Privacy Policy

1. About This Document

This notice explains how Joshua David Toon, trading as Toon Osteopathy, uses personal information belonging to patients, prospective patients and website visitors. It is written to meet the transparency requirements of the UK GDPR and the Data Protection Act 2018, and to reflect the professional obligations set out by the General Osteopathic Council (GOsC).

 

As a sole trader, I run this clinic personally, so wherever this document refers to “I” or “me”, this means Joshua David Toon directly. There is no separate company or board involved.

2. Who I Am and How to Reach Me

  • Trading name: Toon Osteopathy
  • Registered with: General Osteopathic Council, registration number 10889
  • Address: The Health Hub, All Saints Resort, Fornham St.Genevieve, Bury St.Edmunds. IP28 6JQ
  • Email: info@toon-osteopathy.co.uk
  • Website: toon-osteopathy.co.uk
  • Phone: +44 7572 791701
  • ICO registration reference: ZC203281

I am the Data Controller for the personal information described in this notice, meaning I decide how and why it is used. As a sole practitioner, I do not employ a formal Data Protection Officer, but I am personally responsible for data protection compliance and am happy to answer any questions directly.

3. The Information I Hold About You

Identity and contact information

  • Full name, date of birth, address, phone number, email
  • Emergency contact / next of kin

 

Clinical information (special category data)

  • Case history, symptoms and medical background you share with me
  • Examination and treatment notes
  • Correspondence from GPs, consultants or other practitioners involved in your care
  • Imaging or diagnostic reports where relevant
  • Exercise programmes and rehabilitation plans prescribed for you

 

Financial information

  • Payment records
  • Insurance details where a provider such as Bupa is funding your treatment (card numbers are never stored)

 

Website and communication data

  • Enquiry form submissions
  • Email and message correspondence
  • Appointment reminders and related booking messages
  • Website analytics data, where you have accepted analytics cookies (see Section 12)

4. Where This Information Comes From

  • Directly from you: forms, conversations, phone calls and email
  • From a parent or guardian, if you are under 18
  • From other healthcare professionals treating or referring you
  • From an insurer or employer funding your treatment
  • From diagnostic or imaging providers

5. Why I Use Your Information and My Legal Basis for Doing So

Under UK GDPR, every use of personal data needs a lawful basis. Because clinical information is “special category data”, health information also needs a second condition under Article 9. Here is how that applies in this practice:

 

Assessing and treating you

Legal basis: legitimate interests (Art. 6(1)(f)) and provision of healthcare (Art. 9(2)(h)). Covers: health and clinical data.

 

Booking, admin and record keeping

Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). Covers: contact and appointment details.

 

Processing payments and insurance claims

Legal basis: contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)). Covers: payment records, insurance and funder details.

 

Meeting GOsC professional obligations

Legal basis: legal obligation (Art. 6(1)(c)) and Art. 9(2)(h). Covers: clinical records and their retention.

 

Urgent situations affecting your safety or someone else’s

Legal basis: vital interests (Art. 6(1)(d)) and Art. 9(2)(c). Covers: safeguarding and medical emergencies.

 

Your clinical information is only ever processed where it is necessary for your healthcare, or where you have given explicit consent. It is never used for marketing, and I do not send marketing emails or newsletters.

6. Automated Decision Making

I do not use automated decision making or profiling of any kind. Every clinical judgement about your care is made by me, personally.

7. Who I Share Information With

  • Other healthcare professionals, if I need to refer you or coordinate your care
  • Insurers or funders, such as Bupa, strictly for claims relating to your treatment
  • Jane App, my practice management software provider, which stores records on my behalf
  • Regulatory or legal bodies, including the GOsC, where I am required to disclose information
  • A parent or guardian, where you are a minor

 

Where information is shared with another healthcare professional for your ongoing care, I will normally discuss this with you first unless there is an urgent clinical or safeguarding reason not to.

 

I do not sell personal data and I do not share it for anyone else’s marketing purposes.

8. Where Your Information Is Stored

Patient records are held within Jane App, which acts as my data processor under a written data processing agreement. For UK clinics, Jane stores records on servers based in the United Kingdom, and your information is encrypted both while it travels between my device and Jane, and while it sits on their servers.

