: Article 9(2)(h)
Assessing, treating and advising patients, maintaining clinical records and ensuring continuity and safety of care	Contract: Article 6(1)(b); legitimate interests: Article 6(1)(f); and legal obligation where applicable: Article 6(1)(c)	Healthcare: Article 9(2)(h), supported by Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018
Taking payments, managing accounts, recovering sums due and dealing with health insurers at your request	Contract: Article 6(1)(b); legal obligation: Article 6(1)(c); and legitimate interests: Article 6(1)(f)	Healthcare: Article 9(2)(h), where the transaction or claim includes health information
Communicating with another healthcare professional, making a referral or supporting direct care	Contract: Article 6(1)(b); legitimate interests: Article 6(1)(f); legal obligation: Article 6(1)(c); or vital interests in an emergency: Article 6(1)(d)	Healthcare: Article 9(2)(h); legal claims: Article 9(2)(f); vital interests: Article 9(2)(c); or substantial public interest: Article 9(2)(g), as applicable
Meeting professional, safeguarding, tax, insurance, regulatory and legal requirements; preventing or investigating fraud; and establishing, exercising or defending legal claims	Legal obligation: Article 6(1)(c); legitimate interests: Article 6(1)(f); or vital interests: Article 6(1)(d), as applicable	Healthcare: Article 9(2)(h); legal claims: Article 9(2)(f); vital interests: Article 9(2)(c); or substantial public interest: Article 9(2)(g), with the relevant Data Protection Act 2018 condition where required
Handling complaints, incidents, audits, quality assurance and data-protection requests	Legal obligation: Article 6(1)(c) and legitimate interests: Article 6(1)(f)	Healthcare: Article 9(2)(h), or legal claims: Article 9(2)(f), where special category information is involved
Using optional AI-assisted transcription to prepare a draft clinical note	Consent: Article 6(1)(a) for the optional use of Heidi Scribe. Contract: Article 6(1)(b), legal obligation: Article 6(1)(c), and legitimate interests: Article 6(1)(f), as applicable, for reviewing and retaining the final clinical record	Explicit consent: Article 9(2)(a) for the optional processing through Heidi Scribe. Healthcare: Article 9(2)(h), supported by Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018, for the final clinical record
Hosting, operating, securing and improving our website, forms, email and systems, including spam prevention, caching, backups and technical support	Legitimate interests: Article 6(1)(f); legal obligation: Article 6(1)(c), where applicable; or consent: Article 6(1)(a), where consent is required	We do not intentionally use health information for website analytics. Article 9(2)(h) or 9(2)(f) may apply if support or security work unavoidably involves health information
Sending newsletters or promotional communications	Consent: Article 6(1)(a)	Explicit consent: Article 9(2)(a), if a communication or audience selection uses or reveals special category information

Our legitimate interests include providing and administering a safe, effective and sustainable healthcare service; maintaining appropriate records; protecting patients, staff, systems and the clinic; improving our service; and establishing or defending legal rights. We consider and balance these interests against your rights and reasonable expectations before relying on this basis.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier lawful processing unlawful and does not require us to erase information that we must or are entitled to retain on another lawful basis.

5. If you do not provide information

Some information is needed to arrange and provide care safely, fulfil our contract with you, process payment or an insurance claim, and meet professional or legal requirements. If you do not provide relevant information, we may be unable to offer an appointment, provide treatment, communicate safely with another professional or process a claim. Providing information for marketing is always optional and does not affect your care.

Optional AI-assisted clinical documentation

With your permission, the practitioner or osteopath providing your care may use Heidi Scribe, an AI-assisted clinical documentation service provided by Heidi Health, during a consultation. It processes the conversation in real time to produce a transcript and a draft clinical note. Heidi states that it does not retain an audio recording and does not use patient data to train, develop or improve its AI models.

We will explain its use, ask for your consent before starting and record your choice. You may decline, or ask us to stop using it at any time, without affecting your treatment or access to care. Where a consultation concerns a child or young person, we will obtain appropriate consent from the person with parental responsibility and involve the child or young person in an age-appropriate way.

The output is only a draft. The relevant practitioner or osteopath remains responsible for the clinical record and will review, correct and approve any information before transferring the final note to the patient-record system. Heidi is not used to make automated diagnoses, treatment decisions or other decisions about you.

