Privacy & Security Policy

OsteoAllies Privacy Notice

Last updated: 13 October 2026

Your privacy matters to us

 

At OsteoAllies, we are committed to protecting your privacy and treating your personal and health information with care, respect and confidentiality.

This Privacy Notice explains how we collect, use, store and share your information, the organisations and technologies that help us provide our services, and the rights you have under UK data protection law.

It applies to patients, clients, website visitors and people who contact us, book appointments or use our services.

 

1. Who we are

 

Osteo Allies Limited, also trading as OsteoAllies, provides osteopathy, massage, beauty and other health and wellbeing services, including Bowen therapy, reflexology, life coaching and energy healing.

Our trading names include:

• OA Woodside Clinic
• Woodside Osteopathic Clinic
• OA RJ Clinic
• RJ Osteopathic Clinic
• OsteoAnisha

Osteo Allies Limited is responsible for the personal information it controls and acts as a data controller under applicable UK data protection law.

 

Registered company address

Osteo Allies Limited
4th Floor, Tuition House
27–37 St George’s Road
Wimbledon
London
SW19 4EU

 

ICO registration reference: ZB182007
Data Protection Lead: Reena Joshi
Email: info@osteoallies.co.uk

 

Our clinics work with employed and self-employed practitioners. Where another practitioner or organisation has separate responsibility for processing your information, we will provide relevant information about those arrangements.

 

2. Information we collect

Depending on the services you receive, we may collect:

• Personal details: name, date of birth, address, telephone number, email address and occupation.
• Appointment details: bookings, cancellations, attendance, reminders and appointment history.
• Health information: symptoms, medical history, diagnoses, medication, allergies, injuries, surgery, investigations and other information relevant to your care.
• Clinical information: examination findings, treatment plans, treatment notes, consent discussions, progress and outcomes.
• Wellbeing information: relevant physical, mental and emotional wellbeing information, including pregnancy or childbirth information where applicable.
• Contact details for others: emergency contacts, parents or guardians, GPs and other healthcare professionals.
• Correspondence: enquiries, messages, telephone communications, referrals, reports and complaints.
• Financial information: invoices, payment status and transaction details.
• Communication preferences: including your choices about receiving marketing emails and text messages.
• Digital information: information generated when you use our website, online booking system, clinic app or other digital services, including cookies and technical information where applicable.

We collect information relevant to providing safe, appropriate and effective care and operating our services.

Health information is classified as special category personal data and receives additional protection under UK data protection law.

 

3. How we obtain information

Most information comes directly from you when you:

• contact us or make an enquiry;
• book an appointment;
• complete a health questionnaire;
• attend a consultation or treatment;
• communicate with our reception team or practitioners;
• make a payment;
• use our website or digital services; or
• provide feedback or communication preferences.

Where appropriate and lawful, we may also receive information from GPs, consultants, other healthcare professionals, insurers, parents or guardians, referring practitioners or other people involved in your care.

 

4. Why we use your information

We process personal information to:

• register you as a patient or client;
• arrange, manage and confirm appointments;
• assess your needs and provide care;
• create and maintain clinical records;
• communicate with you about your treatment;
• coordinate appropriate referrals and continuity of care;
• process payments and maintain financial records;
• respond to enquiries, requests and complaints;
• meet safeguarding, professional and legal obligations;
• maintain and improve the safety and administration of our services;
• protect our information systems and prevent misuse;
• operate our website and digital services; and
• send marketing communications where permitted by law.

We do not sell patient information.

 

5. Our lawful bases for processing information

We process personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The lawful basis depends on why we are using the information.

 

Purpose	Lawful basis that may apply
Booking and providing agreed services	Performance of a contract or steps taken before entering a contract
Maintaining records required by law	Legal obligation
Clinic administration, security and responding to enquiries	Legitimate interests
Optional marketing where consent is required	Consent
Protecting someone’s life in an emergency	Vital interests
Establishing, exercising or defending legal claims	Legitimate interests or another applicable lawful basis

Where we rely on legitimate interests, these include operating an effective and secure clinic, managing enquiries, maintaining appropriate business records and protecting our services and patients. We consider your rights and interests before relying on this basis.

