PATIENT DATA & PRIVACY NOTICE

PATIENT PRIVACY NOTICE

How we collect, use, and protect your personal information

UK GDPR Compliant | Data (Use & Access) Act 2025 | Updated June 2026

This Privacy Notice explains how and why I collect, use, and protect your personal information when you attend a foot health appointment, purchase a product or service, contact me, or otherwise engage with my practice. You will receive this notice when registering as a new patient.

1. INFORMATION I COLLECT

When you register or book an appointment, you may provide:

- Your name, contact details, and postal address

- Medical history and relevant health information

- Consultation notes and treatment details

- Payment information

- Any information shared through email, messages, or booking forms

Your information is stored securely on an encrypted, password-protected electronic system.

2. USE OF AI TECHNOLOGY FOR CONSULTATION NOTES

To support accurate record-keeping, I may use a secure, GDPR-compliant AI transcription tool during clinical appointments.

- Audio is used only to create accurate consultation notes

- Transcriptions are anonymised and checked before being added to your clinical record

- All audio and draft transcripts are permanently deleted after processing

- No patient-identifiable data is retained by the AI provider

This process helps maintain accurate, timely records while fully protecting your confidentiality.

3. WHY I COLLECT YOUR INFORMATION

Special category health data — Article 9(2)(h)

Your medical history, consultation notes, and treatment details are classed as special category data under UK GDPR. In addition to the lawful bases below, I process this information under Article 9(2)(h) — for the purposes of preventive medicine and the provision of health care by a health professional.

To provide your foot health care

- To deliver safe and appropriate clinical treatment

- To maintain accurate and up-to-date clinical records

- To contact you about appointments, aftercare, or important service updates

For legal and regulatory purposes

- To comply with tax, legal, or professional obligations

- To retain clinical records for the required period

- To respond to legal requests where applicable

For optional marketing (with your consent)

- To send newsletters or practice updates — you may withdraw consent at any time

4. INFORMATION SHARING & DISCLOSURE

Your information is shared only when necessary and in limited, controlled circumstances:

Medical professionals: With your consent, I may share relevant clinical information with your GP or consultant to support continuity of care.

Another practitioner: With your consent, I may share your clinical notes with a Foot Health Practitioner or Podiatrist if you require cover or onward care.

Service providers: Trusted software or administrative providers may receive limited information only as needed to operate my practice (e.g. booking software, payment processing).

Business transfers: If I sell or merge the practice, your information may be transferred lawfully and with prior notice.

Legal compliance: Information may be disclosed if required by law or a regulatory authority.

5. MARKETING COMMUNICATIONS

From time to time I may contact you about important operational updates, such as clinic closures or changes to services. This forms part of normal service delivery.

Optional marketing — such as newsletters or practice news — will only be sent with your consent. You can change your preferences or opt out at any time by contacting me directly.

6. DATA RETENTION

- Foot health clinical records are retained for a minimum of 8 years after your last appointment, in line with professional guidance

- Data relating to invoices or payments is kept for at least 6 years for tax and accounting purposes

- Information is retained only for as long as necessary to fulfil the purposes outlined in this notice

7. INTERNATIONAL DATA TRANSFERS

Some third-party software providers may process your data outside the UK or EU (for example, booking or record-keeping systems). Where this occurs, I rely on approved safeguards — such as the EU–US Data Privacy Framework or equivalent measures — to ensure your information remains protected.

8. YOUR RIGHTS

Under UK GDPR you have the following rights:

Access — Request a copy of the information I hold about you.

Correction — Ask for inaccurate data to be corrected.

Erasure — Request deletion of your personal data. Please note that clinical health records are generally retained for the full period set out in Section 6, as deletion could compromise patient safety and I have a legal and professional obligation to maintain accurate records. Contact data and marketing preferences can be deleted on request.

Restriction — Request that I limit how I use your data while a concern is being resolved.

Object — Withdraw consent for marketing at any time, or object to legitimate interest processing.

Portability — Request your data in a portable format where technically feasible.

Complain — Raise concerns with me first (Section 9) or with the ICO at ico.org.uk.

9. HOW TO RAISE A CONCERN OR COMPLAINT

Your right to complain directly to us — Data (Use and Access) Act 2025

Under the Data (Use and Access) Act 2025, you have the right to raise a data protection concern directly with me before approaching the ICO. I take all concerns seriously and will handle them promptly and fairly.

Please contact me in the first instance:

Email: [email protected]

Post: Belinda Billinge, c/o 12 Reddings House, Twickenham Close, Swindon, SN3 3FP

I will acknowledge your complaint within 30 days and keep a record of how it is handled. If you remain dissatisfied after I have responded, you may escalate your concern to the ICO at ico.org.uk.

10. CONTACT & DATA CONTROLLER

For the purposes of UK GDPR and the Data (Use and Access) Act 2025, Belinda Billinge is the data controller for your personal information.

Email: [email protected]

Website: feet.theconsideratepractice.com