6. Who we share information with

We share only the information reasonably necessary for the relevant purpose. Depending on the circumstances, recipients may include:

• authorised clinicians and administrative personnel working with One Health, who are subject to professional or contractual confidentiality requirements;
• Semble, which provides our booking, practice-management and electronic patient-record system;
• Rehab My Patient, where we use it to issue an exercise or rehabilitation programme;
• Heidi Health, which provides the optional Heidi Scribe service used to transcribe a consultation in real time and prepare a draft clinical note where you have consented;
• 20i, which provides website and email hosting, domain administration, platform security and backups;
• Rockhopper Digital, which provides website management and technical support. Its authorised personnel may have privileged hosting-control-panel access but may access systems or mailbox contents only where necessary and in accordance with our instructions, contractual duties and confidentiality requirements;
• CookieYes, which records and applies website visitors’ cookie and similar-technology choices;
• CleanTalk, which checks website traffic and form submissions for spam and abuse. It may receive technical information and form fields, including an IP address, browser or device signals and the contents of a submission;
• NitroPack and its service provider WP Engine, which provide website optimisation, caching and content-delivery services and may process visitor technical and request information;
• Google, where we use Google Analytics 4, Google Fonts, YouTube or other Google services as described in section 10;
• Automattic, where a Gravatar image or related service is displayed;
• other email, document, IT-support, cyber-security and backup providers where required;
• payment providers, including Lopay and, if offered at the point of payment, Stripe. A payment provider may act as a separate data controller for some payment and fraud-prevention processing under its own privacy notice;
• Healthcode, health insurers and claims administrators where you ask us to submit or support a claim;
• accountants, bookkeepers, legal advisers, professional indemnity insurers and other professional advisers;
• another healthcare professional or service involved in your care, normally with your knowledge or agreement;
• the General Osteopathic Council, the Information Commissioner’s Office, HM Revenue & Customs, safeguarding bodies, the police, courts or other public authorities where disclosure is required or permitted by law; and
• a successor to the clinic or part of the business, subject to appropriate confidentiality, due diligence and data-protection safeguards.

Our service providers must handle information under appropriate contractual, confidentiality and security obligations. Some recipients, such as banks, payment providers, insurers, regulators and independent healthcare professionals, may act as separate data controllers and will be responsible for their own use of the information.

We do not sell or rent personal information, and we do not disclose patient information to third parties so that they can market their own products or services.

We will normally seek your agreement before sharing confidential clinical information for a referral or with somebody not already involved in your care. We may share information without consent where this is required by law or necessary and proportionate for safeguarding, serious safety concerns, an emergency, a regulatory investigation or legal proceedings. We will record our reasoning and disclose no more than is necessary.

7. International transfers

Semble states that patient data is hosted in UK and EU data centres. Our 20i hosting arrangement may store information in data centres within the European Economic Area and may involve sub-processors elsewhere. The precise locations can change according to the supplier’s infrastructure and sub-processor arrangements.

Heidi Health states that, for United Kingdom customers using Heidi Scribe, personal information is stored in the UK and processing takes place within the UK or European Economic Area.

Some active website services may process visitor information outside the UK. These include Google and YouTube, CleanTalk, NitroPack/WP Engine, Automattic/Gravatar and some CookieYes sub-processors. Depending on the service, processing may take place in the United States or other countries whose data-protection laws may differ from those in the UK.

Where a restricted international transfer takes place, we require an appropriate safeguard. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and any required transfer risk assessment and supplementary security measures. You may contact us for more information about the safeguards relevant to your information.

8. How long we keep information

We keep information only for as long as it is needed for the purpose for which it was collected, including professional, legal, accounting, insurance and patient-safety requirements.

