Legal
Privacy Policy
We are committed to protecting your privacy and handling your personal and clinical data with care and transparency.
This notice explains what information we hold about you, why we hold it, who we share it with, how long we keep it, and what rights you have over it. If anything here is unclear, please ask — we would rather explain it than have you wonder.
1. Who we are
MAAR Healthcare Services Ltd, trading as Innate Healthcare, is a chiropractic and physiotherapy clinic at 120 Union Street, Oldham. We are the data controller for the information described in this notice.
Registered name
MAAR Healthcare Services Ltd
Trading as
Innate Healthcare
Registered in
England and Wales
Company number
16899565
Clinic address
120 Union Street, Oldham, OL1 1DU
ICO registration
ZC163763
Contact for data protection
Dr Abdul Rehman, Director · abdul@innatehealthcare.co.uk · 0161 509 7729
We are also bound by the common law duty of confidentiality, which applies to health information separately from data protection law.
2. What information we collect
Information you give us
- Your name, date of birth, address, telephone number and email address
- Your GP's name and practice
- An emergency contact
- Health insurance details, if you are using insurance
- Payment information — handled by our payment providers; we do not store card numbers
- Any access or communication needs you tell us about
- Anything you write in our online booking or contact forms
Clinical information
This is special category data under data protection law, which means it carries extra protection.
- Your medical history, current symptoms and the problem you have come to us with
- Medications you take, and relevant past treatment
- Examination findings, treatment notes and how you progress
- Referral letters and scan or test reports, where these are shared with us
- Information about your work, activity and lifestyle where it is relevant to your care
- Records of consent, including whether a chaperone was offered and what you decided
Information we collect from this website
- Your IP address, browser and device type
- Which pages you visit and how long you spend on them
- How you arrived at our site
- Cookie and similar data — see section 11
Information from other people
- Your GP or another clinician, if they refer you or send us records
- Your insurer, if they authorise your treatment
- Someone acting on your behalf, with your agreement
3. Why we use it, and our legal basis
Data protection law requires us to have a lawful basis for everything we do with your information, and a second basis for health information specifically.
What we do: Provide and manage your care
Our basis: Contract — Art. 6(1)(b)
For health information: Healthcare purposes — Art. 9(2)(h)
What we do: Book appointments and send reminders
Our basis: Contract — Art. 6(1)(b)
For health information: Healthcare purposes — Art. 9(2)(h)
What we do: Keep clinical records
Our basis: Legal obligation and legitimate interests — Art. 6(1)(c), 6(1)(f)
For health information: Healthcare purposes — Art. 9(2)(h)
What we do: Refer you to another clinician
Our basis: Contract — Art. 6(1)(b)
For health information: Healthcare purposes — Art. 9(2)(h)
What we do: Take payment and keep our accounts
Our basis: Contract and legal obligation — Art. 6(1)(b), 6(1)(c)
For health information: Not applicable
What we do: Look into a complaint
Our basis: Legitimate interests — Art. 6(1)(f)
For health information: Legal claims — Art. 9(2)(f)
What we do: Protect a child or an adult at risk
Our basis: Legal obligation, vital interests or public task — Art. 6(1)(c), (d), (e)
For health information: Safeguarding — Art. 9(2)(b), 9(2)(c), and Sch.1 Pt.2 para.18 DPA 2018
What we do: Keep our staff and patients safe
Our basis: Legitimate interests and legal obligation — Art. 6(1)(f), 6(1)(c)
For health information: As applicable
What we do: Send you clinic updates or marketing
Our basis: Consent — Art. 6(1)(a)
For health information: Explicit consent — Art. 9(2)(a)
What we do: Analytics and non-essential cookies
Our basis: Consent — Art. 6(1)(a)
For health information: Not applicable
Where we rely on your consent — for marketing, or for non-essential cookies — you can withdraw it at any time, and withdrawing it is as easy as giving it. That will not affect your care.
4. When we may share without asking you
What you tell us is confidential. There are limited situations where we may need to share information without your consent, in order to protect you or someone else:
- Where there is a risk of serious harm to you or to another person
- Where a child or an adult at risk may be being abused or neglected
- Where we are required to share by law or by a court order
- Where a specific legal reporting duty applies to us
Where this happens we will normally tell you first, unless doing so would put someone at greater risk. We share only what is necessary, and we record what we shared, with whom, and why. Our Safeguarding page explains more.
5. Who we share it with
We do not sell your information, and we do not share it for anyone else's marketing.
Where a company handles information on our behalf, they act only on our instructions and under a written contract requiring them to keep it secure.
Who: Cliniko (Red Guava Pty Ltd)
What they do: Our booking system and clinical records, and the emails that confirm and remind you about appointments
Where: United Kingdom
Who: Microsoft (Microsoft Ireland Operations Ltd)
What they do: Our email, files and internal systems
Where: United Kingdom
Who: Vercel (Vercel Inc.)
