Privacy Notice
1. Who we are
A1 Bodyworks Clinic is an osteopathy practice at Unit 10, Bridgewater Craft & Garden Centre, Halton Road, Runcorn WA7 5QS. The clinic is run by Yasmine Aouane as a sole trader, who is the data controller for the personal information described here.
Our osteopaths are registered with the General Osteopathic Council and follow its standards on confidentiality.
Contact us about your data
Email: a1bodyworksclinic@gmail.com
Phone: 07903 078 269
Post: the clinic address above
ICO registration number: ZB793444.
2. What information we collect
Contact details: name, phone, email and address. From you, when you book, call, message or fill in our website form.
Booking and payment details: appointment dates, fees paid and deposits. From our booking system and payment provider.
Health information: medical history, symptoms, examination findings, treatment notes and GP details. From you, and our osteopaths during your care.
Personal details: date of birth, gender and occupation. From your new patient form.
Messages: what you send us by email, WhatsApp or the website form.
Please don’t include medical details in the website form or WhatsApp. We’ll discuss these with you in person.
We don’t use your information for automated decision-making or profiling.
3. How we use it and why we’re allowed to
Data protection law requires a lawful basis for each use. Health information is “special category” data, so it also needs an extra condition.
Assess and treat you, and keep clinical records: to provide the care you’ve asked for (Art. 6(1)(b)). For health information: providing health care under a professional duty of confidentiality (Art. 9(2)(h)).
Manage bookings, reminders, deposits and payments: to provide the care you’ve asked for (Art. 6(1)(b)).
Reply to enquiries from the website form, phone, email or WhatsApp: our legitimate interest in answering you (Art. 6(1)(f)).
Write to your GP or another professional: only with your consent, unless there is a serious risk to you or others.
Keep accounts and tax records: legal obligation (Art. 6(1)(c)).
Meet our regulator’s and insurer’s requirements: legal obligation and legitimate interest (Art. 6(1)(c) and (f)).
Send news or offers: only if you’ve opted in (see section 7).
We only collect what we need, and we never sell your information.
4. Who we share it with
Only the people involved in your care see your clinical records. We use trusted service providers to run the clinic. They act on our instructions and must keep your information secure.
Cliniko: booking, clinical notes and payments. Holds contact, booking and health information.
Stripe: card payments. Holds payment details. We never see your full card number.
Google (Gmail): email. Holds emails and website form messages.
Google Analytics: website statistics. Only used if you accept analytics cookies.
Framer: our website and contact form. Holds what you type into the form.
WhatsApp (Meta): messages. Holds messages you send us.
Xero: accounts. Holds invoices and payment records.
AGP Accountants: accounts and tax. Financial records only, no clinical information.
We may also share information if the law requires it, for example with our regulator or insurer, or to protect someone from serious harm.
If an associate osteopath treats you, they’ll see the records they need for your care.
5. Where it’s stored
Our clinical records are held in Cliniko’s UK data region. Paper records, if any, are kept locked at the clinic.
Some of our other providers, such as Google, Meta, Stripe and Framer, may process data outside the UK. Where they do, they use safeguards approved under UK law, such as the UK International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework. You can ask us for details.
6. How long we keep it
Adult clinical records: 8 years after your last appointment.
Clinical records for patients treated under 18: until their 25th birthday, or 8 years after their last appointment if that is later.
Financial records: as long as HMRC requires.
Website form, email and WhatsApp enquiries from people who don’t become patients: up to 12 months.
After that, we securely delete or destroy it.
7. Marketing and our website
Marketing. We’ll only send you news or offers if you’ve said yes. You can stop them at any time by replying “stop” or contacting us. We’ll only send occasional updates, such as clinic news or offers. Appointment reminders and messages about your care are not marketing.
Website form. When you send a message through our website, Framer passes it to our clinic email. Ticking the consent box lets us reply to your enquiry. It does not sign you up to marketing. There is a separate, optional box to join our mailing list.
Links. Our website links to other sites, such as Cliniko for booking, Google Maps and WhatsApp. Their own privacy policies apply there.
Cookies and website statistics. We use Google Analytics to understand how people use our website, for example which pages are visited and how people found us, so we can improve it. Google Analytics uses cookies (small files stored on your device). We only set these cookies if you click “Accept analytics” on our cookie banner, and we rely on your consent to do so. If you reject them, the website works in exactly the same way.
Google Analytics doesn’t tell us who you are. Google processes this data for us and may do so outside the UK (see section 5). The cookies (named _ga and _ga_…) last up to 2 years unless you delete them.
We also store your cookie choice in your browser for 6 months, so we don’t ask you on every page. This is needed to remember your choice, so it doesn’t require consent.
You can change your mind at any time using “Cookie settings” at the bottom of every page, or by clearing cookies in your browser.
8. Your rights
You have the right to:
get a copy of the information we hold about you
ask us to correct anything that’s wrong
ask us to delete your information, unless we must keep it by law (for example, clinical records)
ask us to limit how we use it, or object to how we use it
ask for your information in a format you can take elsewhere
withdraw your consent at any time, where we rely on it
To use any of these rights, contact us using the details in section 1. We’ll reply within one month, and it’s normally free.
Complaints. Please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes. We’ll update this notice when anything changes. Last updated: October 2026.