Information	Normal retention period
Adult clinical records	A minimum of eight years after the last consultation, in line with General Osteopathic Council guidance
Clinical records for a child	At least until the patient’s 25th birthday, in line with General Osteopathic Council guidance
Financial, tax, invoice and transaction records	Normally six years after the end of the relevant accounting period
Enquiries that do not result in an appointment	Normally up to 12 months after the last meaningful contact
Complaints, significant incidents and related investigations	Normally six years after closure, or longer where linked to a clinical record, legal claim, regulatory requirement or safeguarding matter
Marketing contact details	Until you unsubscribe or withdraw consent; we may then retain minimal information on a suppression list so that we respect your choice
Website and cookie information	For the periods shown in our cookie preference tool or Cookie Policy
Website files and database backup copies	Normally up to 30 days before the backup expires or is overwritten. Information restored from a backup remains subject to the original retention period
CleanTalk anti-spam records	For the period configured for the service, which will not exceed 45 days. A genuine enquiry retained by One Health is then kept under the relevant enquiry, clinical or complaint period above
Heidi Scribe consultation audio	Heidi states that audio is processed in real time and is not retained as an audio recording
Heidi Scribe transcript and draft note	Only until the relevant practitioner or osteopath has reviewed the output, transferred the required information to the clinical record and completed any necessary quality check; it is then deleted from Heidi. The approved clinical note is retained as part of the clinical record under the periods above

These are minimum or usual periods, not an automatic promise of deletion on a particular day. We may retain information for longer where this is necessary because of ongoing care, a complaint, a safeguarding concern, a regulatory matter, an actual or potential legal claim, an insurer’s requirement or another legal hold. At the end of the applicable period, we review the information and securely delete, destroy or anonymise it where it is no longer required.

9. How we protect information

We use proportionate technical and organisational measures to protect personal information from accidental or unlawful loss, alteration, disclosure, access or destruction. These include role-based and least-privilege access controls, strong passwords and multi-factor authentication where available, encryption in transit and at rest where supported, confidentiality requirements, staff training, supplier checks, device security, secure disposal and procedures for managing data breaches.

Our hosting platform provides SSL certificates, a web application firewall, brute-force protection, daily malware scanning and daily backup copies retained for up to 30 days. We keep WordPress, themes and plugins updated and use email-authentication controls including SPF, DKIM and DMARC. Technical support access is restricted to authorised purposes and is governed by our instructions and access controls.

No internet or email service can be guaranteed to be completely secure. Please avoid sending more health information by ordinary email than is necessary and contact us if you would prefer to discuss a more suitable way to provide particularly sensitive documents.

10. Cookies and similar technologies

Our website uses CookieYes as its consent-management platform and uses cookies, scripts, pixels, local storage and related technologies for functions such as security, remembering preferences, displaying external media and understanding how the website is used.

Some technologies are necessary to provide a service you request or protect the website and forms. PECR also permits certain limited uses without consent where every condition for an exception is met. Other non-essential analytics, advertising, external-media or tracking technologies will not be activated unless you have made the required choice through our cookie tool.

Our main website services are:

Service	Purpose and information involved	When it operates
CookieYes	Displays the consent banner, stores your choices and applies them. It may process a consent identifier, time and date, IP address and browser or device information	Necessary consent-management technology operates when you visit so that we can record and respect your choices
CleanTalk	Protects forms and the website from spam and abuse. It may assess IP address, browser and device signals, JavaScript or cookie-test results and form fields, including the message you submit	Security checks may operate where necessary to protect the site or a form. They are not used for advertising or clinical decision-making
Google Analytics 4 (property G-SGNE8MR649)	Helps us understand visits and interactions using information such as pages viewed, approximate location, device information and online identifiers	Google Analytics tags are blocked until you consent to analytics. We use Google Consent Mode v2 in its basic implementation so that analytics data is not sent to Google before consent
Google Fonts	Delivers typefaces used to display the website. When fonts are fetched directly from Google, Google receives technical request information such as the visitor’s IP address and browser information	It may operate when a page using the font is displayed; we rely on legitimate interests to present a consistent, usable website
NitroPack / WP Engine	Speeds up and protects the website through optimisation, caching and a content-delivery network. It may receive IP address, browser, request and security-log information and stores cached copies of public pages	It operates when the website is requested; we rely on legitimate interests in providing a secure and efficient website
YouTube player library	We do not currently embed YouTube videos. A player library is included by the website’s image-carousel plugin and could result in technical request information being sent to YouTube if it loads	The library is blocked unless you consent to Advertisement cookies, so no request is made to YouTube before that consent is given
Gravatar / Automattic	Displays an avatar where that feature is used. Automattic may receive technical request information and an encoded or hashed version of an email address used to find an avatar	It operates only on pages where the feature is displayed; we rely on legitimate interests for that limited display

Our Cookie Policy and CookieYes preference panel identify the particular cookies and technologies detected on the website, their providers, purposes and durations. The list may change when the website or a supplier changes, so the preference panel is the most current source for individual cookie details.