 

Special category health information

Health information requires an additional condition under Article 9 of the UK GDPR.

For relevant healthcare services, this may include Article 9(2)(h), where processing is necessary for the provision or management of health or social care and the applicable professional confidentiality requirements are satisfied.

For other services or processing activities, another appropriate Article 9 condition may be required, including explicit consent where applicable.

We determine and document the relevant lawful basis and additional condition for the activities concerned.

Consent to clinical treatment is separate from consent used as a lawful basis under data protection law.

 

6. Information needed to provide your care

We need certain personal details, relevant health information and appropriate clinical records to provide safe services.

If essential information is not provided, we may be unable to assess or treat you safely or provide a particular service.

You are not required to provide information that is not relevant to your care, and you do not need to agree to marketing in order to receive treatment.

Your practitioner can explain why particular information is needed.

 

7. Consent to examination and treatment

Your practitioner will explain the proposed examination or treatment and provide an opportunity for you to ask questions.

You may decline or withdraw consent to examination or treatment at any time.

Your practitioner will document relevant discussions and decisions within your clinical record.

Signing a new patient questionnaire does not constitute blanket consent to all future examinations or treatments.

 

8. Sharing information and confidentiality

We only share information where appropriate and lawful.

Depending on the circumstances, information may be shared with:

• practitioners involved in your care;
• authorised reception or administrative personnel;
• GPs, consultants and other healthcare professionals;
• hospitals and emergency services;
• safeguarding authorities where appropriate;
• insurers and professional advisers;
• regulators and legal authorities where necessary;
• service providers processing information on our behalf; or
• other people or organisations where you have authorised disclosure or another lawful reason applies.

 

We aim to share only information necessary for the relevant purpose.

Reception and administrative personnel are not routinely provided access to detailed clinical treatment notes.

Practitioners are expected to respect patient confidentiality and access or use information only where appropriate for their professional duties.

Where a referral or transfer of care involves another practitioner, relevant information may be shared in accordance with applicable confidentiality, professional and data protection requirements.

We will not ordinarily disclose confidential information to a spouse, family member or other person merely because they request it.

There are limited circumstances where information may be disclosed without consent, including legal obligations, safeguarding concerns or situations involving serious risk of harm.

 

9. Children and young people

We provide care to children and young people.

We may collect information about a parent, guardian or person with parental responsibility to support appropriate care, consent and safeguarding arrangements.

The child’s or young person’s capacity, understanding and confidentiality rights will be considered in accordance with applicable law and professional standards.

We take particular care to protect children’s personal and health information.

 

10. Organisations and technology providers

We use external organisations to help deliver and administer our services.

Where these organisations process personal information on our behalf, we require appropriate confidentiality, security and data protection arrangements.

 

Cliniko — clinical records and practice management

We use Cliniko to manage patient records, appointments, clinical notes and other information associated with providing care and administering our clinics.

Access is managed through user accounts and permissions.

 

Balance VA — CX Assist Ltd

We engage Balance VA (trading as CX Assist Ltd) to provide certain administrative services on our behalf, including answering telephone calls and assisting with appointment bookings.

Authorised members of their team may access personal information necessary to manage enquiries and appointments.

They are required to handle personal information securely, confidentially and in accordance with applicable data protection law and their contractual obligations to Osteo Allies Limited.

 

CliniQApps — AI reception and patient communications

We use CliniQApps, provided by Exiron (AUST) Pty Ltd, for AI-assisted reception, patient communications, appointment administration and certain automation functions.

Depending on the communication channel and service used, CliniQApps may process names, contact details, appointment information, telephone conversations and messages.

