The type of personal information we collect:

We currently collect and process the following information:

· Personal identifiers, contacts, and characteristics (for example, name and contact details)

· Contact Number

· Email Address

· Address Details

· Browser Location Information

· Personal Health Information

How we get the personal information and why we have it:

Most of the personal information we process is provided to us directly by you for one of the following reasons:

· Obtaining email address, telephone number and postal address for invoicing.

· Obtaining email addresses for the purpose of communication and advertisement between client(s) and Stimulis Osteopathy.

· Personal data you disclose as part of the contact form.

· Personal data (health information) you disclose as part of the clinical session(s).

· Marketing of services may be carried out on data collected in the public domain.

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

· Your consent. You can remove your consent at any time. You can do this by contacting: Tom Sherrington (BSc MSc BOst) at Information.stimulis@gmail.com

· We have a contractual obligation.

· We have a legal obligation.

· We have a vital interest.

· We may need it to perform a public task.

· We have a legitimate interest.

Your data will be retained for the following time periods:

· Under UK law, we are required to keep any financial information for 3 years. After this period, your personal data will be irreversibly destroyed.

· Any personal data held by us for marketing and service update notifications will be kept by us until such time that you notify us that you no longer wish to receive this information.

· Data collected as part of access to our website and the platform it resides on – analytics data – will be retained for a period of 26 months from data of collection in line with Google’s updated data retention policies.

· Data on the platform will be retained for one year from the date of collection.

· Data you shared with us as part of the contact form – if it is to be used for processing then your data will be retained for the lifetime of the contract between us plus six years to be able to defend any insurance claims against us.

· If the data, you shared with us is used to respond to a query that you have and there is no contractual basis for us processing your data then this will be kept for the lifetime of the request. We will maintain enough data to prove that we have complied with your requirements for one year to demonstrate our response if challenged.

Protecting your data:

· We protect your personal data from threat such as theft, corruption & accidental loss (non-exhaustive). The measures taken to prevent these threats include:

· Only obtaining the necessary amount of personal data.

· Anonymising or destroying personal data responsibly when it is not required.

· Only processing information that is needed to perform the necessary role(s).

· Encrypting personal data to protect and reduce the chances of cyber threats.

· Protecting personal websites, networks, and IT systems from unauthorised access.

· Periodically checking that all measures are continuing to keep your data protected. Improvements to the protection of your data will be made if deemed necessary.

· Ensuring backups are completed when necessary.

· Ensuring all third parties to the same standards of data protection.

· Ensuring any staff associated with Stimulis Osteopathy are appropriately trained in the handling of personal data.

Your data protection rights:

Under data protection law, you have rights including:

· Your right of access - You have the right to ask us for copies of your personal information.

· Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

· Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

· Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

· Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

· Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.