 

Your information is not routinely transferred outside the UK. A small number of Jane’s messaging features, such as text message appointment reminders, involve providers based outside the UK, and appropriate safeguards are in place where that applies. Clinical notes themselves are never sent this way. If the wider position ever changes, I will update this notice.

9. How Long I Keep Your Records

Retention periods follow professional indemnity and GOsC aligned guidance for osteopathic practice:

  • Adult patients: normally 8 years from the date of your last appointment
  • Patients treated as minors: until their 25th birthday, or their 26th birthday if they were 17 at their final appointment

 

Once the retention period has passed, records are securely deleted or destroyed.

 

If I stop practising

If I retire, cease practice, or become unable to practise, arrangements are in place for your records to be transferred to another registered practitioner or securely stored for the remainder of the retention period, in line with GOsC requirements. You would be informed of any transfer.

10. Keeping Your Information Secure

I am the only person who has access to your records, and I keep that access tightly controlled.

  • Your records are held in Jane App, a dedicated clinical system, rather than in general purpose file storage, email folders or spreadsheets
  • Access to Jane is protected by a strong, unique password and two step verification, so a password on its own is not enough to open your notes
  • I hold the only login for the practice and I do not share my account with anyone
  • Every laptop, tablet or phone I use for clinical work is password protected, encrypted, and set to lock itself when not in use
  • Jane keeps an activity log, so any access to your record is recorded and can be reviewed
  • I do not use consumer email or messaging apps to send clinical information
  • Paper notes, where used, are stored securely and transferred into the clinical record
  • I stay current with GOsC and data protection training relevant to confidentiality

 

In the unlikely event of a data breach that risks your rights or freedoms, I will notify the ICO within the required 72 hour window and inform you directly if there is a high risk to you personally.

11. Your Rights Under UK GDPR

  • Access: request a copy of what I hold about you
  • Rectification: ask me to correct inaccurate information
  • Erasure: ask me to delete your information, where no legal or professional obligation requires me to keep it
  • Restriction: ask me to limit how your data is used
  • Objection: object to processing based on legitimate interests
  • Withdrawal of consent: withdraw consent at any point, where consent is the basis I am relying on
  • Portability: request your data in a portable format, where technically feasible

 

Clinical records held under a legal or professional retention obligation cannot be erased early, even if requested, until that period has passed.

 

Requesting your records

Email info@toon-osteopathy.co.uk to request a copy of your information. I will confirm your identity first. There is no charge, and you will receive it within one calendar month, usually by secure electronic copy.

12. Cookies and Website Use

My website uses cookies and similar technologies. A cookie is a small file placed on your device that either helps the site work properly or tells me how the site is being used.

 

When you first visit, a banner asks how you would like these handled. Nothing beyond the essentials is set on your device until you have made that choice.

 

Essential cookies

These keep the website working: loading pages correctly, keeping the site secure, and remembering the cookie preference you selected. They cannot be switched off, and no consent is required for them.

 

Analytics cookies

These tell me how many people visit, which pages they read, and how they found the site. It helps me understand what people are actually looking for so I can write more useful information. This data is aggregated and I do not use it to identify you personally.

 

Advertising and tracking cookies

I do not use advertising, retargeting or cross site tracking cookies of any kind.

 

Changing your mind

You can change or withdraw your cookie preferences at any time using the cookie settings link on the website. You can also block or delete cookies through your browser settings, although some parts of the site may not work as well if you do.

 

What cookies never do here

No clinical information, appointment details or enquiry form content is collected through website cookies. Website cookies are handled entirely separately from your patient record, which sits in Jane App.

 

Essential cookies are used under the strictly necessary exemption in the Privacy and Electronic Communications Regulations. Any non-essential cookies are set only on the basis of your consent, which you are free to withdraw at any point.

13. Children’s Information

Where a patient is under 18, I collect information with the involvement and consent of a parent or guardian, who may also exercise data protection rights on the child’s behalf. Older children who are able to understand their own care may exercise these rights themselves.

14. If You Have a Concern

If you are unhappy with how your information has been handled, please contact me directly first. I will always try to resolve it. I will acknowledge your complaint promptly and respond within 30 days.

 

You also have the right to complain to the Information Commissioner’s Office at any time:

  • Website:ico.org.uk/concerns
  • Phone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to This Notice

I review this notice periodically and will update the date at the top whenever changes are made. Please check back occasionally, especially if your treatment with me is ongoing.