Its AI receptionist can assist with enquiries, bookings, cancellations and rescheduling. It does not access clinical treatment notes for reception purposes or provide clinical advice. Clinical enquiries are referred to an appropriate member of the team.

CliniQApps may also assist with SMS, email and other supported communication channels.

 

Payment processing

We use Stripe and SumUp to support secure payment processing.

These providers may process payment and transaction information, including information necessary for fraud prevention and compliance with financial regulations.

 

Accounting

We use Xero for accounting, invoicing and financial administration.

 

Microsoft 365 and SharePoint

We use Microsoft business services, including SharePoint, for business administration and secure document management.

This may include relevant clinical correspondence, referral letters or reports where appropriate.

 

Other service providers

We may also use providers supporting website hosting, online forms, communications, IT security, analytics and professional administration.

 

11. AI-assisted clinical documentation

Some OsteoAllies practitioners use CliniQApps AI Clinical Notes to assist with preparing clinical records.

 

How it works

Where this service is used:

1. Your practitioner explains the use of the AI scribe and seeks your agreement before proceeding.
2. Consultation audio is captured and transcribed using speech-recognition technology.
3. AI technology uses the transcript and, where relevant, existing clinical notes to prepare a draft.
4. Your practitioner reviews, corrects and approves the draft.
5. The approved clinical note is saved in our clinical-record system.

The AI-generated draft does not become an approved clinical note until the practitioner has reviewed and approved it.

Your practitioner remains professionally responsible for the accuracy and appropriateness of the clinical record.

 

Your choice

You may decline the use of the AI clinical scribe.

If you decline, your practitioner can document your consultation without using the AI scribe.

Declining the AI scribe will not prevent you from receiving appropriate care.

 

How recordings and transcripts are handled

CliniQApps processes consultation audio and transcripts to prepare draft clinical notes.

CliniQApps stores this information within its secure infrastructure in Sydney, Australia, and uses specialist transcription technology.

OsteoAllies’ selected retention period for consultation audio is 30 days. Once this setting has been implemented, consultation audio will be deleted from CliniQApps’ active storage within that period, subject to the provider’s documented backup deletion arrangements.

Transcripts and draft notes are managed under separately defined retention arrangements. Approved clinical notes remain in Cliniko in accordance with our clinical-record retention policy.

CliniQApps states that patient information, recordings and transcripts are not used to train AI models.

 

12. International processing and data transfers

Some of our service providers process personal information outside the United Kingdom.

CliniQApps stores its information in Amazon Web Services infrastructure in Sydney, Australia.

Its AI functionality uses Amazon Bedrock to run Claude within its Australian infrastructure.

Some information is processed by specialist providers, including:

 

• Deepgram (United States): speech-to-text transcription of calls and consultations.
• ElevenLabs (United States): converting AI receptionist responses into speech.
• Twilio: telephone and SMS communications.
• Meta: supported messaging channels, where used.
• Mailgun: delivery of automated emails.

 

CliniQApps states that it does not use patient information to train AI models and that its providers are subject to relevant contractual restrictions.

CliniQApps has described encryption safeguards and international data transfer arrangements, including a UK International Data Transfer Addendum for UK clinics.

Where personal information is transferred outside the UK, we take steps to ensure an appropriate transfer mechanism and safeguards are in place.

You may contact us to request further information about relevant international transfer safeguards.

 

13. Protecting your information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These include, where appropriate:

• individual user accounts and access controls;
• authentication and password security;
• secure clinical-record systems;
• controlled access to confidential documents;
• encrypted communications and storage where supported;
• confidentiality obligations for practitioners and staff;
• appropriate agreements with service providers; and
• procedures for handling information-security incidents.

No system can guarantee absolute security, but we take reasonable and proportionate measures to protect the information entrusted to us.

 

14. How long we retain information

We retain information for as long as necessary for the relevant purpose and to meet professional, legal, regulatory and insurance obligations.

