N J Harrison Chiropody Podiatry Services

Privacy Policy

Dated: 21 June 2026

Who we are

N J Harrison Chiropody Services is a chiropody practice run by Nicola Harrison. I am registered with the Information Commissioner's Office (ICO) under registration number ZB774205.

If you have any questions about how I handle your personal data, please contact me at nomeanfeet [at] hotmail.co.uk (please replace [at] with @ when emailing).

What personal data we collect

I collect and process the following types of personal data:

Contact details — your name, address, telephone number, and email address
Health and therapy-related information — your presenting concerns, relevant medical history, current medications, and any other health information you share with me
Session notes — records of our appointments, including observations, treatments provided, and your progress
Financial records — payment information and invoices

Important: Your health and therapy-related information is classified as "special category data" under Article 9(1) of the UK GDPR. This type of data receives enhanced legal protection because of its sensitive nature.

How we collect your data

I collect personal data directly from you:

When you first contact me to make an enquiry or book an appointment
During your initial consultation and intake assessment
During our treatment sessions
Through email or telephone communications

I do not collect personal data about you from third parties unless you have given your explicit consent for this.

Why we process your data — lawful basis

To process your personal data lawfully under UK GDPR, I rely on the following legal bases:

Article 6 basis (ordinary personal data):

Article 6(1)(f) UK GDPR — legitimate interests. Specifically, my legitimate interest in retaining information necessary to provide you with the best possible treatment and to comply with my professional indemnity insurance requirements as a practitioner in private practice.

Article 9 basis (special category health data):

Article 9(2)(h) UK GDPR — processing is necessary for the provision of health care treatment by a health professional subject to a professional obligation of confidentiality.

The additional condition under DPA 2018 Schedule 1 is Part 1, paragraph 2 (health or social care). My professional obligation of confidentiality is grounded in the common-law duty of confidence owed by health and wellbeing practitioners to their clients, and the standard professional practice expected of practitioners in private practice.

Professional obligations and CPD

I engage in ongoing continuing professional development (CPD) appropriate to my practice to ensure I provide you with the best possible care.

I am not required to attend clinical supervision, but I may choose to engage in peer consultation to support my professional development. Where I do:

Your name and any identifying details are never shared
I use only anonymised or pseudonymised case material
Anyone I consult with professionally is bound by their own professional obligations of confidentiality

Who we share your data with

I keep your information confidential. However, I use the following third-party service which may process your data:

Cliniko — practice management and appointment booking

This service is bound by a data processing agreement that requires them to protect your data appropriately. A link to their privacy policy is available on request.

Additionally, I have administrative help who may access your calendar appointments and contact details for scheduling purposes. They do not have access to your clinical notes.

I never sell your personal data to anyone.

International data transfers

Cliniko (Cliniko Pty Ltd) is based in Australia. This means your personal data may be transferred outside the United Kingdom.

Where data is transferred internationally, I rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs) as appropriate safeguards, in accordance with UK GDPR Chapter V and the updated requirements of the Data (Use and Access) Act 2025.

You can request a copy of the relevant transfer safeguards by contacting me.

How long we keep your data

I retain your personal data for the following periods:

Treatment records (adult clients): 7 years after our last appointment, in line with the Limitation Act 1980 and standard professional indemnity insurance requirements
Treatment records (clients under 18 at the time of treatment): until you reach the age of 25
Financial records: 6 years, as required by HMRC
Website enquiries (non-clients): 12 months

After the applicable retention period ends, paper records are securely destroyed and electronic records are permanently deleted.

Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed — to know how your data is being used (this privacy policy fulfils that right)
Right of access — to request a copy of the personal data I hold about you. Under the Data (Use and Access) Act 2025, I will conduct a reasonable and proportionate search when responding to your request
Right to rectification — to ask me to correct any inaccurate or incomplete data I hold about you
Right to erasure — to ask me to delete your personal data. However, this right is not absolute. I may need to retain your records until the end of the applicable retention period where this is required by professional guidelines, insurance requirements, or law
Right to restrict processing — to ask me to limit how I use your data in certain circumstances
Right to data portability — to request your data in a format that can be transferred to another provider
Right to object — to object to certain types of processing, including processing based on legitimate interests
Rights related to automated decision-making — I do not use automated decision-making or profiling in my practice

To exercise any of these rights, please contact me at nomeanfeet [at] hotmail.co.uk (please replace [at] with @ when emailing). I will respond within one month.

Data protection complaints — your right under the Data (Use and Access) Act 2025

You have the right to make a data protection complaint directly to me. You can submit a complaint through my compliance page at https://njharrisonchiropodyservices.policydiary.co.uk (Make a complaint tab) or by emailing me at nomeanfeet [at] hotmail.co.uk.

I take all complaints seriously and will respond promptly.

If you are not satisfied with my response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Address: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Confidentiality exceptions

I treat everything you share with me as confidential. However, there are limited circumstances where I may need to share information without your consent:

Risk of serious harm — if I believe there is a serious risk of harm to you or to another person
Safeguarding concerns — if I have concerns about the safety of a child or a vulnerable adult
Legal requirement — if I am ordered to disclose information by a court of law

Wherever possible, I will discuss any disclosure with you first, unless doing so would itself put someone at risk.

Changes to this policy

I review this privacy policy annually and whenever my practices change significantly. If I make any substantial changes that affect how your data is processed, I will inform you directly.

You can always find the current version of this policy on my compliance page at https://njharrisonchiropodyservices.policydiary.co.uk.