What they do: Hosts this website, including the booking and contact forms
Where: United Kingdom
Who: Sanity (Sanity AS)
What they do: Manages the content of this website, and currently keeps a short-term backup copy of contact form messages
Where: European Union
Who: Stape (Stape Europe OÜ)
What they do: Processes our website analytics in a way that removes identifying details before they reach any analytics provider
Where: European Union
Who: Stripe (Stripe Payments UK Ltd and Stripe Payments Europe Ltd)
What they do: Takes payment when you book online
Where: United Kingdom and Ireland
Who: Takepayments Ltd and EVO Payments UK Ltd
What they do: Take payment at the clinic, over the telephone, and by payment link
Where: United Kingdom
Who: Your GP or another clinician treating you
What they do: To coordinate your care — normally with your knowledge and agreement
Where: -
Who: Your health insurer
What they do: To process a claim, where you have asked us to
Where: -
Who: The General Chiropractic Council or Health and Care Professions Council
What they do: Where required by a regulatory investigation
Where: -
Who: Our insurers and legal advisers
What they do: Where a claim is made or expected
Where: -
Who: Local authority, police or NHS services
What they do: Safeguarding — see section 4
Where: -
Who: HMRC and other authorities
What they do: Where the law requires it
Where: -
6. How long we keep it
We follow the NHS Records Management Code of Practice. It does not formally bind a private clinic, but it is the recognised standard and we see no reason to hold your records to a lesser one.
What: Adult clinical records
How long: 8 years
From when: Your last appointment
What: Records of children and young people
How long: Until your 25th birthday, or your 26th if treatment ended when you were 17
From when: Whichever is later
What: Records of patients who have died
How long: 8 years
From when: Date of death
What: Consent forms
How long: Kept with the clinical record
From when: As above
What: Complaint records
How long: 10 years
From when: When the complaint closes
What: Safeguarding records — adults
How long: 10 years
From when: When the matter closes
What: Safeguarding records — children
How long: Until the 25th birthday, or 10 years, whichever is longer
From when: When the matter closes
What: Incident and accident records
How long: 6 years; for children, until the 25th birthday
From when: Date of the incident
What: Financial and accounting records
How long: 6 years
From when: End of the accounting period
What: Enquiries where you do not become a patient
How long: 12 months
From when: Your enquiry
What: Marketing consent
How long: 2 years after you withdraw it
From when: Withdrawal
At the end of these periods, records are securely destroyed.
7. Your rights
You have the right to:
- See the information we hold about you
- Correct anything that is factually wrong
- Have information erased, where there is no legal reason for us to keep it
- Restrict what we do with it
- Receive information you gave us in a portable format
- Object to processing based on our legitimate interests, and to marketing at any time
- Withdraw consent where we rely on it
How to ask
Contact us at reception@innatehealthcare.co.uk, call 0161 509 7729, or write to us at the clinic. You do not need to use any particular form of words.
We will respond within one calendar month. If your request is complex, or if you make several, we may take up to two further months — we will tell you within the first month if that happens. There is normally no charge.
Some things to be aware of
- Erasure is limited for clinical records. We are expected to keep them for the periods in section 6, so we usually cannot delete them on request. We will explain if that applies to you.
- Corrections to clinical opinion. We will correct factual errors. Where you disagree with a clinical judgement, we will record your view alongside ours rather than remove the original.
- We may withhold some information where releasing it would be likely to cause serious harm to your physical or mental health, or where it would identify someone else who has not agreed.
- Records of someone who has died are covered by the Access to Health Records Act 1990 rather than by data protection law, and are available to a personal representative or someone with a claim arising from the death.
8. Automated decisions
We do not make decisions about your care using automated processing or profiling. A person is always involved.
9. How we keep it safe
- Clinical records are held in Cliniko, which holds ISO 27001 certification
- Everyone who uses our systems has their own login — we do not use shared accounts
- Access is limited to people who need it to provide or support your care
- Our team is trained in confidentiality and data protection, and retrained regularly
- We have a procedure for identifying and reporting personal data breaches, including reporting to the Information Commissioner within 72 hours where required
No system is completely secure and no method of sending information over the internet can be guaranteed. If you have a concern about the security of your information, please tell us.
10. Information sent outside the UK
We have chosen our suppliers so that your information stays within the United Kingdom or the European Economic Area wherever possible.
- Your clinical records and bookings are held in the United Kingdom.
- Our email and internal systems store information in the United Kingdom.
- This website runs on servers in the United Kingdom, and our payment providers operate in the United Kingdom and Ireland.
- Our website content system and our analytics infrastructure operate within the European Economic Area, which UK law recognises as providing an equivalent standard of protection.
One of our suppliers, Vercel Inc., is a United States company, although it processes our information on servers in the United Kingdom. Vercel is certified under the UK Extension to the EU–US Data Privacy Framework, which UK law recognises as providing an adequate standard of protection.
Some of our suppliers use their own global infrastructure to deliver their services, and their own agreements govern how they protect your information when they do. You can ask us for details at any time.
11. Cookies and similar technologies
Our website uses cookies and similar technologies that store small amounts of information on your device. Some are necessary for the site to work and for payments to be taken securely. Others, such as analytics, are only used if you agree.
You can change your choices at any time using the Manage Cookies link in the footer. Our Cookie Policy explains in detail what is used and why.
[This section is deliberately short and points to the Cookie Policy, which is being rewritten once the full inventory is confirmed. Do not add detail here that the Cookie Policy will carry — two descriptions that drift apart is the problem we have just fixed with the privacy policies.]
12. Marketing
We will only send you clinic updates or marketing if you have agreed to receive them. You can unsubscribe at any time using the link in any message, or by contacting us.
Withdrawing consent will not affect your care, and it will not stop your appointment reminders — those are part of providing your treatment rather than marketing.
13. If you are unhappy with how we handle your information
Please tell us first — contact us at reception@innatehealthcare.co.uk and we will look into it. You can also raise it under our Complaints policy.
You have the right to complain to the Information Commissioner's Office at any time, whether or not you have raised it with us:
- www.ico.org.uk
- 0303 123 1113
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
14. Changes to this notice
We may update this notice to reflect changes in how we work or in the law. The current version is always on this page, with the date it was last reviewed. Where a change is significant, we will tell you directly if we can.
