We are committed to protecting and preserving the privacy of our visitors when visiting our site or communicating electronically with us.

This policy sets out how we process any personal data we collect from you or that you provide to us through our website. We confirm that we will keep your information secure and that we will comply fully with all applicable UK Data Protection legislation and regulations. Please read the following carefully to understand what happens to personal data that you choose to provide to us, or that we collect from you when you visit this site. By visiting our website you are accepting and consenting to the practices described in this policy.

Types of information we may collect from you
We may collect, store and use the following kinds of personal information about individuals who visit and use our website:

Information you supply to us
You may supply us with information about you by filling in forms on our website. This includes information you provide when you submit a contact/enquiry form. The information you give us may include your name, address, e-mail address and phone number,

Information our website automatically collects about you.
With regard to each of your visits to our website we may automatically collect information including the following:

technical information, including a truncated and anonymised version of your Internet protocol (IP) address, browser type and version, operating system and platform;
information about your visit, including what pages you visit, how long you are on the site, how you got to the site (including date and time); page response times, length of visit, what you click on, documents downloaded and download errors.

Cookies
Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

How we may use the information we collect

We use the information in the following ways:

– To provide you with information and/or services that you request from us;

– To administer our site including troubleshooting and statistical purposes;

– To improve our site to ensure that content is presented in the most effective manner for you and for your computer;

– For security and debugging as part of our efforts to keep our site safe and secure.

– This information is collected anonymously and is not linked to information that identifies you as an individual. We use Google Analytics to track this information. Find out how Google uses your data at https://support.google.com/analytics/answer/6004245.

Disclosure of your information
Any information you provide to us will either be emailed directly to us or may be stored on a secure server. We use a trusted third party hosting provider  to facilitate the running and management of this website.

We do not rent, sell or share personal information about you with other people or non-affiliated companies, any external sources required by your website such as mailing lists from service providers such as mailchimp, sendinblue etc, are subject to your own user agreement per the terms of your account with the provider themselves.

We will use all reasonable efforts to ensure that your personal data is not disclosed to regional/national institutions and authorities, unless required by law or other regulations.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Third party links
Our site may, from time to time, contain links to and from the third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Your rights – access to your personal data
You have the right to ensure that your personal data is being processed lawfully (“Subject Access Right”). Your subject access right can be exercised in accordance with data protection laws and regulations. Any subject access request must be made in writing to us at our email address listed at the bottom of this page. We will provide your personal data to you within the statutory time frames. To enable us to trace any of your personal data that we may be holding, we may need to request further information from you. If you have a complaint about how we have used your information, you have the right to complain to the Information Commissioner’s Office (ICO).

21/05/2026

 

Total Health West Berkshire

PATIENT PRIVACY NOTICE

This Patient Privacy Notice describes how we, Total Health West Berkshire (a trading name of Total Chiropractic Ltd, from now on known as THWB)], collect and use personal data relating to our Patients (i.e. individuals who attend or who have previously attended THWB for health advice and treatment). It also covers our use of personal data relating to Prospective Patients (i.e. individuals who enquire about or express an interest in the services offered by THWB) with whom we may communicate (such as over our website or by email). We also refer in this notice to Patients and Prospective Patients as ‘you’.  

We are required by data protection law to give you the information in this Privacy Notice. It is important that you read the Privacy Notice carefully, together with any other information that we might give you from time to time about how we collect and use your personal data. 

[We also have a Children's Privacy Notice aimed at Patients who are children. Depending on the maturity of the child, the child should read this, or parents (or carers) should talk it through with their child, if appropriate. Please contact us to request this, if needed (see contact details below).] 

This Privacy Notice applies from 13/05/2025 and supersedes any previous versions. We may update this Privacy Notice at any time. 

Who is the controller?

Rosie Piercy is the 'controller' for the purposes of data protection law (also referred to in this notice as 'we' or 'us'). This means that we are responsible for deciding how we hold and use personal data about you. We can be contacted as follows: email: hello@totalhealthwestberks.co.uk. Telephone: 01635 791 301.

