Privacy notice
Last updated: 8 November 2026
The short version
- I collect only what I need to treat you safely, run appointments and get paid.
- Your health information is confidential. I share it only with your consent, or where the law requires it.
- Your records are kept in Cliniko, a secure clinic system that stores UK accounts' data in the UK.
- Adult records are kept for 8 years after your last appointment, then securely deleted.
- You can ask to see, correct or receive a copy of your information at any time.
Who I am
ID Osteopathy is run by Iain Davis, a registered osteopath (General Osteopathic Council number 11668). I am the "data controller" for your information, which means I decide how it is used and I am responsible for keeping it safe.
Practice address: ID Osteopathy, c/o Reflections, 163 High Street, Harborne, Birmingham B17 9QE.
Email: iain.davis@idosteo.com · Phone: 07437 047745
What information I collect
- Contact details: your name, address, phone number, email address and date of birth.
- Health information: your symptoms, medical history, medication, examination findings, treatment notes, the advice I give you and your consent to treatment.
- Other details you choose to share: for example your GP's name, your work, sport or activities, or an emergency contact.
- Appointment and payment records: bookings, cancellations, invoices and receipts.
- Messages: emails, texts and call notes about your care or appointments.
Most of this comes from you. With your permission, I may also receive information from your GP, another health professional or your health insurer.
Why I use it, and the legal basis
Data protection law requires me to tell you the legal basis for each use of your information. Health information is "special category" data, so it needs an extra condition too.
| What I use it for | Legal basis (UK GDPR) |
|---|---|
| Assessing and treating you, and keeping clinical records | Providing the service you have asked for (Article 6(1)(b)), and providing health care as a registered health professional bound by confidentiality (Article 9(2)(h)) |
| Booking appointments and sending reminders | Providing the service you have asked for (Article 6(1)(b)) |
| Keeping records as my regulator, insurer and HMRC require | Legal obligation (Article 6(1)(c)) |
| Running the practice, such as handling queries or complaints | Legitimate interests (Article 6(1)(f)) |
| Writing to your GP or another professional, or sending a report to your insurer | Your consent, which I ask for each time |
I do not send marketing emails or sell your information.
Online booking through Cliniko
When you book online, or when I record your appointment and treatment notes, your information is stored in Cliniko, a clinic management system. Cliniko acts on my instructions and is not allowed to use your information for its own purposes.
- Cliniko stores data for UK accounts on servers in the UK.
- Cliniko is based in Australia, so it has a data processing agreement with standard contractual clauses in place to protect your information under UK law.
- Information is encrypted while it is sent and while it is stored.
The booking calendar on this website is provided by Cliniko. You can read more on Cliniko's security page.
Who I share your information with
- Your GP or another health professional: only with your consent, unless there is an urgent risk to your health or someone else's safety.
- Your health insurer: only if you ask me to, for example to support a claim.
- Service providers who help me run the practice: Cliniko (records and booking) and SumUp (card payments). SumUp only receives the details needed to take your payment, never your clinical notes.
- Where the law requires it: for example a court order, the General Osteopathic Council, or a safeguarding concern.
- My professional indemnity insurer: only if needed to deal with a complaint or claim.
Reflections salon, where my treatment room is, does not have access to your records.
How I keep it safe
- Clinical records are kept in Cliniko, protected by a strong password and two-step login.
- I don't use paper forms. Everything is recorded directly in Cliniko.
- Email and text messages are not always fully secure. Please don't send detailed health information by email unless you are happy to. You can tell me at your appointment instead.
How long I keep it
| Record | How long |
|---|---|
| Adult clinical records | 8 years after your last appointment |
| Records for children and young people | Until their 25th birthday (26th if they were 17 when treatment ended), or 8 years after the last appointment if that is longer |
| Payment and tax records | As long as HMRC requires, usually 6 years |
| Enquiries from people who never book | Up to 12 months |
After that, records are securely deleted. If I stop practising, I will either pass your records securely to another registered osteopath or keep them safely until the end of these periods. If your records are going to move, I will let you know.
Your rights
You have the right to:
- See your information: ask for a copy of your records. This is free, and I will reply within one month.
- Correct it: ask me to fix anything that is wrong or incomplete.
- Ask me to delete it: I will do this where I can. I may need to keep clinical records for the periods above, and if so I'll explain why.
- Limit or object to its use: in some situations, such as where I rely on legitimate interests.
- Take it elsewhere: ask for a copy in a common digital format, or for it to be sent to another practitioner.
- Withdraw consent: at any time, for anything I do only with your consent.
To use any of these rights, email iain.davis@idosteo.com or speak to me at your appointment. I may need to check your identity first.
Children
For patients under 16, a parent or guardian usually gives consent and can ask for the child's information. Young people who understand their care can make these requests themselves.
This website
This website does not use cookies or tracking tools. Its fonts load from Google Fonts, which means your browser shares your IP address with Google when the page loads. The booking calendar is run by Cliniko, which may use cookies needed for booking to work.
Complaints
If you are unhappy with how I have handled your information, please tell me first so I can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
I will update this page if anything changes. The date at the top shows when it was last revised.