Privacy Policy

Book an appointment
BODY REPAIR CLINIC LTD
Privacy Policy

Last updated: June 2026

Body Repair Clinic Ltd (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, make an enquiry, or receive treatment or services at our clinic.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (ICO).

1. Who We Are
 

For any questions about this policy, or to exercise your rights, please contact us using the details above. Our Clinic Director, Chela Collingbourne, is responsible for data protection matters.

2. What Data We Collect

We collect different types of personal data depending on how you interact with us. The categories are set out below.

2.1 Website Visitors
  • Technical information: IP address, browser type, device type, operating system, referral source
  • Usage data: pages visited, time on site, click patterns, anonymised analytics data via Google Analytics
  • Cookies (see our Cookie Policy for full details)
2.2 Enquiries and Bookings
  • Identity information: name, date of birth, address, telephone number, email
  • Communication content: the message you send us, including by email, contact form, WhatsApp, social media or phone
  • Booking details: services requested, preferred appointment times, practitioner preferences
2.3 Patient Records (Special Category Health Data)

If you become a patient, we collect additional information necessary to provide you with safe and effective treatment. This is classified as special category personal data under UK GDPR and is given enhanced protection.

 

  • Medical history: past and current conditions, medications, allergies, prior treatments, GP details, relevant family history
  • Clinical records: assessment findings, diagnosis, treatment notes, outcomes, recommendations, follow-up plans
  • Body and biometric data: physical assessment findings, postural measurements, range of motion, and (where applicable) photographs of posture and lower limbs taken as part of an assessment
  • Foot scanner data: AI foot scan data, pressure distribution, arch type, foot dimensions, lower-limb alignment and posture analysis. See section 2.4 below for details
  • Insurance and funding information: where treatment is funded through a third party (e.g. health insurer or solicitor in a personal injury claim)
2.4 Foot Scanner (X5 Foot Scanner)

Our X5 Foot Scanner is classified by the manufacturer (Footwork Lab) as a commercial wellness device, not a regulated medical device. It is used as a screening and wellness assessment tool to inform clinical care.

 

When you have a Foot, Posture & Lower Limb Wellness Assessment, we collect:

 

  • Pressure distribution, arch type, foot dimensions and asymmetry data from the scan
  • Photographs of standing posture (front and side) and lower limb alignment
  • A scan report generated by the device containing the above data
 

Important: The scanner is operated in offline mode. Patient data is processed on the device in clinic and is not uploaded to the manufacturer’s servers. The scan report is emailed from a clinic-controlled mailbox (info@bodyrepair.clinic) to you, and saved to your clinical record in our patient management system.

Once the report is saved, your individual profile is wiped from the scanner. We do not retain identifiable patient data on the scanner long-term.

2.5 Payments
  • Online payments and deposits: card details processed securely by Stripe. We do not store full card details on our systems
  • In-clinic card payments: processed via Dojo. We do not store full card details
  • Transaction records: amounts, dates, services, payment method (held for accounting and tax purposes)
2.6 Marketing Communications

Where you have opted in, we send marketing emails about our services, offers and clinic news. You can unsubscribe at any time. We do not sell or share your contact details with third parties for marketing purposes.

3. Legal Basis for Processing

UK GDPR requires us to have a lawful basis for processing your personal data. We rely on the following:

 

  • Contract: to provide the services you have booked and to manage your appointments and payments.
  • Legal obligation: to maintain clinical records and meet regulatory requirements set by professional bodies (e.g. General Osteopathic Council, Chartered Society of Physiotherapy) and for tax/accounting law.
  • Legitimate interests: to operate our clinic effectively, including appointment reminders, follow-up care, internal record-keeping, and improving our services.
  • Consent: for marketing communications, posture/clinical photographs, and any use of your data beyond what is necessary for your direct care. You can withdraw consent at any time.
  • Vital interests: in an emergency where processing your data is necessary to protect your life or someone else’s.
 

For special category health data, we rely on UK GDPR Article 9(2)(h): processing is necessary for the provision of health treatment by a health professional bound by a duty of professional confidentiality.

4. Who We Share Your Data With

We do not sell your data. We share it only where necessary to provide our services or meet legal obligations. Our key data processors are:

 

