Effective Date: July 2026

At Total Balance Osteopathy, we are committed to protecting your privacy and ensuring that your personal information is processed fairly, lawfully and transparently.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, contact us, book appointments, or receive osteopathic healthcare services from us.

We process personal information in accordance with the:

• UK General Data Protection Regulation (UK GDPR) 
• Data Protection Act 2018 
• Data (Use and Access) Act 2025 
• Applicable healthcare and professional standards 

We continually review our procedures to ensure your personal information remains secure and is handled responsibly.

1. WHO WE ARE

Total Balance Osteopathy provides osteopathic assessment, treatment, rehabilitation and related healthcare services.

The clinic is owned and operated by a registered osteopath who is regulated by the General Osteopathic Council (GOsC). All treatment is provided in accordance with the Osteopathic Practice Standards and other relevant professional guidance.

Data Controller Registration

Total Balance Osteopathy is registered as a data controller with the Information Commissioner’s Office (ICO). 

Our ICO registration number is: ZC168483. You can verify our registration at: https://ico.org.uk/ESDWebPages/Search

For any questions regarding this Privacy Policy or your personal information, please contact:

Total Balance Osteopathy

Email: info@totalbalanceosteopathy.co.uk

Telephone: 07471 425304

Address: 20 Mansfield Close  Worthing  West Sussex  BN11 2QT

2. WHAT INFORMATION WE COLLECT

Personal Information

We may collect and process the following information:

• Name
• Address
• Email address
• Telephone number
• Date of birth
• Emergency contact details
• GP details (where relevant)

Health Information

As part of providing safe and effective osteopathic care, we may collect and process health information, including:

• Medical history
• Symptoms and injuries
• Previous investigations or diagnoses
• Medication information
• Lifestyle, occupational and activity information relevant to your care
• Treatment records and clinical notes

Health information is classified as Special Category Data under UK GDPR and is subject to additional legal protection.

Website Information

When you visit our website, we may automatically collect limited technical information such as:

• IP address (anonymised)
• Browser type
• Operating system
• Referring website
• Pages visited and time spent on pages

This information helps us maintain the security and performance of our website and does not normally identify you personally.

3. CLINICAL RECORDS

As a regulated healthcare provider, we are legally and professionally required to maintain accurate clinical records relating to your care.

These records may include consultation notes, examination findings, treatment records, medical history information, referral letters, reports and correspondence relevant to your treatment.

These records form part of your healthcare record and are maintained in accordance with:

• General Osteopathic Council requirements 
• Osteopathic Practice Standards 
• Applicable legislation 
• Professional indemnity requirements 

Maintaining accurate clinical records helps us provide safe, effective and continuous healthcare and fulfil our professional obligations.

4. HOW WE COLLECT YOUR INFORMATION

We may collect information when you:

• Book an appointment
• Complete registration, consent or medical history forms
• Contact us by telephone, email or website enquiry form
• Attend appointments
• Subscribe to clinic communications
• Use our website

Online bookings, patient forms and clinical records are securely managed through Cliniko, our practice management software provider.

Cliniko acts as a Data Processor on our behalf under a Data Processing Agreement that complies with UK GDPR requirements.

5. HOW WE USE YOUR INFORMATION

We use your information to:

• Arrange and manage appointments
• Provide osteopathic assessment and treatment
• Maintain accurate clinical records
• Communicate with you regarding your care
• Send appointment reminders and administrative communications
• Prepare reports or referral letters where appropriate
• Communicate with other healthcare professionals where appropriate and with your consent (unless another lawful basis applies) 
• Meet legal, regulatory, professional and insurance obligations
• Improve our services and website functionality

We will only process your information where we have a lawful basis to do so.

6. LAWFUL BASIS FOR PROCESSING

We process personal information under one or more of the following lawful bases:

• Contract – to provide healthcare services requested by you
• Legal obligation – to comply with legal, regulatory and professional requirements
• Legitimate interests – to manage and improve our services
• Provision of healthcare – for processing special category health data necessary for healthcare purposes

Where consent is required, you may withdraw that consent at any time. Withdrawal of consent will not affect processing that has already taken place lawfully.

