Privacy Notice

SYNERGY BODY & SPINE CLINIC LTD ("we", "us", "our") is committed to protecting and respecting your privacy.

This Privacy Notice explains how we collect, use, store and protect your personal information when you:

• Visit our website;
• Contact us with an enquiry;
• Book an appointment;
• Receive treatment from us;
• Subscribe to our communications; or
• Otherwise interact with our clinic.

Data Controller

SYNERGY BODY & SPINE CLINIC LTD is the data controller responsible for your personal information.

Address: Inside Fitness First, Ulleries Road, Solihull, B92 8DS

Telephone: 0121 517 2199

Email: info@sbs-clinic.com

If you have any questions regarding this Privacy Notice or how your information is handled, please contact us using the details above.

Depending on your relationship with us, we may collect the following information:

Identity and Contact Information

• Name
• Date of birth
• Address
• Telephone number
• Email address
• Emergency contact details

Health and Treatment Information

• Medical history
• Health questionnaires
• Symptoms and diagnoses
• Clinical assessments
• Treatment records
• Progress notes
• Referral information
• Relevant information received from healthcare professionals

This information is classified as special category personal data under UK GDPR.

Appointment Information

• Appointment dates and times
• Attendance records
• Booking history
• Communications relating to appointments

Payment Information

• Payment records
• Transaction history

We do not store your full payment card details.

Website and Technical Information

When you visit our website we may collect:

• IP address
• Device information
• Browser type
• Usage information
• Website activity and analytics data

We will only collect and use personal information that is relevant and necessary for the purpose for which it is collected. We will not ask for, use or share more information than we reasonably need to provide services, manage appointments, meet legal obligations or administer finance-related requests.

We collect information:

• Directly from you when you contact us or complete forms;
• When you book or attend appointments;
• Through communications by telephone, email or website;
• From healthcare professionals who refer you, where appropriate;
• From family members acting on your behalf where authorised;
• Through cookies and website analytics tools.

We use your personal information to:

• Manage enquiries and appointments;
• Provide chiropractic, physiotherapy, spinal decompression and related healthcare services;
• Maintain clinical records;
• Communicate with you regarding treatment;
• Send appointment reminders;
• Process payments;
• Meet legal and regulatory obligations;
• Improve our services and website;
• Defend legal claims;
• Send marketing communications where permitted by law and where you have consented.
• Facilitate and administer applications for finance products used to fund treatment;
• Verify identity and eligibility for finance applications;
• Communicate with finance providers regarding applications and agreements.

Under UK GDPR we must have a lawful basis for processing your personal data.

As a healthcare provider we process health information which is special category personal data.

We process this information under Article 9(2)(h) UK GDPR, which permits processing necessary for the provision of health care and treatment.

We may also process health information where:

• You have provided explicit consent;
• It is necessary to establish, exercise or defend legal claims; or
• Processing is otherwise permitted by law.

Where information connected to your treatment is relevant to a finance application, we will only share what is necessary for that purpose and where we have a lawful basis to do so. Health information will not be shared with a finance provider unless it is necessary, proportionate and permitted under data protection law.

We do not sell personal information to third parties.

Where necessary and lawful, we may share personal information with:

• Healthcare professionals involved in your care, including GPs, consultants, physiotherapists and other treatment providers;
• Practice management and appointment booking system providers;
• Payment service providers;
• IT support, website hosting and cloud service providers;
• Professional advisers including lawyers, accountants, auditors and insurers;
• Regulatory bodies, law enforcement agencies and government authorities where required by law;
• Debt recovery, fraud prevention and legal service providers where necessary to establish, exercise or defend legal claims;
• Finance providers and lenders where you apply for, or request information about, finance options to fund treatment. This may include sharing information necessary to assess eligibility, process your application, manage your finance agreement and comply with legal and regulatory obligations.

Where finance is offered, the lender will act as an independent controller of your personal information and will provide its own privacy notice explaining how your information is collected, used and shared.

All third parties are required to process personal information securely and only for legitimate purposes.

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place as required by UK GDPR.

These safeguards may include:

• UK International Data Transfer Agreements (IDTA);
• UK Addendum to EU Standard Contractual Clauses; or
• Transfers to countries recognised as providing adequate protection.

You may request further information about these safeguards by contacting us.

We retain personal information only for as long as necessary for the purposes for which it was collected and to meet our legal, regulatory and professional obligations.

Retention periods may vary depending on the nature of the information and applicable healthcare record retention requirements.

When information is no longer required, it will be securely deleted or anonymised.

Further details regarding retention periods can be requested from us.

We implement appropriate technical and organisational measures designed to protect personal information from:

• Unauthorised access;
• Loss;
• Disclosure;
• Alteration; and
• Misuse.

These measures include access controls, secure systems, encryption where appropriate and staff confidentiality obligations.

We may send information about clinic services, promotions or updates where:

• You have consented to receive marketing communications; or
• We are otherwise permitted to do so by law.

You can withdraw your consent or unsubscribe at any time by:

• Clicking the unsubscribe link in emails;
• Contacting us by email; or
• Contacting us by telephone.

Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.

Our website may use cookies and similar technologies to:

• Ensure website functionality;
• Improve website performance;
• Analyse visitor behaviour;
• Enhance user experience.

Where required, we will obtain your consent before placing non-essential cookies on your device.

Further information is available in our Cookie Policy.

Under UK GDPR you have the right to:

• Request access to your personal information;
• Request correction of inaccurate information;
• Request erasure of information in certain circumstances;
• Request restriction of processing;
• Object to processing;
• Request transfer of your information to another organisation where applicable;
• Withdraw consent where processing relies on consent;
• Not be subject to solely automated decision-making where applicable.

To exercise any of these rights, please contact us using the details provided in this Privacy Notice.

If you have concerns about how we handle your personal information, we would appreciate the opportunity to address them first.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk

Telephone: 0303 123 1113

We may update this Privacy Notice from time to time to reflect changes in our services, legal requirements or data processing activities.

The latest version will always be available on our website and will show the date of the most recent update.

SYNERGY BODY & SPINE CLINIC LTD

Telephone: 0121 517 2199

Email: info@sbs-clinic.com