Privacy Policy
James Edward Osteopathy is committed to protecting the privacy and confidentiality of your personal and health information. This Privacy Policy outlines how we collect, use, store, and share your data, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as well as relevant professional standards for Osteopaths and Massage Therapists in the United Kingdom.
Our Commitment to Your Privacy
- We will only collect data that is relevant and necessary for providing you with safe and effective osteopathic and massage therapy treatments.
- We will always process your data lawfully, fairly, and transparently.
- We will ensure your data is kept secure and confidential.
- We will be transparent about how we use your data and your rights concerning it.
Who We Are
James Edward Osteopathy, The Therapy Loft, Upper floors, 2 Dartmouth Rd, London, SE23 3XU. +44 7462 466739 · info@jeotherapies.com · www.jeotherapies.com
For the purposes of data protection law, James O’Reilly (operating as James Edward Osteopathy) is the Data Controller of the personal data you provide.
What Personal Data Do We Collect?
We collect various types of personal data, which may include:
Personal Identification Information
Name, date of birth, address, telephone number(s), email address, and gender.
Special Category Data (Health Information)
Detailed medical history, lifestyle information, treatment notes (including consultations, examinations, diagnoses, and treatment plans), referral letters, imaging results, and clinical consent records.
Financial Information
Payment details and transaction records for services rendered.
Communication Data
Records of correspondence between you and the clinic (e.g., emails, text messages, phone call notes).
How We Collect Your Data
Directly from you
When you complete new patient forms, during consultations, or through direct communication via phone, email, or WhatsApp.
From third parties
With your explicit consent, this may include referrals from GPs, consultants, or other healthcare providers.
How We Use Your Data (Purposes of Processing)
We rely on specific lawful bases under UK GDPR to process your data:
For direct healthcare and treatment (Article 6(1)(b) & Article 9(2)(h))
To accurately assess your health condition, provide safe osteopathic and massage therapy care, maintain accurate patient records, and communicate with you regarding your treatment plan.
For administrative and business purposes (Article 6(1)(f) & Article 6(1)(b))
To manage your appointments, process payments, maintain accounting records, and comply with professional body requirements.
For future communications (Article 6(1)(a))
If you explicitly opt-in, we may use your contact details to send you occasional clinic updates. You can withdraw this consent at any time.
Sharing Your Data
We will only share your personal information when necessary for your care, required by law, or with your explicit consent. This may include sharing with:
Healthcare professionals
Your GP or specialists, strictly with your explicit consent.
IT and data storage providers
Secure, UK GDPR-compliant third-party services used for electronic record keeping and payment processing.
Professional bodies
The General Osteopathic Council (GOsC), relevant massage therapy associations, or legal authorities, only if there is a strict legal or ethical obligation to do so.
We will never sell your personal data to third parties.
How We Store Your Data
Your data is stored securely. Electronic records are held on password-protected devices and secure, GDPR-compliant cloud systems with regular backups. Any physical paper records are stored in locked filing cabinets within secure premises.
Data Retention
We retain your data for specific periods to comply with legal and professional obligations:
Adult Patient Records
Retained for a minimum of 8 years after your last treatment session.
Children’s Records
Records for patients seen as minors will be retained until their 25th birthday.
Administrative Records
Financial and tax records are typically retained for 6 years. After these periods, your data will be securely and permanently destroyed or anonymised.
Your Rights
Under UK GDPR, you have the right to:
- Be informed about how your data is being used.
- Request access to the personal data we hold about you.
- Request the rectification of inaccurate or incomplete data.
- Request the erasure of your data (subject to legal retention periods for health records).
- Restrict or object to the processing of your data in certain circumstances.
- Request data portability.
How to Make a Complaint
If you have any concerns about how we handle your personal data, please contact us directly so we can resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113 · www.ico.org.uk
Last Updated: August 2026.
