Privacy Policy & GDPR Data Protection ? The Trinity Practice, Shaftesbury

GDPR 2026 Privacy Notice

Scope

This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The General Data Protection Regulation (GDPR), along with the Privacy and Electronic Communications Regulations (PECR), seek to protect and enhance the rights of data subjects. These rights cover the safeguarding of personal data, protection against unlawful processing and the appropriate use and storage of personal data.

1 - The Practice

Based at 42 Bell St, Shaftesbury, Dorset, SP7 8AE which hereafter for the purposes of this Privacy Notice will be referred to as the Practice, is pleased to provide the following information:

2 - Who we are

The Practitioners diagnose and treat health conditions. Treatments are carried out in accordance with the Institute of Osteopathy’s patient charter https://www.iosteopathy.org/about-osteopathy/about-osteopathy The practice may also provide other treatments, about which our staff will be pleased to provide more details. Other treatment providers are responsible for their own healthcare records and are also bound by data protection law.

3 - Personal Data

a) For the purposes of providing treatment, the Practice may require detailed medical information. We will only collect what is relevant and necessary for your treatment. When you visit our practice, we will make notes which may include details concerning your medication, treatment and other issues affecting your health. This data is always held securely and is not shared with anyone not involved in your treatment, although for data storage purposes it may be handled by pre-vetted staff who have all signed an integrity and confidentiality agreement.

b) Contact details provided by you such as telephone numbers, email addresses and postal addresses may be used to arrange appointments, send reminders and provide information concerning your care.

c) When you interact with us, your information may move through the following systems:

Website enquiries → sent to us by email or securely stored
Online bookings → processed and stored within our practice management system, Cliniko
Appointment deposits → securely processed by Stripe
In-clinic card payments → securely processed via WorldPay
Clinical records → stored securely within Cliniko as part of your ongoing care

We do not store your card or payment details on our systems. Payments are handled by third-party providers (Stripe and WorldPay), which act as secure payment processors.

d) For marketing purposes, the Practice will only use your contact details where you have given clear consent to receive such communications. You may withdraw your consent at any time by contacting the Practice.

e) Some basic personal data may be collected about you from the forms you complete, records of correspondence and phone calls, and details of your visits to our website, including information such as Internet Protocol (IP) addresses.

f) The Practice’s website uses cookies to help identify and track visitors and understand how the website is used. You can control or disable cookies through your browser settings if you wish.

g) The Practice will only collect the information needed so that we can provide you with the services you require. The business does not sell or broker your data.

4 - Legal basis for processing personal data

Under UK data protection law, we rely on the following lawful bases depending on how your information is used:

Providing healthcare (special category data)
We process your health information to assess, treat and manage your care.
Lawful basis: Provision of healthcare and medical diagnosis, and our professional obligations as healthcare providers.

Managing appointments and clinic operations
We use your contact and booking information to arrange appointments, take deposits, manage payments and maintain accurate records.
Lawful basis: Contract (providing services you have requested) and legitimate interests (running an effective healthcare service).

Communication about your care
We may contact you regarding appointment reminders, follow-up care and relevant clinical information.
Lawful basis: Legitimate interests and provision of healthcare.

Marketing communications
We only send marketing communications where you have clearly opted in.
Lawful basis: Consent. You may withdraw this at any time.

5 - Legitimate interests pursued by Practitioners

To provide, manage and improve healthcare services and ensure the effective operation of the Practice.

6 – Consent

Where consent is relied upon (for example, marketing communications), you may withdraw it at any time using the contact details provided at the end of this Privacy Notice.

7 – Disclosure

The Practice will keep your personal information safe and secure. Only staff involved in your care or administration will have access to your information. The Practice will not disclose your Personal Information unless required to do so by law or to meet regulatory obligations, or to protect the rights, property or safety of the Practice and its patients.

8 - Retention Policy

The Practice will process personal data during the duration of any treatment and will continue to store only the personal data needed for at least eight years after the contract has expired to meet legal obligations. Records concerning minors will be retained at least until the child has reached the age of 25.

9 - Data storage

All data is held within the EEA. The Practice does not store personal data outside the EEA.

10 - Your rights as a data subject

At any point whilst the Practice is in possession of, or processing your personal data, you have the following rights:

Right of access – you have the right to request a copy of the information that we hold about you.
Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
Right to erasure – in certain circumstances you can ask for the data we hold about you to be erased.
Right to restrict processing – where certain conditions apply you have a right to restrict the processing.
Right of data portability – you have the right to have the data we hold about you transferred to another organisation.
Right to object – you have the right to object to certain types of processing such as direct marketing.
Rights relating to automated decision-making – you have the right not to be subject to decisions based solely on automated processing.

If the Practice refuses your request, we will provide a reason and you have the right to complain.