*Last updated: 8 July 2026*
Data protection contact: enquiries@rockinghamforestwellbeing.co.uk
PRIVACY NOTICE
(Why we collect your personal data and what we do with it)
When you supply your personal details to this clinic they are stored and processed for 4 reasons (the bits in bold are the relevant terms used in the Data protection Act 2018, which includes the General Data Protection Regulation – ie the law):
1. We need to collect personal information about your health in order to provide you with the best possible treatment. Your requesting treatment and our agreement to provide that care constitutes a contract. You can, of course, refuse to provide the information, but if you were to do that we would not be able to provide treatment.
2. We have a “Legitimate Interest” in collecting that information, because without it we couldn’t do our job effectively and safely.
3. We also think that it is important that we can contact you in order to confirm your appointments with us or to update you on matters related to your medical care. This again constitutes “Legitimate Interest”, but this time it is your legitimate interest.
4. Provided we have your consent, we may occasionally send you general health information in the form of articles, advice or newsletters. You may withdraw this consent at any time – just let us know by any convenient method.
Special category data. Because we provide health and wellbeing services, some of the information we hold about you is health data, which is classed as “special category data” under the UK GDPR. In addition to the lawful bases above, we rely on Article 9(2)(h) of the UK GDPR: processing is necessary for the provision of health or social care or treatment, carried out by or under the responsibility of a professional subject to an obligation of professional secrecy.
We retain clinical records for a minimum of 8 years after your last appointment, or, for children, until their 25th birthday (whichever is later), in line with recommended healthcare record-keeping standards. After this period we review records and securely delete them unless there is a documented reason to retain them (for example, ongoing or anticipated care, or a legal requirement). You may request earlier deletion of data we are not required to keep.
Your records are stored:
on paper, in locked filing cabinets, and the offices are always locked out of working hours.
electronically (“in the cloud”), using a specialist medical records service. This provider has given us their assurances that they are fully compliant with the General Data Protection Regulations. Access to this data is password protected, and the passwords are changed regularly.
on our office computers. These are password-protected, backed up regularly, and the office locked out of working hours.
We will never share your data with anyone who does not need access without your written consent. Only the following people/agencies will have routine access to your data:
• The medical records service who store and process our files
• Your practitioner(s) in order that they can provide you with treatment
• Our reception staff, because they organise our practitioners’ diaries, and coordinate appointments and reminders (but they do not have access to your medical history or sensitive personal information)
• Other administrative staff, such as our bookkeeper. Again, administrative staff will not have access to your medical notes, just your essential contact details.
• We also use Mailchimp to coordinate our messages, so your name and email address may be saved on their server.
International transfers. Some of our service providers store data outside the UK. We use Mailchimp occasionally for email newsletter or marketing messages, and we do not use it for clinical records or health information. Mailchimp (The Rocket Science Group LLC d/b/a Mailchimp, part of Intuit) is based in the United States. Mailchimp’s published privacy and data processing terms state that Intuit Inc. and Mailchimp rely on the EU-US Data Privacy Framework and the UK Extension to the EU-US Data Privacy Framework, and that Mailchimp’s Data Processing Addendum includes the Standard Contractual Clauses and UK Addendum where applicable. Our practice management and medical records system is provided by Cliniko. Cliniko states that data for accounts created in the UK is stored in the UK, using secure AWS datacentre facilities, and that Cliniko provides a Data Processing Addendum including Standard Contractual Clauses where applicable. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place, such as an adequacy decision or the International Data Transfer Agreement / Addendum approved by the ICO.
From time to time, we may have to employ consultants to perform tasks which might give them access to your personal data (but not your medical notes). We will ensure that they are fully aware that they must treat that information as confidential, and we will ensure that they sign a non-disclosure agreement.
Website enquiries and online forms
If you contact us through this website, we collect the information you choose to send, such as your name, contact details and message. We use this information to respond to your enquiry and, where relevant, to arrange or discuss services at the clinic. Website enquiry details may be handled through our website form system and sent to the appropriate clinic contact so that your enquiry can be dealt with.
Please do not include unnecessary sensitive medical information in the website contact form. If your enquiry relates to treatment or an appointment, we may ask for further information through a more appropriate route.
Website, cookies and embedded services
Our website may use cookies and similar technologies to help the site work properly, remember cookie choices, protect forms from misuse, understand how the site is used, and display embedded content such as maps or booking links. More detail is available in our Cookie Policy.
Website hosting. Our website is hosted by CSM Web Design Limited in the UK using 20i infrastructure. Website data, server logs and backups may be processed for hosting, security, maintenance and support purposes.
The website may link to or embed services provided by third parties, including online booking, maps, email marketing and website security/form tools. When you use those services, their own privacy and cookie information may also apply.
Your rights. Under the UK GDPR you have the following rights in relation to your personal data:
– The right to be informed about how your data is used (this notice).
– The right of access — you can request a copy of the personal data we hold about you.
– The right to rectification — you can ask us to correct inaccurate or incomplete data.
– The right to erasure — you can ask us to delete your data. Please note that we are professionally required to retain clinical records for a minimum period (see “How long we keep your information” below), so this right may be limited while that period applies.
– The right to restrict processing in certain circumstances.
– The right to data portability for data processed by automated means on the basis of consent or contract.
– The right to object to processing based on legitimate interests, and to object at any time to direct marketing.
– The right to withdraw consent at any time where processing is based on consent (for example, our newsletter), without affecting the lawfulness of processing before withdrawal.
– Rights in relation to automated decision-making and profiling. We do not carry out any automated decision-making that has legal or similarly significant effects.
To exercise any of these rights, contact us using the details at the top of this notice. We will respond within one calendar month. If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ico.org.uk, helpline 0303 123 1113).