Company: DAS Chiropractic Limited
Trading Name: Optimum Chiropractic

This policy outlines how Optimum Chiropractic (DAS Chiropractic Limited) collects, stores, processes, and protects personal and medical data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Common Law Duty of Confidentiality

The purpose of this policy is to ensure that patient information is:

• collected lawfully and transparently
• stored securely
• used only for legitimate healthcare purposes
• protected against unauthorised access or disclosure

All staff members working within Optimum Chiropractic are required to comply with this policy.

The Data Controller responsible for patient data is:

DAS Chiropractic Limited (Optimum Chiropractic)

The Data Controller determines how personal data is processed and ensures compliance with data protection legislation.

All authorised staff members may handle patient information only as required to perform their role within the clinic.

Optimum Chiropractic may collect and process the following information:

• Name
• Address
• Date of birth
• Telephone number
• Email address

• Health history
• Presenting complaints
• Examination findings
• Treatment notes
• Imaging reports
• Consent forms

• Email correspondence
• SMS communication
• WhatsApp communication where applicable
• Call centre communications via Balance VA

• Appointment records
• Payment records
• Website enquiry forms

Patient data is processed under the following lawful bases:

Article 6 UK GDPR

• Provision of healthcare services
• Legitimate interests in operating a healthcare clinic
• Patient consent where applicable

Article 9 UK GDPR (Special Category Data)

Medical data is processed because it is necessary for the provision of healthcare services by a healthcare professional.

Patient data may be collected through:

• Online enquiry forms via the clinic website
• Online booking forms
• Intake and consent forms
• In-person consultations
• Telephone communications
• Email communications
• SMS communications
• WhatsApp messaging where patients initiate communication
• Balance VA call centre services

Patients are informed that their data will be used for clinical care, appointment administration, and communication relating to their healthcare.

Patient records are primarily stored electronically using:

PracticeHub Practice Management System

This system stores:

• patient demographic information
• health history forms
• consultation notes
• appointment records

Access is restricted to authorised clinic personnel only.

Radiographic images and related documentation are stored on the clinic computer located in the X-ray room using:

• DxWorks imaging software
• An external secure storage folder on the clinic computer

Access to imaging records is restricted to authorised clinical personnel.

Where paper documentation exists (e.g., signed consent forms or intake documents), these records are stored in a:

Secure staff-only location within the clinic.

Access is limited to authorised staff members only.

Optimum Chiropractic implements appropriate technical and organisational measures to protect patient data, including:

• Password-protected computer systems
• Restricted staff access to patient records
• Secure storage of paper records
• Use of secure clinical management software (PracticeHub)
• Controlled access to the X-ray room and imaging systems

Patient information must never be accessed, viewed, or shared unless necessary for legitimate clinical or administrative purposes.

Patient communication may occur through:

• Email
• SMS appointment reminders
• WhatsApp messaging
• Telephone communication
• Balance VA call centre services

These communication channels are used only for appointment scheduling, clinic administration, and matters related to patient care.

Sensitive medical information will only be shared when clinically appropriate and necessary.

Optimum Chiropractic operates CCTV within the clinic premises for security purposes.

Key points:

• CCTV recording is motion activated only
• Recording occurs when the clinic is closed
• CCTV is used solely for security and crime prevention
• Recordings are not used for monitoring staff or patients during clinic operation

Access to CCTV recordings is restricted to authorised personnel.

All patient information is treated as strictly confidential.

Patient information will not be shared with third parties unless:

• the patient has provided consent
• it is required for medical referral or continuity of care
• it is required by law
• it is necessary to protect patient safety

All staff must uphold the common law duty of confidentiality.

Patient information may occasionally be shared with:

• other healthcare providers for referral or collaboration
• diagnostic imaging services where appropriate
• regulatory or legal authorities when required by law

Only relevant information necessary for the purpose of care will be shared.

Under UK GDPR, patients have the right to:

• access their personal data (Subject Access Request)
• request correction of inaccurate data
• request restriction of processing
• request erasure where legally appropriate
• object to certain types of data processing

Requests for access to patient records must be made in writing.

The clinic will respond within one calendar month in accordance with GDPR requirements.

In the event of a suspected data breach:

1. The incident must be reported immediately to the clinic management.
2. The breach will be assessed to determine risk to individuals.
3. Where required, the Information Commissioner’s Office (ICO) will be notified within 72 hours.
4. Affected individuals will be informed where there is a risk to their rights or freedoms.

All data breaches will be recorded and investigated.

Patient records are retained in accordance with UK healthcare record retention guidance.

Retention periods:

Adults:
Minimum 8 years after the last treatment

Children:
Until age 25

After this period, records will be securely deleted or destroyed.

All staff members working within Optimum Chiropractic must:

• follow this data protection policy
• maintain strict confidentiality
• only access patient data necessary for their role
• ensure records are handled securely
• report any suspected data breaches immediately

Failure to comply with this policy may result in disciplinary action.

This policy will be reviewed annually or sooner if:

• legal requirements change
• clinic procedures change
• new technology is introduced

Policy Name: Data Protection and Patient Records Policy
Organisation: DAS Chiropractic Limited (Optimum Chiropractic)
Version: 1.0
Effective Date: 1 March 2026
Review Date: 1 March 2027