 

 

What is personal data? 

Personal data means any information relating to a living individual who can be identified (directly or indirectly), in particular by reference to an identifier (e.g. name, email address, physical features). Personal data can be factual (e.g. contact details or age), an opinion or assessment about an individual, or information that may otherwise impact that individual in a personal or business capacity.

Data protection law provides additional protection for personal data about an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health, sex life or sexual orientation, criminal convictions or offences, biometrics (if used for identification purposes), or genetics. This is referred to as special category data. We refer to personal data that is not special category data as ordinary personal data.

What type of personal data do we hold about you?

We hold personal data about you in order to provide our services, including, for example: name, contact details, [age and date of birth,] your requirements for our services, related biographical and background information relevant to our services, records of the services we have provided, and associated payments.

This includes special category data relevant to our services, including: background medical information and health details from you, information about our assessments and treatments for you, and other information about your health which is collected or recorded by us in providing our services.

If you are a Prospective Patient, we may hold your name and contact details, and other information relating to your enquiry or our communications with you.

If you visit our premises, we may also collect images of you via our CCTV system from our camera that monitors the reception front door.

Why do we hold your personal data and on what legal grounds?

We hold and use your personal data for the purposes of providing our services, responding to your enquiries, and for sending you related communications. 

We also use CCTV outside our premises to assist with the security of our premises.

Both during and following the end of our relationship with you, we may retain your personal data in case it is needed to address enquiries from you, or to address any concerns or legal issues relating to our services or our business. See also below: How long do we keep your personal data?.

Data protection law requires us to have a legal ground for each use of personal data. Most commonly, we rely on the following legal grounds when we process your personal data. 

• Where we need to process your data to perform the contract we have entered into with you for the provision of our services (performance of the contract). This would apply for most of our activities, for example, collecting background information about you (including health details), maintaining records of [our assessments, treatment and services], managing payments from you, and communicating with you in relation to our services.
• Where we need it to comply with a legal obligation (legal obligation). This may include where law enforcement authorities require us to collect, use or share personal data, or where necessary to comply with other law.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (legitimate interest). This may include, for example, using your data to respond to any enquiries, use of our CCTV system, and retaining or using your data to exercise or defend any legal claims, or otherwise to protect our legal rights.
• Where we have obtained your specific consent. [We will seek your consent before using your contact details to send you direct marketing communications (which you have not otherwise specifically requested from us).

We are required to have an additional legal ground in order to use data relating to your health (because it is special category data). As healthcare professionals, the applicable legal ground is that our use of health data is necessary to provide our health care and treatment services. 

 

In exceptional circumstances, we may also use personal data (including special category data) where needed to protect your vital interests or those of another person, to detect or prevent unlawful acts, to establish, exercise or defend legal claims, or where it is in the public interest in the area of public health.   

How do we collect your personal data?  

You provide us with most of the personal data about you that we hold and use. Other personal data about you is generated by us in the course of providing our services, for example records of our assessments and treatments, and information within internal communications or communications with you. 

Some of the personal data about you that we hold and use may come from external sources. For example: if you have had previous treatment, we may, with your consent, request records from your previous healthcare provider and you may provide us with copies of notes and images from other medical appointments you have been to.

 

AI - Assisted Tools and Your Data

 

We may use secure AI-assisted tools to support the drafting and structuring of clinical and administrative documents. These tools are used to improve clarity and efficiency only and do not make clinical decisions or diagnoses. All clinical assessments, conclusions, and recommendations are made and reviewed by appropriately qualified clinicians. Any data processed is handled in accordance with UK GDPR and data protection legislation, and we take appropriate steps to ensure confidentiality and security at all times. 

If you give us someone else’s personal data

Sometimes, you might provide us with another person’s personal data – e.g. details of a family member or next of kin. In such cases, we require you to inform the individual what personal data of theirs you are giving to us. You must also give them our contact details and let them know that they should contact us if they have any queries about how we will use their personal data[, or, if we ask you to do so, you must pass on to them a separate privacy notice in which we explain what we do with their personal data that we receive from you][, although we may also provide them with a specific privacy notice to give them this information].

