Last updated: 4 August 2026

Move Free Pontypool respects your privacy and is committed to protecting your personal information.

This privacy policy explains what information is collected, why it is used, how it is stored and shared, and the rights available to you under the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable laws.

Who is responsible for your information?

The data controller is:

Move Free Pontypool
13 Broad Street
Abersychan
Pontypool
NP4 7BQ

Telephone: 07922 278249
Email: movefreepontypool@gmail.com

The data controller decides how and why your personal information is processed.

Information we may collect

Depending on how you contact or use the clinic, information collected may include:

• your name

• date of birth or age

• address

• telephone number

• email address

• emergency contact details

• appointment and payment information

• GP or other healthcare professional details

• medical history

• medication

• symptoms, diagnoses and examination findings

• treatment records and clinical notes

• rehabilitation plans and progress

• referral letters, imaging reports or other healthcare correspondence

• consent and communication preferences

• website enquiries

• feedback, complaints or reviews

• technical website information, such as IP address, browser type and cookie information

Health information is classed as special category personal data and receives additional legal protection.

How information is collected

Information may be collected when you:

• make an enquiry by telephone, email, website form, text message or social media

• book, cancel or rearrange an appointment

• complete a consultation or patient form

• attend an appointment

• provide medical documents or correspondence

• communicate with the clinic after treatment

• make a payment

• leave feedback or make a complaint

• subscribe to marketing communications

• use the website and accept relevant cookies

Information may also be received from another healthcare professional, insurer, parent, guardian or representative where appropriate and lawful.

Why your information is used

Personal information may be used to:

• arrange and manage appointments

• confirm your identity

• provide safe and appropriate clinical care

• assess your health and suitability for treatment

• maintain accurate clinical records

• communicate about appointments and care

• send appointment reminders

• provide rehabilitation advice or aftercare

• refer or communicate with other healthcare professionals where appropriate

• process payments and maintain financial records

• respond to enquiries, complaints or legal claims

• meet professional, regulatory, insurance and legal obligations

• maintain the safety and security of the clinic

• improve clinic services

• send marketing communications where you have agreed to receive them

The ICO requires privacy notices to explain why information is processed, how long it is kept and who it may be shared with.

Lawful bases for processing

Depending on the circumstances, personal information may be processed because:

• it is necessary to provide a service or take steps before providing a service

• it is necessary to comply with a legal or professional obligation

• it is necessary for legitimate business interests, provided your rights do not override those interests

• you have provided consent, particularly for optional marketing communications

• it is necessary to establish, exercise or defend legal claims

• it is necessary to protect someone’s vital interests in an emergency

Health information requires both a lawful basis under Article 6 of the UK GDPR and an additional condition for processing special category data under Article 9.

Health information may be processed where necessary for the provision and management of healthcare by a regulated healthcare professional who is subject to duties of confidentiality.

Consent to clinical examination or treatment is separate from the lawful basis used to maintain necessary clinical records.

Appointment reminders and communication

Your contact details may be used to:

• confirm bookings

• send appointment reminders

• notify you about changes

• provide relevant aftercare or rehabilitation information

• respond to questions about your care

Messages may be sent by telephone, text message, email or the booking system selected by the clinic.

Please avoid sending highly sensitive medical information through public social media comments.

Marketing communications

Marketing emails or newsletters will only be sent where you have actively agreed to receive them or where another lawful basis applies.

You can unsubscribe at any time using the unsubscribe link in an email or by contacting the clinic.

Withdrawing from marketing will not affect necessary appointment or clinical communications.

Who information may be shared with

Information is not sold to other organisations.

It may be shared where necessary with:

• your GP or another healthcare professional

• diagnostic imaging or referral providers

• professional regulators

• insurers and indemnity providers

• legal, accounting or professional advisers

• payment providers

• appointment-booking and practice-management providers

• website and hosting providers, including Wix

• email, telephone or text-message providers

• IT support and secure data-storage providers

• government, regulatory or law-enforcement bodies where legally required

Only information reasonably necessary for the relevant purpose will be shared.

