The Hartland Podiatry Clinic Ltd
Customer Privacy Notice
1 General Information
This privacy notice outlines how we collect, use, and protect your personal information when you contact us or access our services.
As part of delivering our services, we are required to process personal data relating to our patients and, where applicable, their relatives or representatives. “Processing” refers to activities such as collecting, recording, organising, storing, sharing, or securely disposing of data.
We are committed to transparency regarding why your personal data is required and how it is handled. This notice also explains your data protection rights.
The Hartland Podiatry Clinic Limited may update this Privacy Policy periodically. The most current version will always be available on our website at https://thehartlandclinic.co.uk
1.1 Contact Details
The Hartland Podiatry Clinic Limited is the data controller responsible for the personal information we process, unless specified otherwise.
You can contact us through many different channels including but not limited to post, telephone and email.
Post: The Hartland Podiatry Clinic Ltd, 10 Barnards Way, Charlton, Wantage, Oxfordshire, OX12 7EA, GB
1.2 How do we get information
The majority of personal information we process is provided directly by you in the following situations:
- You are a private patient who has self-referred for podiatry.
- Family members or carers
- Other health and care providers
- Schools, college, universities or other education organisations
- Insurance Companies
We may also monitor and record communications, such as telephone calls and emails, for quality assurance, training, and compliance purposes.
In some cases, we receive personal information indirectly, for example:
- You are an NHS patient referred to our services by your GP, another healthcare provider or insurance provider.
We only use your personal information for the purposes for which it was collected. However, in certain circumstances, we may process your data without your knowledge or consent where required or permitted by law.
1.3 Sharing your information
We do not share your personal data with third parties for the purposes of direct marketing.
Your information will not be transferred outside of the European Union unless adequate safeguards are in place and it is compliant with applicable data protection laws.
In certain circumstances, we may be legally required to disclose personal information—for example, in response to a court order or legal obligation.
We work with trusted third-party service providers, such as orthotic laboratories, to support the delivery of our services. These providers operate under formal agreements which ensure they may only process your personal information under our instruction, are prohibited from sharing it with any other parties, and are required to handle it securely and retain it only for the period specified by us.
1.4 Your information protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR.
Which lawful basis we rely on may affect your data protection rights which are in brief set out below.
Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with.
Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure – You have the right to ask us to delete your personal information.
Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
Your right to object to processing – You have the right to object to the processing of your personal data.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
1.5 Complaints
We are committed to upholding the highest standards in the collection, use, and protection of personal information. If you have any concerns or complaints regarding this privacy notice or how we handle your personal data—including its collection, storage, management, or disposal—please contact us at info@thehartlandclinic.co.uk
If you believe that your data has been handled in a manner that is unfair, inappropriate, or in breach of data protection legislation, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). For more information, or to make a complaint, please visit the ICO website: https://ico.org.uk/global/contact-us/.
1.6 Security
We place the highest priority on the protection of privacy and confidentiality, ensuring that all personal data is collected, stored, and used in full compliance with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR) 2018.
Personal information is securely maintained in both electronic and paper formats, with access strictly limited to authorized personnel who need it to perform their duties. Protecting your information is of utmost importance to us, and we employ various measures to safeguard your privacy, including:
- Anonymizing personal information where possible.
- Implementing an independent review process for data handling practices.
- Adhering to stringent contractual obligations with third parties.
- Establishing clear agreements regarding data sharing and processing.
- Enforcing strict user access controls to limit access to sensitive data.
Additionally, all staff are bound by a legal and contractual duty of confidentiality to ensure the ongoing protection of your information.
2 What information do we hold?
2.1 You as a patient
As a provider of healthcare services, we have a legal obligation to collect and process personal information necessary for the creation and maintenance of medical records.
We only retain information that is directly relevant to your care and treatment. This may include:
- Basic personal details such as your name, address, contact information, gender, pronoun preferences, date of birth, NHS/ HSC/ CHI number, next of kin details including any support networks, emergency contact details.