  • Cliniko: our patient management and clinical records system. Cliniko stores patient records, appointments, treatment notes and uploaded documents (including foot scan PDFs). Data is held within the UK/EU. Cliniko is GDPR compliant.
  • PepTalkr: our email and patient communication automation system, used for appointment reminders and (with your consent) marketing communications.
  • WhatsApp (Meta Platforms): where you choose to contact us via WhatsApp, your messages are processed by Meta. Meta may process data outside the UK under Standard Contractual Clauses. We save only clinically relevant information to your record and ask that you avoid sending sensitive health information by WhatsApp where possible.
  • Stripe: payment processor for online bookings and deposits. Stripe is a regulated payment provider that processes card details directly and securely.
  • Dojo: our in-clinic card terminal provider. Dojo processes card payments at the point of sale.
  • Footwork Lab (X5 Foot Scanner manufacturer): manufacturer of the foot scanning device. We operate the scanner in offline mode so that patient data is not uploaded to Footwork Lab’s servers. Footwork Lab may be contacted for technical support but does not have routine access to patient data.
  • Google Analytics: anonymised website analytics. No personally identifiable data is shared with Google through our analytics.
  • Email and hosting providers: we use one.com for email services. Email is encrypted in transit.
  • Other healthcare professionals: where clinically necessary and with your consent, we may share information with your GP, specialist or another healthcare provider involved in your care.
  • Insurers, solicitors and funding bodies: where your treatment is funded through a health insurer or related to a legal claim, and where you have authorised us to do so.
  • Regulators, courts and law enforcement: where we are legally required to disclose information (e.g. court order, safeguarding obligation, professional regulator investigation).
5. International Data Transfers

Some of our service providers may transfer data outside the UK. Where this happens, we ensure appropriate safeguards are in place, including UK Standard Contractual Clauses or adequacy decisions. The X5 Foot Scanner is operated in offline mode specifically to prevent patient data being transferred to its manufacturer’s servers outside the UK.

6. How Long We Keep Your Data

We keep your data only as long as necessary for the purposes set out in this policy or as required by law. Specific retention periods include:

 

  • Patient clinical records (adults): 8 years from the date of your last appointment, in line with General Osteopathic Council and professional indemnity requirements.
  • Patient clinical records (under 18s): until the patient’s 25th birthday (or 26th if the last appointment was at age 17).
  • Foot scanner data on the device: patient profile wiped from the scanner once the report has been saved to the patient’s clinical record.
  • Enquiries that don’t lead to appointments: retained for up to 24 months and then deleted.
  • Financial and tax records: retained for 7 years in line with HMRC requirements.
  • Marketing data: retained while you remain subscribed. Removed promptly when you unsubscribe.
  • Website analytics: retained for up to 26 months (Google Analytics default).
7. How We Protect Your Data

We take appropriate technical and organisational measures to protect your data, including:

 

  • Secure, GDPR-compliant cloud platforms for patient records (Cliniko)
  • Encrypted data transmission for online forms, payments and reports
  • Access controls: only authorised clinical and administrative staff can access patient records, and only on a need-to-know basis
  • Password-protected systems and regular review of staff access
  • Foot scanner operated in offline mode to limit external data transfer
  • Website firewall, daily security scans and regular backups
8. Data Breach Procedures
If a personal data breach occurs and is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office (ICO) without undue delay and where feasible within 72 hours. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
9. Your Rights

Under UK GDPR you have the following rights:

  • Right to be informed: about how your data is being used (which this policy sets out).
  • Right of access: to request a copy of your personal data (a “subject access request”).
  • Right to rectification: to have inaccurate data corrected.
  • Right to erasure (“right to be forgotten”): to have your data deleted in certain circumstances. Please note this right is limited where we are required to retain clinical records for legal or regulatory reasons (see section 6).
  • Right to restrict processing: to limit how we use your data in certain situations.
  • Right to data portability: to receive your data in a portable, structured format.
  • Right to object: to processing of your data, including for direct marketing.
  • Rights related to automated decision-making: we do not use automated decision-making or profiling that would significantly affect you.
 

To exercise any of these rights, please contact us at info@bodyrepair.clinic. We will respond within one month. There is normally no charge, although a reasonable fee may apply if a request is manifestly unfounded, excessive or repetitive.


You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Cookies

Our website uses cookies to help you navigate efficiently, perform certain functions and understand how the site is used. When you first visit, our cookie banner lets you Accept All, Reject All, or Customise your choices by category.

 

  • Necessary cookies always active. They are essential for the website to work and cannot be switched off.
  • Functional cookies support enhanced features and personalisation, such as remembering your preferences.
  • Analytics cookies help us understand how visitors use the site, using anonymised data.
  • Performance cookies help us monitor and improve how the site performs.
  • Marketing cookies are used to make advertising more relevant to you. These are only set if you allow them.
 

Non-essential cookies are only set if you accept them. You can change your choices at any time via the cookie settings on our website. For full details, please see our separate Cookie Policy at bodyrepair.clinic/cookie-policy.

11. Third-Party Links
Our website may contain links to other websites. We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before submitting any personal data.
12. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website with the “last updated” date shown at the top. We encourage you to review this page periodically.

13. Contact Us

If you have any questions about this Privacy Policy, our use of your data, or you wish to exercise your rights, please contact:

 

Body Repair Clinic Ltd

Ground Floor Management Suite

Bellway Industrial Estate

Longbenton, Newcastle Upon Tyne

NE12 9SA