Where appropriate, your consent will be obtained before sharing clinical information with another healthcare professional, unless disclosure is required by law or justified by a serious safety concern.

Service providers and data processors

Some organisations process information on behalf of Move Free Pontypool. These may include website hosting, booking, email, payment and clinical-record systems.

These organisations are expected to process information securely and only according to appropriate instructions and contracts.

You should add the exact services you use here, for example:

• Wix

• your online booking provider

• your patient-record system

• your payment provider

• your email provider

Do not leave this part vague once the systems are confirmed.

International data transfers

Some service providers may process or store information outside the United Kingdom.

Where this happens, reasonable steps will be taken to ensure appropriate safeguards are in place, such as adequacy regulations or approved contractual protections.

How long information is kept

Information is kept only for as long as it is reasonably needed for the purpose for which it was collected and to meet legal, professional, insurance and regulatory responsibilities.

Clinical chiropractic records are normally retained for:

• Adults: eight years after the last appointment

• Children: until the patient’s 25th birthday, or 26th birthday if they were aged 17 when treatment ended

These retention periods follow GCC guidance.

Other information may be retained for different periods, for example:

• financial and tax records, normally six years

• enquiries that do not become appointments, only as long as reasonably necessary

• marketing information, until consent is withdrawn or it is no longer needed

• complaints or legal matters, for as long as needed to manage the issue and relevant limitation periods

Information will be securely deleted, destroyed or anonymised when it is no longer required. The ICO expects organisations to review retention periods and remove information that is no longer needed.

Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for a copy of your personal information

• ask for inaccurate information to be corrected

• ask for incomplete information to be completed

• request that processing is restricted

• object to certain uses of your information

• request erasure in certain circumstances

• request transfer of information where applicable

• withdraw consent where processing is based on consent

• complain about how your information has been handled

The right to erasure is not absolute. Information may need to be retained to meet healthcare, regulatory, insurance or legal obligations.

To exercise a right, contact:

movefreepontypool@gmail.com

Identity may need to be confirmed before information is released.

Accessing your clinical records

You may request access to your clinical records.

Requests will normally be answered within one month, although additional time may be allowed for particularly complex requests.

Information may occasionally be withheld or redacted where disclosure would adversely affect another person’s rights or where another lawful exemption applies.

Security

Reasonable technical and organisational measures are used to protect personal information from:

• unauthorised access

• accidental loss

• alteration

• disclosure

• destruction

• misuse

Measures may include password protection, restricted access, secure systems, encrypted devices, backups and appropriate confidentiality procedures.

No electronic system is completely risk-free, but reasonable steps will be taken to protect the information held.

Website cookies

The website may use cookies and similar technologies to:

• make the website function correctly

• understand how visitors use the website

• remember preferences

• support booking, security or analytics functions

Non-essential cookies should only be used after appropriate consent has been obtained.

Further information should be provided in a separate Cookie Policy or through the website’s cookie banner.

Social media and public reviews

Information shared publicly on social media, Google reviews or other public platforms may be visible to other people.

Move Free Pontypool cannot control how information posted publicly by a user is copied or shared by others.

Patients are encouraged not to include sensitive medical details in public comments or reviews.

Children’s information

Information about children and young people will only be collected where necessary to provide care and meet professional obligations.

Consent and involvement of a parent or guardian will be managed according to the young person’s age, understanding, best interests and applicable healthcare law.

This is separate from the UK GDPR age rules for online information services.

Changes to this privacy policy

This policy may be updated when the clinic’s systems, services, professional requirements or data-protection laws change.

The latest version will be published on the website with the date it was last updated.

Complaints

Please contact Move Free Pontypool first if you have concerns about how your information has been used.

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Telephone: 0303 123 1113

The ICO provides guidance on privacy notices and people’s information rights.