Patient Data & Privacy Notice

WHAT PERSONAL DATA WE COLLECT

​

As your foot health practitioner, we collect and hold the following types of information about you:

 

Standard Personal Data

• Full name, date of birth, and home address

• Telephone number and email address

• Emergency contact name and telephone number

• GP name, practice address, and contact details

• Appointment history and correspondence with you

• Payment records

 

Special Category (Health) Data

We also collect health information, which is classified as 'special category data' under UK GDPR and is given the highest level of legal protection. This includes:

 

• Medical history, diagnoses, and ongoing conditions

• Current medications and known allergies

• Vascular and neurological assessment findings

• Wound care and infection records

• Mobility and disability information

• Clinical photographs of feet or nails (with your consent)

• Any other health information relevant to your foot care

 

Your information is stored securely on an encrypted, password-protected electronic system.

 

USE OF AI TECHNOLOGY FOR CONSULTATION NOTES

 

To support accurate record-keeping, we may use a secure, GDPR-compliant AI transcription tool during clinical appointments.

- Audio is used only to create accurate consultation notes

- Transcriptions are anonymised and checked before being added to your clinical record

- All audio and draft transcripts are permanently deleted after processing

- No patient-identifiable data is retained by the AI provider

 

This process helps maintain accurate, timely records while fully protecting your confidentiality.

​

WHY WE COLLECT YOUR DATA (LAWFUL BASIS)

We process your personal data under the following lawful bases:

• Legitimate interests (Article 6(1)(f) UK GDPR): We process your data to provide foot health care services and run our practice.

• Contractual necessity (Article 6(1)(b) UK GDPR): Processing is necessary to deliver the care you have engaged us to provide.

• Healthcare provision (Article 9(2)(h) UK GDPR): We process your health data because it is necessary for the provision of health care treatment.

• Consent (Articles 6(1)(a) and 9(2)(a) UK GDPR): For clinical photography, marketing communications, or any use of your data beyond direct care — where you have given us your explicit consent.

 

Recognised legitimate interests — safeguarding vulnerable individuals 

(Article 6, Data (Use and Access) Act 2025, ★ in force 5 February 2026): 

Where processing is necessary for safeguarding vulnerable individuals, the usual balancing test is presumed satisfied. Particularly relevant for domiciliary care of frail, elderly, or at-risk patients.

 

HOW WE USE YOUR DATA

We use your information to:

• Provide, plan, and manage your foot health treatment

• Maintain accurate clinical records of your care

• Contact you about appointments, including reminders and follow-ups

• Refer you to other healthcare professionals where clinically appropriate, with your knowledge

• [With your consent] Send you occasional information about foot health and practice news

• [With your consent] Take and store clinical photographs to monitor your treatment progress

 

WHO WE SHARE YOUR DATA WITH

We will not sell, rent, or share your personal data with third parties for marketing purposes. We may share relevant information with:

• Your GP or other healthcare professionals involved in your care, where clinically necessary

• Our software provider(s), who process data on our behalf under a Data Processing Agreement (Article 28, UK GDPR). This includes our clinical records system Cliniko

 

We will always inform you if we need to share information about you beyond routine care purposes.

 

HOW LONG WE KEEP YOUR DATA

We retain your data in accordance with the following retention schedule:

 

Data Retention Periods

Adult clinical records — 8 years from the date of last treatment (NHS Records Management Code)

Children's clinical records — Until the patient's 25th birthday (or 26th if aged 17 at last treatment)

Deceased patient records — Minimum 8 years from date of death

Marketing consent / email lists — Until you withdraw consent, or 2 years after last engagement

Appointment records (non-clinical) — 2 years

 

YOUR RIGHTS

Under UK GDPR, you have the following rights regarding your personal data:

• Right to Access: You may request a copy of all personal data we hold about you (a Subject Access Request). We will respond within one calendar month. Where we need to clarify your request before we can respond effectively, we may contact you first — pausing the response period while we await your reply, as permitted under the Data (Use and Access) Act 2025 (★ in force 5 February 2026).

• Right to Rectification: You may ask us to correct any inaccurate or incomplete information we hold about you.

• Right to Erasure: You may ask us to delete your data. Please note that we may be unable to delete clinical records where we have a legal obligation to retain them (see retention schedule above).

• Right to Object: You may object to us processing your data based on legitimate interests. For marketing communications, this right is absolute.

• Right to Data Portability: In certain circumstances, you may request your data in a portable format.

• Right to Restrict Processing: You may ask us to restrict how we use your data while a complaint or query is being resolved.

 

NEW - DATA  (USE & ACCESS) ACT 2025 Right to complain to us directly

 

Under the Data (Use and Access) Act 2025 (in force 19 June 2026), you have a statutory right to raise a data protection complaint directly with us before contacting the ICO. We will acknowledge your complaint within 30 days and respond without undue delay.

 

To raise a complaint, please see our Data Protection Complaints Procedure available on request

 

HOW TO EXERCISE YOUR RIGHTS

To make any request regarding your data, or to raise a concern, please contact us:

• Email: contactfeetathome@gmail.com

• Correspondence: 49 Longfield Ave, Wallington, Surrey, SM6 7AZ

We will respond within one calendar month of receiving your request.

 

RIGHT TO COMPLAIN TO THE ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk

• Telephone: 0303 123 1113

We would always encourage you to contact us directly in the first instance so we have the opportunity to resolve any concern.

 

CONTACT & DATA CONTROLLER

For the purposes of UK GDPR and the Data (Use and Access) Act 2025, Karen Buglass is the data controller for your personal information.

Email: contactfeetathome@gmail.com 

Website: www.feetathome.com

 

 

KEEPING THIS NOTICE UP TO DATE

We review this Privacy Notice at least annually and whenever our practices change. The current version was last updated in July 2026.

 

Version: [1.0]   |   Date: July 2026  |   Next review: July 2027

​