 

If you are a parent or carer providing information about a child, please also see our Children's Privacy Notice.

Who do we share your personal data with?

We may share relevant personal data with the following parties (and our legal grounds for doing so are described in brackets).

• Legal authorities or regulatory bodies, our legal and professional advisors or auditors, or other parties where we are required by law to do so (for compliance with a legal obligation, or otherwise in our legitimate interests to protect or enforce our rights, or to exercise, establish or defend legal claims).
• Prospective or actual purchasers or our organisation or our business (in the legitimate interests of the purchaser).
• Other parties with your consent (for example if you give your consent to share your records with another healthcare provider).
• Other parties where necessary to protect your rights and interests, or the rights or interests of another individual (in our legitimate interests, or for compliance with a legal obligation).

 

• Our service providers may also handle your data, such as providers of [email, document management and accounting systems or online patient management systems]. They act as processors on our behalf, meaning that we remain primarily responsible for how they use your data in line with the purposes and lawful bases identified in this Privacy Notice.

Consequences of not providing personal data

We only ask you to provide personal data when we have a good reason and there may therefore be consequences if you do not provide particular information to us. 

Some of the personal data you provide to us, for example background information about you, is required in order for us to provide our services effectively and to perform our contract with you. 

If you choose not to provide us with any personal data requested, we will tell you about the particular implications of any such decision at the relevant time.

How long will we keep your personal data?

We will not keep your personal data for longer than we need it for our legitimate purposes.

If you are a Patient, we generally keep records relating to our services to you [and associated assessments and treatment)] of indefinitely but you can ask us to destroy these 8 years from the date of your last visit to us. [(For Patients who are children, we generally keep these records until their 25th birthday, or 26th birthday if the Patient was 17 at the conclusion of treatment.)] 

If you are a Prospective Patient, we generally keep records of our communications with you for a period of 12  months following our last communication with you. Note that you also have the right to withdraw any consent you have given, and to object to use of your data for direct marketing purposes (see ‘Your rights’ below), in which case we may delete your personal data sooner. 

Our retention periods may be changed in appropriate circumstances, for example we may need to retain your details for longer if there is a dispute in relation to our services. You may contact us for additional information about retention periods.

Please note that personal data that is held on IT back-up data sets for disaster recovery purposes may be retained for a different period. This is because it may not be possible to apply retention periods to individual records without erasing the whole back-up data set. [Back-up data sets are generally retained for up to10 years for disaster recovery purposes.]

 

Transferring personal data outside the UK

We do not ordinarily transfer your personal data outside the UK.

 

Your rights   

You have a number of legal rights relating to your personal data, as follows. 

• The right to withdraw any consent you have given in relation to the use of your personal data.

1. The right to make a subject access request. This enables you to receive certain information about how we use your personal data, as well as to receive a copy of it. 

1. The right to request that we correct incomplete or inaccurate personal data that we hold about you. 
2. The right to request that we delete or remove personal data that we hold about you where there is no good reason for us continuing to process it, or where you have withdrawn any consent relating to that processing. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).

1. The right to object to our processing your personal data where: (a) we use it for direct marketing purposes; or (b) where we are relying on our legitimate interest (or those of a third party) as our legal ground. In the case of (b), note that we may continue the processing if we can show a compelling reason to do so. 
2. The right to request that we restrict our processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

1. The right to request that we transfer your personal data to you or to another party, in a structured format. This right applies in respect of data that you have provided where our legal ground for using the data is that it is necessary for the performance of a contract or that you have consented to us using it (this is known as the right to “data portability”).

 

If you would like to exercise any of the above rights, contact Rosie Piercy  - hello@totalhealthwestberks.co.uk . Note that these rights are not absolute and in some circumstances we may be entitled to refuse some or all of your request. 

If you have any questions or concerns about how your personal data is being used by us, you can contact Rosie Piercy  - hello@totalhealthwestberks.co.uk