7. SHARING YOUR INFORMATION

We treat all personal information as confidential and will never sell your personal information or share it for marketing purposes.

We will only share your information where it is necessary, lawful and appropriate to do so:

• With healthcare professionals involved in your care
• With your insurer where relevant to your claim
• With legal or regulatory bodies where required by law
• With trusted service providers who support our business operations

There may be occasions when it is clinically appropriate for your osteopath to communicate with your GP or another healthcare professional involved in your care. Wherever possible, this will be discussed with you beforehand, and your consent obtained before information is shared.

Information will only be shared with your insurer where you have made a relevant claim, and such sharing is necessary for that purpose.

All organisations with whom we share personal information are expected to maintain appropriate security measures and comply with applicable data protection legislation.

8. THIRD-PARTY SERVICES

Cliniko

We use Cliniko, provided by Red Guava Pty Ltd, to manage appointments, patient records, communications, invoices and receipts and online bookings. As a UK-based account, your data is stored on servers located within the United Kingdom. Cliniko acts as a data processor on our behalf, and a written Data Processing Agreement is in place in accordance with UK GDPR requirements. Further information about Cliniko’s security and privacy practices is available at:  https://www.cliniko.com/security and  https://www.cliniko.com/policies/privacy/

Website Hosting

Our website is hosted by IONOS (1&1 IONOS SE). IONOS operates data centres within the United Kingdom and a written Data Processing Agreement is in place with them in accordance with UK GDPR requirements. Further information about IONOS’s data protection practices is available at:  www.ionos.co.uk

Website Analytics

Our website uses IONOS SiteAnalytics, a built-in analytics tool provided by IONOS. This tool collects anonymised data about website visits, such as pages viewed and general traffic patterns, for the purpose of maintaining website security and performance. No cookies are used by this tool and no personal data about individual visitors is stored.

Google Business Profile

We maintain a Google Business Profile so that patients can locate our clinic, obtain directions, view opening hours and, if they choose, leave reviews. This profile is operated by Google LLC. Any data collected when you interact with our Google Business Profile is governed by Google’s Privacy Policy, available at:  www.google.com/policies/privacy

Google Maps

Our website uses Google Maps to provide location and mapping information for our clinic. Google Maps is provided by Google LLC. When this service is enabled, Google may process information about your device and use of the service in accordance with its Privacy Policy, available at:  policies.google.com/privacy

Social Media

We maintain business pages on Instagram and Facebook (operated by Meta Platforms, Inc.) and a YouTube channel (operated by Google LLC).

If you interact with our social media pages or YouTube channel, the relevant platform may collect and process information about you in accordance with its own privacy policy.

Further information is available at: Meta Privacy Policy:  www.facebook.com/privacy/policy

Google Privacy Policy (including YouTube): policies.google.com/privacy

We do not receive personal data about individual visitors to our social media pages or YouTube channel beyond information that you choose to share with us directly, for example by sending us a message or submitting a comment.

We do not use social media or YouTube interactions to build marketing profiles about patients.

9. INTERNATIONAL TRANSFERS

We aim to ensure that personal information is stored and processed within the United Kingdom wherever reasonably possible.

Where any of our service providers transfer personal information outside the UK, they are required to implement appropriate safeguards in accordance with UK data protection legislation to ensure your information remains adequately protected.

10. MARKETING COMMUNICATIONS

If you choose to receive clinic news, updates or marketing communications, we may contact you by email.

You can withdraw your consent to marketing communications at any time by:

• Clicking the unsubscribe link within emails
• Contacting the clinic directly

Please note that withdrawing marketing consent will not affect communications relating to your appointments or healthcare.

11. COOKIES

Our website uses cookies and similar technologies to support website functionality and certain third-party services.

When you first visit our website, you are provided with privacy settings that allow you to accept, reject or configure optional services. You can also review and change your preferences using the Privacy Settings tool available on the website.