 

Clinical records

Osteopathic clinical records are normally retained for at least eight years after the last consultation.

For children, osteopathic records are normally retained until at least their 25th birthday.

Longer retention may be necessary in particular circumstances.

Other services and types of clinical records are retained in accordance with their applicable requirements and our retention policy.

 

AI clinical documentation

Our selected retention period for CliniQApps consultation audio is 30 days, subject to confirmation of implementation.

Approved clinical notes are retained within Cliniko under our clinical-record retention policy.

CliniQApps maintains a rolling backup period of up to 35 days for its stored information.

 

Other information

Financial records, correspondence, complaints, enquiries and administrative information are retained according to applicable legal requirements and our documented retention schedules.

Marketing information is retained only while there is a valid reason to use it, subject to appropriate suppression records and legal obligations.

When information is no longer required, we arrange for it to be securely deleted, destroyed or anonymised as appropriate.

 

15. Marketing and communication preferences

We may offer you the opportunity to receive health and wellbeing information, clinic news, events, service updates and occasional promotional offers.

Marketing is optional and does not affect your care.

We distinguish between:

 

• Care and administrative communications, such as appointment confirmations, reminders and necessary treatment-related messages.
• Marketing communications, such as newsletters, promotions and offers.

 

We send electronic marketing only where permitted under applicable UK data protection law and the Privacy and Electronic Communications Regulations.

Where consent is required, we ask for it separately.

You can withdraw marketing consent or opt out at any time using the unsubscribe facility where provided or by contacting info@osteoallies.co.uk.

We do not use confidential clinical information to target individuals with condition-specific marketing unless an appropriate legal basis and any necessary explicit consent are in place.

 

16. Cookies and website information

Our website may use cookies and similar technologies for essential functionality, preferences, analytics and, where applicable, marketing purposes.

Where consent is required for non-essential cookies, we will request it through our website’s cookie controls.

You can manage your cookie choices using the controls available on our website.

Further information about cookies and similar technologies is available through our website’s cookie settings or Cookie Notice.

 

17. Your data protection rights

Under UK data protection law, you may have rights to:

• be informed about how your information is used;
• access personal information we hold about you;
• have inaccurate information corrected;
• request deletion in certain circumstances;
• request restriction of processing;
• object to certain processing;
• request data portability where applicable; and
• withdraw consent where processing relies on consent.

 

You have the right to object to processing based on legitimate interests in applicable circumstances. You also have the right to object to processing for direct marketing at any time.

These rights are subject to applicable legal conditions and exceptions.

For example, we may need to retain clinical records despite a deletion request where professional or legal obligations require retention.

To exercise your rights, contact:

info@osteoallies.co.uk

We may need to verify your identity before responding to certain requests.

We will respond within the applicable statutory time limits, normally within one month for a data subject access request.

 

18. Complaints and concerns

If you are concerned about how we have handled your information, please contact us.

Data Protection Lead: Reena Joshi
Email: info@osteoallies.co.uk

We will investigate your concern and respond in accordance with our legal obligations.

You also have the right to complain to the Information Commissioner’s Office (ICO).

 

Information Commissioner’s Office
Website: https://ico.org.uk
Telephone: 0303 123 1113

 

Osteo Allies Limited ICO Registration Reference: ZB182007

 

19. Automated decision-making

Our AI reception and clinical documentation tools support administrative and clinical documentation activities.

Clinical assessment, treatment decisions and approval of clinical notes remain the responsibility of the relevant practitioner.

We do not use these tools to make solely automated decisions about your clinical care that have legal or similarly significant effects on you.

 

20. Changes to this Privacy Notice

We may update this Privacy Notice to reflect changes in our services, technology, legal requirements or data protection practices.

The latest version will be published on our website, with the date of the most recent update shown at the beginning.

Where changes materially affect how your information is used, we will take appropriate steps to inform you.