You can accept or reject non-essential categories and can change or withdraw your choices at any time by selecting the persistent Cookie Preferences control displayed on the website. Rejecting non-essential technologies will not prevent access to the core website, although some optional website features may remain unavailable. Withdrawing consent does not affect the lawfulness of earlier processing.

11. Marketing

We will send email newsletters or promotional communications only where we have an appropriate lawful basis and have complied with PECR. Where we rely on your consent, you can unsubscribe at any time by using the link in the message or emailing us. Service messages about appointments, payments, clinical care or changes affecting an existing service are not marketing and may still be sent where necessary.

We will not use clinical information to target marketing or use an identifiable patient story, testimonial, photograph or video in publicity without appropriate, separate and explicit consent.

12. Children and young people

We provide services to babies, children and young people and therefore process their personal and health information. A parent, guardian or person with parental responsibility will usually provide information and manage bookings for a younger child. We will involve the child or young person in an age-appropriate way and respect their confidentiality, understanding and data-protection rights where they are able to exercise those rights themselves.

We take particular care to collect only what is necessary, restrict access and avoid using children’s information for marketing or unrelated purposes.

13. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• be informed about how we use your information;
• request access to your personal information and a copy of it;
• ask us to correct inaccurate information or complete incomplete information;
• ask us to erase information where there is no overriding reason for us to retain it;
• ask us to restrict how information is used in certain circumstances;
• receive information you provided to us in a structured, commonly used, machine-readable format, or ask us to transfer it to another controller, where the right to data portability applies;
• object to processing based on legitimate interests;
• object at any time to direct marketing; and
• withdraw consent at any time where processing is based on consent.

Your right to object: You have the right to object to our use of your personal information where we rely on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims. We will always stop using your information for direct marketing if you object.

These rights are not absolute. For example, we may need to retain a clinical record to meet professional obligations, protect patient safety or establish or defend legal claims, even if you ask us to erase it.

We do not use solely automated decision-making or profiling that produces legal or similarly significant effects on patients. Where Heidi Scribe is used, it produces a draft only; the relevant practitioner or osteopath reviews and approves the final clinical record and remains responsible for all clinical decisions.

To exercise a right, email je**@****************co.uk or write to the clinic address above. Please describe what you are asking us to do. We may request proportionate proof of identity or authority before disclosing or changing information.

We will respond without undue delay and normally within one month after receiving a valid request and any information reasonably required to verify identity. The law allows an extension in certain complex cases. We do not normally charge a fee, although the law permits a reasonable fee or refusal in limited circumstances, such as a manifestly unfounded or excessive request.

14. Data-protection complaints

If you are concerned about how we have used or protected your personal information, please email je**@****************co.uk with the subject line Data Protection Complaint, or write to Jessica Brown at the clinic address above. Please explain what has happened, when it happened and what outcome you are seeking. If you need help to make the complaint, let us know and we will provide reasonable assistance.

We will:

• acknowledge your complaint within 30 days of receiving it;
• investigate it appropriately and without undue delay;
• keep you informed about progress where a response is not immediate; and
• tell you the outcome and any action taken.

If your concern also relates to clinical care or another service issue, our clinical complaints procedure may apply alongside this data-protection process.

You also have the right to complain to the Information Commissioner’s Office (“ICO”):

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113 | Website: www.ico.org.uk/make-a-complaint/

We would welcome the opportunity to address your concern directly, but you are not prevented from contacting the ICO.

15. External websites

Our website may link to or embed external websites or services, including our online booking service. Those organisations may be separate controllers and their own privacy and cookie notices will apply. Embedded content is controlled through our cookie tool where consent is required. If you follow an external link or activate content, the external provider may collect information under its own terms. We are not responsible for how an unrelated external website uses personal information.

16. Changes to this notice

We review this notice periodically and whenever our services, systems, suppliers or legal obligations materially change. The current version will be published on our website with its review date. Where a change would significantly affect how we use existing information, we will take reasonable steps to bring it to the attention of the people affected.

17. Contact us

For questions about this notice or the way we use personal information, email je**@****************co.uk or write to Jessica Brown at the clinic address shown at the start of this notice.

© 2026 Jessica Brown trading as One Health Osteopathy Clinic