Depending on your preferences, the following services may be used:

• IONOS SiteAnalytics – used to provide anonymised information about website visits and general traffic patterns to help us understand website performance.
• Google Maps – used to display location and mapping information. Google may process information when this service is enabled.
• Cliniko Booking System – used to provide our embedded online appointment booking service. Cliniko may process information when you use the booking system.

Where consent is required, these services will only be activated in accordance with the privacy preferences you select.

You can change or withdraw your consent at any time through the Privacy Settings tool on our website. You can also control cookies through your browser settings, although disabling certain technologies may affect some website functionality.

Further information about the third-party providers we use and how they process personal information can be found in Section 8 of this Privacy Policy.

12. DATA STORAGE AND SECURITY

We take appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, misuse or disclosure.

Patient information is stored using secure systems and is only accessible to those who require access in order to provide healthcare services or manage clinic operations.

We regularly review our security procedures to help protect the information we hold.

13. DATA RETENTION

We retain clinical records for a minimum of 8 years following the end of your treatment, in accordance with the requirements of the General Osteopathic Council and applicable legal, regulatory and insurance obligations.

Where treatment has been provided to a child or young person, records will be retained until the patient reaches the age of 25, or for 8 years from the end of treatment, whichever is the later.

When information is no longer required, it will be securely deleted or destroyed in accordance with applicable requirements.

14. AUTOMATED DECISION-MAKING

We use automated systems to send appointment reminders and administrative communications by email. These are operational tools only. No decisions about your care, treatment or access to our services are made solely by automated means. All clinical decisions are made by your osteopath.

15. CHILDREN'S INFORMATION

Total Balance Osteopathy provides osteopathic care for babies, children and young people.

Where treatment is provided to a child or young person, we may collect personal information from a parent, legal guardian or person with parental responsibility where appropriate.

This information is processed solely for the purpose of providing safe and effective healthcare and fulfilling our legal and professional obligations.

As children grow older and are able to make decisions about their own healthcare, we will process their personal information in accordance with applicable legislation and professional guidance regarding capacity and consent.

We take particular care to protect the privacy and confidentiality of children's personal information.

16. DATA PROTECTION COMPLAINTS

We are committed to handling personal information responsibly and in accordance with applicable data protection legislation.

If you have any concerns about how we have handled your personal information, we encourage you to contact us in the first instance so that we have the opportunity to investigate and resolve the matter.

You can raise a data protection concern by contacting us using the details provided at the end of this Privacy Policy.

We will:

• Acknowledge receipt of your complaint within 30 days
• Investigate the matter thoroughly; and 
• Aim to respond without undue delay. 

If you remain dissatisfied following our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Information about making a complaint can be found at:  https://ico.org.uk/make-a-complaint/

17. YOUR RIGHTS

Under UK GDPR, you have the right to:

• Request access to your personal information
• Request correction of inaccurate information
• Request erasure of information where appropriate
• Restrict or object to certain processing activities
• Withdraw consent where applicable
• Request transfer of your information where legally applicable
• Lodge a complaint with the Information Commissioner’s Office (ICO)

Not all rights apply in every circumstance, particularly where healthcare providers have legal or professional obligations to retain clinical records.

If you wish to exercise any of your rights, please contact us using the details provided below.

We will respond to requests in accordance with UK data protection legislation.

Further information about your rights is available from the Information Commissioner's Office:  https://www.ico.org.uk

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in legislation, regulatory guidance, professional standards, technology or the way in which we provide our services.

The latest version will always be available on our website.

16. CONTACT US

If you have any questions regarding this Privacy Policy or how your personal information is processed, or if you wish to exercise any of your data protection rights, please contact:

Total Balance Osteopathy

Email: info@totalbalanceosteopathy.co.uk

Telephone: 07471 425304

Address:  20 Mansfield Close  Worthing  West Sussex  BN11 2QT

If you are not satisfied with our response, you have the right to contact the Information Commissioner’s Office (ICO):

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website:  https://www.ico.org.uk

Telephone:  0303 123 1113