- Information about care needs (including disabilities, home conditions, medication, dietary requirements, allergies and general care provisions)
- Records of interactions and communications with you during the course of your treatment.
- Financial information, including payment methods and funding arrangements.
- Professional information, such as your occupation, where it is relevant to your care.
- Details of services you have accessed through us.
- Clinical notes and reports relating to your health and the treatment you have received.
- Feedback you have provided and outcomes related to your treatment.
- Information related to any complaints or incidents involving your care.
- Recordings of both inbound and outbound telephone calls.
- Photographs where needed to show the before and after of your treatment
- Any other personal data collected in the course of delivering healthcare services or operating our business.
2.2 What do we do with your information?
We collect personal information to support the delivery of safe, effective, and high-quality care, as well as to enable accurate medical diagnosis and treatment planning.
Generally, your information is used to:
- Inform clinical decisions regarding your care.
- Ensure the treatment you receive is safe, appropriate, and effective.
- Maintain accurate records for administrative and clinical purposes.
- Fulfil our duty to safeguard children and vulnerable adults.
- Plan and develop our services to meet future healthcare needs.
- Monitor and review the quality of care provided to ensure continuous improvement.
- Support the education and training of healthcare professionals.
- Conduct research and statistical analysis (where appropriate and in accordance with legal requirements).
- Invite you to complete satisfaction surveys to improve our services.
- Investigate and respond to complaints, concerns, or incidents.
- Comply with legal, professional, and regulatory obligations.
- Carry out audits to assess and enhance the quality of our services.
In some cases, we may use trusted third-party providers to support your care and treatment.
2.3 Lawful basis for processing
While we will always obtain your consent for medical treatment, our responsibilities under data protection laws are distinct and governed by specific legal bases. We process your personal information under the following lawful grounds:
- Consent: Where appropriate, we will explain how your information will be used and seek your freely given, informed consent.
- Contractual Necessity: We may process your information where it is necessary to produce a contract, such as when providing services funded by the NHS.
- Legal Obligation: Your information may be processed where necessary to comply with legal or regulatory requirements.
- Legitimate Interests: In some instances, we or a third party may process your data on the basis of legitimate interests, provided these do not override your fundamental rights or freedoms.
Information relating to your health is categorised as special category data under data protection legislation. We process this information on the grounds that it is necessary for medical diagnosis, the provision of health or social care, or for research and statistical purposes, as outlined in the Health and Social Care Act 2012.
Common Law Duty of Confidentiality
We also adhere to the common law duty of confidentiality when handling your health and care information. We meet this duty in the following ways:
- You have given us your consent—either implicitly (to receive care) or explicitly (for other purposes).
- We have a legal obligation to collect, use, and share the data.
- The public interest in using the data (e.g. sharing with law enforcement to prevent or detect serious crime) outweighs the public interest in maintaining confidentiality.
2.4 Sharing your health record
We are committed to maintaining the confidentiality of your health information and will not disclose it to third parties unless specific circumstances apply, as outlined below:
- With Your Consent for Direct Care: To ensure you receive the highest standard of care, it may be necessary to share relevant health information with professionals involved in your treatment, such as your GP, consultants, hospital providers, insurance companies, care providers or emergency services. We will discuss this with you in advance and seek your consent before any information is shared.
- Contractual Arrangements: In some cases, we may need to share limited, non-sensitive information with funding organisations such as the NHS or your employer (if they are funding your treatment), in accordance with contractual requirements.
- Exceptional Circumstances: In rare situations, we may be required to share your information without your consent, including:
- When it is necessary in the public interest—for example, to prevent serious harm or risk to life.
- To comply with legal obligations—for example, safeguarding a child under the Children Act 1989.
- When ordered to do so by a court of law.
- In response to a legitimate request from law enforcement authorities relating to a serious criminal investigation.
- Business Transfers: In the event of a business sale, merger, or acquisition, your information may be disclosed to third parties involved in the transaction. This will only occur to the extent permitted by law and with appropriate safeguards in place. You will be notified if your data is affected.
