PRIVACY POLICY

Last Updated: September 2026

Welcome to the Privacy Policy for Flimwell GetWell (accessible via www.flimwellgetwell.com). We are committed to protecting and respecting your privacy, particularly regarding your personal and health-related data.

This policy explains how we collect, use, process, and protect your personal information in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and professional guidelines established by the General Chiropractic Council (GCC).

1. Important Information & Who We Are

Data Controller

Flimwell GetWell is the data controller responsible for your personal data. [1]

  • Full Practice Name: Flimwell GetWell

  • Lead Clinician: Nell Chandler

  • Clinic Address: Ballards Wood House, Rosemary Lane, Flimwell, TN5 7PS

  • Email Address: hello@flimwellgetwell.com

  • Telephone / WhatsApp: +447947383510

  • Information Commissioner’s Office (ICO) Registration Number: [Insert your ICO registration number here]

2. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

  • Identity Data: First name, last name, date of birth, and gender.

  • Contact Data: Billing address, home address, email address, and telephone/WhatsApp numbers.

  • Financial & Transaction Data: Details about payments to and from you, and credit/debit card processing details handled securely by our third-party payment gateways.

  • Technical & Usage Data: Internet protocol (IP) address, browser type, time zone setting, and how you use our website.

  • Special Category (Health) Data: Because we provide chiropractic care and wellness treatments, we collect sensitive information regarding your past/present health, medical history, symptoms, lifestyle, clinic notes, and treatment outcomes.

3. How Your Personal Data Is Collected

We use different methods to collect data from and about you, including:

  • Direct Interactions: Information you provide by filling out booking forms, patient intake forms, contacting us via email, or speaking with us on WhatsApp.

  • Online Booking System: When you schedule an appointment via our website, data is captured directly by our booking processor.

  • In-Clinic Assessments: Health data gathered during your consultation and physical treatments.

  • Automated Technologies: As you interact with our website, we may automatically collect Technical Data using cookies and tracking pixels.

4. Our Lawful Bases for Processing Data

Under the UK GDPR, we must have a valid legal reason to process your data. We rely on the following bases:

  1. Contractual Necessity (Article 6(1)(b)): To process your online booking, manage appointments, send automated reminders, and process payments.

  2. Legal Obligation (Article 6(1)(c)): To fulfill statutory requirements, such as maintaining precise clinical records under chiropractic regulatory frameworks.

  3. Legitimate Interests (Article 6(1)(f)): To respond to enquiries, run our website smoothly, and maintain clinic security.

  4. Processing Special Category Health Data (Article 9(2)(h)): Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, and the provision of health or social care or treatment.

5. Sharing Your Data with Third-Party Processors

We do not sell your personal data. To run our online clinic operations, we securely share data with trusted third-party processors who adhere strictly to data privacy standards:

  • Online Booking & Clinic Management: Accuity, Processes your appointment data, intake forms, and health records securely.

  • Payment Gateways: Stripe / Square] (Processes payment data securely using PCI-DSS standards; we do not store your raw credit card data).

  • Website Hosting & Analytics: .Squarespace and Godaddy (Processes basic website interaction data)

All our software partners are vetted to ensure they protect your data and, where possible, host data on secure servers located in the UK or the European Economic Area (EEA).

6. Data Security & Retention

Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. Online transmission of data via our website utilizes encrypted SSL/TLS layers.

Retention Period

By law, health and chiropractic clinical records must be retained for a specific minimum period (typically 8 years after the conclusion of treatment for adults, or until a child reaching their 25th birthday). We will delete your standard inquiry data once it is no longer necessary for the purposes it was collected.

7. Your Legal Rights

Under the UK GDPR, you have the following rights regarding your data:

  • Request Access: Also known as a Subject Access Request (SAR). You have the right to receive a copy of the personal and medical data we hold about you.

  • Request Correction: The right to have incomplete or inaccurate data corrected.

  • Request Erasure: The right to request deletion of data, subject to legal limitations (note that our statutory duty to retain medical logs supersedes a deletion request for active medical files).

  • Object to/Restrict Processing: The right to limit how we process your personal data.

To exercise any of these rights, please email us directly at hello@flimwellgetwell.com.

You also have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO)(www.ico.org.uk), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.

8. Cookies Notice

Our website uses standard operational and analytics cookies to ensure the website loads properly and to monitor user traffic patterns. You can review or adjust your browser settings to decline tracking cookies at any time