Finchley Back Care Centre (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal data we collect when you use our website or our clinic services, why we collect it, how we use it, and what rights you have over it.
This policy applies to finchleybackcare.co.uk and to the personal data we collect when you contact us, book an appointment, or visit us as a patient.
Who We Are
Finchley Back Care Centre is the data controller for the personal data described in this policy.
- Address: 2 Cyprus Road, Finchley, London, N3 3RY
- Phone: +44 20 8371 0222
- Email: Info@fbpc.co.uk
- ICO registration number: ICO:00014124928
If you have any questions about this policy or how we handle your data, please contact us using the details above.
What Personal Data We Collect
We collect different data depending on how you interact with us.
When You Contact Us or Enquire Online
- Name
- Email address
- Phone number
- Any details you choose to share about your condition or symptoms in the enquiry form
Details about your condition or symptoms are classed as health data, which UK data protection law treats as a special category of personal data requiring extra care. We explain the legal basis for handling this below.
When You Book or Attend an Appointment
- Name, contact details and date of birth
- Appointment history
- Clinical notes, assessment findings and treatment records made by your chiropractor or therapist
- Relevant medical history you disclose during your consultation
When You Browse Our Website
- Pages visited, time spent on the site, and how you navigated to us
- Approximate location and device/browser type
- Session recordings of on-screen activity, where you have given consent (see Cookies and Tracking below)
We do not collect payment card details through this website. Card or other payment details are taken separately at the clinic if applicable, and are not stored by the website.
How We Use Your Data and Our Legal Basis
| What we do | Why | Legal basis |
|---|---|---|
| Respond to your enquiry | To answer your question and arrange an appointment if you choose | Legitimate interest in providing the service you have asked for, and steps taken at your request before entering into an agreement for treatment |
| Provide chiropractic and related treatment | To deliver the care you have booked | Necessary for the provision of health care by a health professional (UK GDPR Article 9(2)(h)), together with your explicit consent to treatment obtained at the clinic |
| Keep clinical records | Required by our professional regulatory body and good clinical practice | Legal obligation and necessary for the provision of health care |
| Send appointment reminders | To reduce missed appointments | Legitimate interest, or contract, depending on how the reminder is sent |
| Analyse website usage and session recordings | To understand how the site is used and improve it | Consent, gathered through our cookie banner before any tracking begins |
| Send marketing updates, if you opt in | To keep you informed about the clinic | Consent |
Where we rely on consent, for example website tracking, you can withdraw that consent at any time without affecting the lawfulness of anything done before you withdrew it.
Cookies and Website Tracking
Our website uses cookies and similar technologies. Some are essential for the site to function. Others, including session recording and analytics tools, are only active once you have given consent through our cookie banner.
Session recording: we use Microsoft Clarity to understand how visitors use the site, for example by observing anonymised interactions such as scrolling and clicks. This does not activate until you accept it through our cookie banner.
Analytics: we use Google Analytics to understand visitor numbers and behaviour in aggregate. This does not activate until you accept it through our cookie banner.
You can change your cookie preferences at any time using the cookie settings link, or through your browser settings.
Who We Share Your Data With
We share personal data with the following types of organisation, only where necessary:
- IT and website service providers, who host the site and its data on our behalf
- Microsoft, as the provider of our session recording tool, where you have consented to this
- Google, as the provider of our analytics tool, where you have consented to this
- Regulatory bodies, such as the General Chiropractic Council, where required by law or professional obligation
- Other healthcare professionals, such as your GP, only where necessary for your care and, where required, with your consent
We do not sell your personal data to any third party.
International Data Transfers
Some of the service providers we use, including Microsoft and Google, may process data on servers located outside the UK. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK’s international data transfer addendum or an adequacy decision, to ensure your data continues to be protected to UK standards.
How Long We Keep Your Data
- Clinical records: kept in line with the retention guidance of the General Chiropractic Council and relevant professional bodies [confirm exact retention period with the GCC, commonly a minimum of several years after the last treatment, and longer for patients who were under 18 at the time of treatment]
- Enquiry form submissions that do not lead to treatment: kept for [confirm period, for example 12 months] and then deleted
- Website analytics and session recording data: kept for [confirm period based on the tool’s default retention settings, for example 12 months] and then automatically deleted or anonymised
We only keep personal data for as long as necessary for the purposes it was collected for, or as required by law or professional regulation.
How We Protect Your Data
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including access controls on clinical records and secure hosting for our website and booking systems. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.
Your Rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request erasure of your data, in certain circumstances (this may be limited for clinical records we are required to retain)
- Restrict or object to certain types of processing
- Data portability, receiving your data in a portable format where applicable
- Withdraw consent at any time, where we rely on consent as our legal basis
- Complain to the Information Commissioner’s Office (ICO) if you believe we have not handled your data properly, at ico.org.uk or by phone on 0303 123 1113
To exercise any of these rights, contact us using the details at the top of this policy.
Children’s Privacy
We may treat patients under 18 with appropriate parental or guardian consent. Where we hold data about a child, we take extra care with how long it is retained and who can access it. Our website is not directed at children and we do not knowingly collect data from children through the website itself.
Changes to This Policy
We may update this policy from time to time, for example if we change the tools we use or if data protection law changes. The date at the top of this page shows when it was last updated. We encourage you to review this page periodically.
Contact Us
If you have any questions about this policy or how we handle your personal data, please contact us:
- Phone: +44 20 8371 0222
- Email: Info@fbpc.co.uk
- Address: 2 Cyprus Road, London, United Kingdom, N3 3RY
Notes for whoever finalises this page
- Every bracketed placeholder above needs a real answer before publishing, most importantly the exact clinical record retention period, which should come from the General Chiropractic Council’s Website Toolkit or professional indemnity insurer, not a guess.
- This assumes cookies and session recording are consent gated per item 4 of the fix tracker. If Clarity is switched off instead of consent gated, remove the Clarity references above.
- If any online payment is ever taken through the website in future, for example a booking deposit, this policy needs a payment data section added back in at that point, written accurately for whatever payment processor is actually used.
- Have this reviewed by a solicitor or data protection specialist familiar with UK health data before it replaces the current live policy, exactly as flagged in the original audit.
