UK GDPR 2026 Privacy Notice

​

Who we are

​

Apple Tree Osteopaths, Baby Pathway (operated by Yummy Discoveries Ltd) and Chiltern Breastfeeding Partnership (operated by Luci Lishman) which hereafter for the purposes of this Privacy Notice will be referred to as “The Practice”. When we refer to “we, “us” or “our” throughout this notice we mean “The Practice”.

 

You can contact us

Felicity Bertin (Apple Tree Osteopaths / Baby Pathway)  

Telephone 07591 791636 or email info@appletreeosteopaths.co.uk 

Luci Lishman (Chiltern Breastfeeding Partnership) 

Telephone 07795 366251 or email support@chilternbreastfeeding.com 

 

We are committed to handling your personal data with care, transparency and respect. This notice explains what we collect, why we collect it, and what your rights are.

 

 

What data we collect and why

 

CLINICAL RECORDS

 

When you engage with us remotely or come to see us – or bring your baby or child – we record information relevant and necessary for your care. This includes medical history, current medications, symptoms, progress notes, and any relevant correspondence with other healthcare professionals. We may also record photographs or videos where clinically indicated, always with your explicit consent.

 

This information is essential for providing safe and appropriate care. It is stored securely and accessed only by practitioners and administrative staff directly involved with your care. All staff handling clinical and other personal data have signed a confidentiality agreement. 

 

We use Cliniko, Finger-ink, Physitrack and Skully Care to store and manage clinical records. Skully Care is used specifically to measure and monitor head shapes as part of osteopathic paediatric assessments.

 

We also sometimes use Heidi AI which listens to consultations and automatically converts the conversation into structured, accurate medical records. This will not be used without your explicit consent.

 

BOOKINGS AND COMMUNICATIONS

 

We use your / your child’s personal and contact details – name, date of birth, phone number, email address, home address – to manage appointments, send reminders and share information relevant to your care. This includes administrative communications such as booking confirmations and reminders, pre- appointment forms and sending reports/ notes, auditing or other information concerning your treatment.

 

We may also use the contact details provided by you to respond to your enquiries, including making telephone contact, text message and emailing information to you which we believe may be of interest to you.

 

NEWSLETTER AND MARKETING

 

If you choose to sign up to the Apple Tree Osteopaths / Baby pathway newsletter, communications may come from either brand, but your data is always held and handled by the same organisation.

You will never be added to the newsletter mailing list without actively choosing to. You can unsubscribe at any time using the link in any email sent by Apple Tree Osteopaths / Baby pathway or by contacting us directly.

Systeme.io is used to manage newsletter and some marketing communications.

 

With your explicit consent and for the purposes of promoting healthcare, including offers and advice, we may email you with information that may be of interest to you and / or your child.

 

WEBSITE ANALYTICS

 

Our websites use Google Analytics 4 and Microsoft Clarity to help us understand how visitors use the site. Both tools are configured to anonymise data – we do not collect personally identifying information through either platform. You can manage your cookie preferences using the banner on our websites, or through your browser settings

 

 

Legal basis for processing your data

 

Contractual necessity – to provide the care / treatment you have requested and to manage your appointments.

 

Explicit consent – for the processing of sensitive health data, for any marketing or newsletter communications you have opted into and the use of AI technology.

 

Legitimate interests – to respond to enquiries and to maintain records necessary for the safe running of The Practice and to meet the standards required of our professional regulatory boards. 

 

 

How we share your data

 

We do not sell, rent or share your personal data for commercial purposes.

 

In some circumstances, it may be necessary to share relevant aspects of your records with other healthcare professionals – for example, your GP, a paediatrician, a specialist – where this is in your child’s best interests. This might also include emergency services. We will always inform you before doing so where possible.

 

We collect data to process payment for services including managing payments and collecting/recovering / reimbursing money owed. For the purposes of account management, external accountants, who have a legal obligation to maintain your confidentiality, will have access to receipts, bank transactions and other accounting data. 

 

We will not disclose your personal information unless we are compelled to, to meet legal obligations, regulations or valid governmental requests.

This would include concerns about the safety of you, your child or children, when we would be professionally and legally obligated to share relevant information with appropriate agencies without your consent. 

 

 

How long we keep your data

 

If you are over the age of eighteen, we retain your records for eight years following the end of your treatment/ support, in line with our professional and legal obligations. After this period, data is securely deleted.

 

Records relating to minors (under the age of eighteen) at the time of treatment / support are retained until they reach the age of twenty-five.

 

 

Data storage and systems

 

Cliniko – our practice management system, used for clinical records, consent forms, pre-consultation forms, appointment bookings and patient communications. Cliniko’s servers are based in Australia; however

Cliniko is contractually committed to protecting patient data in accordance with UK GDPR.

 

Finger-ink – provides pre–consultation and consent forms that integrate with Cliniko. Finger-ink’s servers are based in New Zealand; however, Finger-ink is contractually committed to protecting patient data in accordance with UK GDPR.

 

Heidi AI – artificial intelligence technology which listens to consultations and automatically converts the conversation into structured, accurate medical records. Maintains secure UK- based data hosting compliant with UK GDPR.

This will not be used without your explicit consent.

 

Physitrack – used to assign and manage home exercise and activity programmes. Data is stored securely in accordance with UK GDPR.

 

Skully Care – used to manage and monitor head shapes as part of our osteopathic paediatric assessments. Data is stored securely in accordance with UK GDPR.

 

Smart Survey – system used for client feedback / audits. All data is kept in the UK in a secure data centre in accordance with UK GDPR.

 

Systeme.io – used to manage newsletter sign-ups and marketing communications for the Apple Tree Osteopaths and Baby Pathway brands.

Data is stored securely in accordance with UK GDPR.

 

Google Analytics 4 and Microsoft Clarity – used for anonymised website analytics. No personally identifying information is collected through these tools.

 

All personal data is accessed only by authorised staff and practitioners. Where personal data is accessed on personal devices, these devices are password protected. 

 

Where personal data is recorded on paper this is stored securely and destroyed when no longer required. 

 

 

Your rights under UK GDPR

 

• Right of access – you can request a copy of the information we hold about you, including details about where we get personal information from and who we share personal information with

• Right to rectification – you can ask us to correct information that is inaccurate or incomplete.

• Right to erasure – in certain circumstances, you can ask us to delete the data we hold about you.

• Right to restrict processing – you can ask us to limit how we use your data in certain circumstances.

• Right to data portability – you can ask for your data to be transferred to another organisation.

• Right to object – you can object to certain types of processing, including direct marketing 

• Right to withdraw consent – you have the right to withdraw your consent to the processing of your personal information

 

 

How to exercise your rights

 

To request access to your data, or to exercise any of the rights listed above, please contact us using the relevant contact details at the top of the privacy notice.

 

To protect your privacy, we will ask you to provide proof of identity before releasing any personal information. We accept a copy of a driving licence or passport, plus a recent utility bill or bank statement. At least one form of photographic ID is required.

 

We will respond to all requests within one month, in line with UK GDPR requirements.

 

 

Concerns about how we handle your data

 

If you have concerns about how we are handling your personal data, please contact us in the first instance at either

info@appletreeosteopaths.co.uk or 

support@chilternbreastfeeding.com

We will respond within 30 days.

 

If you are not satisfied with our response, you have the right to refer your concern to the Information Commissioner’s Office (ICO):

 

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Tel: 0303 123 1113 www.ico.org.uk