- Legal Compliance: We may also process and share your information where required to comply with applicable laws, regulations, or legal processes.
The Hartland Podiatry Clinic Limited will always make every reasonable effort to inform you when your data is being shared, unless we are prevented from doing so by law.
2.5 Data Retention
As a healthcare organisation, we are legally and ethically required to retain medical records for a specified period in accordance with the General Data Protection Regulation (GDPR) 2018. Typically, we retain records for eight years following the conclusion of a patient’s care.
In line with NHS guidelines, adult medical records are securely stored and disposed of eight years after treatment ends or upon the patient’s death. For patients under 18, records are retained until their 25th birthday—or 26th birthday if treatment ended when they were under 17.
All records are stored securely and disposed of using approved methods, such as shredding paper documents or permanently erasing digital files, to ensure compliance with legal data destruction standards.
3 National Data Opt-Out
The National Data Opt-Out allows individuals to choose whether their confidential patient information can be used for purposes beyond their individual care and treatment—such as for research or healthcare planning—by health and adult social care organisations that are registered with the Care Quality Commission (CQC).
Currently, we do not share any patient data for planning or research purposes to which the National Data Opt-Out would apply. However, this position is reviewed annually. Should our data usage change in the future, patients will have the right to opt out of such data sharing.
4 Friends/ Relatives
4.1 What data do we have?
In the course of delivering high-quality care and support, it may be necessary for us to retain limited personal information about the friends or relatives of our patients.
This may include basic details such as your name, address, and contact information, including telephone number and email address.
4.2 Why do we have this information?
We are legally required to have a valid lawful basis for processing personal data.
We process this information on the grounds of legitimate business interest, specifically to hold details of next of kin and individuals with lasting power of attorney for those accessing our services.
Where required, we will seek and rely on your explicit consent to process your personal data.
5 Access to Health Records
Each time you attend an appointment with one of our clinicians, a detailed record is made of the information you provide and the discussions that take place. This ensures our healthcare professionals have the necessary information to plan and deliver your ongoing care effectively.
Your health record includes documentation of clinic visits, procedures, tests, investigations, and copies of all relevant correspondence relating to your treatment. We also maintain essential personal details such as your name, address, gender, next of kin, and ethnic background.
5.1 Confidentiality
Your health record is treated with the utmost confidentiality and is only accessed by staff members when necessary to perform their professional duties. All staff are bound by strict professional, legal, and contractual obligations to uphold confidentiality.
Wherever possible, we anonymise information to prevent individual identification. Information will only be shared with external organisations if they are directly involved in your care—such as your GP, social worker, community nursing team, or hospital—ensuring that your care remains coordinated and safe.
5.1 Access to your health records
Should you wish to access your medical records held by The Hartland Podiatry Clinic Ltd please contact us at:
The Hartland Podiatry Clinic, 10 Barnards Way, Wantage, Oxfordshire, OX12 7EA
5.2 When will the information be released?
The organisation will process your request promptly. In all cases, your records will be provided within 30 days of receiving your accurately completed request. If we experience any difficulties in locating your data, we will keep you updated on the progress.
5.3 Amending information with your record
Individuals do not have the right to have professional opinions or judgments removed from their records, unless the entry is factually incorrect (e.g., if the notes pertain to a different patient). However, if you disagree with any content in your record, you may request that a statement be added to reflect your views. You are entitled to a copy of any statement added to your record.
6 Our website
Our website uses cookies—small text files stored on your device—to enhance user experience, monitor website performance, and support ongoing improvements to our services and site functionality.
We also utilise analytics tools to gather standard internet log data and information on visitor behaviour patterns. This helps us better understand how our website is used and informs future development.
Lawful Basis for Processing
We process personal information collected via cookies under the following lawful bases:
- Consent: We obtain your consent for the use of non-essential (optional) cookies.
- Legitimate Interests: We may process your information where it is necessary for our legitimate business interests, such as ensuring the security and functionality of our IT systems and maintaining service continuity.
Version: 2 Updated 30/04/2025