Privacy notice

This notice explains how Orthotic Consultants Ltd uses personal information when you contact us, visit our website or receive orthotic care. It covers patients, parents, carers and people making enquiries.

Who is responsible for your information?

Orthotic Consultants Ltd is the controller of information used to provide our services. Company number: 07305653, registered in England and Wales. We are registered with the Information Commissioner's Office (ICO), reference ZB877129. For privacy questions or requests, contact Zishan Akhtar via info@orthotic-consultants.com or call 0203 7459 616. Our London clinic is at 10 Harley Street, London W1G 9PF, by appointment only.

Information we collect

Enquiries and bookings may include your name, contact details, appointment information and the message you send us. Clinical care may require your date of birth, relevant medical history, symptoms, examination findings, referrals, prescriptions, measurements, casts or scans, clinical photographs, treatment records and correspondence. We also keep quotations, invoices and payment records.

When you use the website, our hosting, security and analytics providers may process technical information such as your IP address, browser, device and pages visited. See our cookie notice for more information.

Where information comes from

Most information comes from you or a parent, carer or authorised representative. Where relevant to your care, we may receive information from your GP, consultant, physiotherapist, other healthcare professionals, referring organisations, case managers or insurers. Please only provide another person's information where you are authorised to do so.

Why we use it and our lawful bases

• Enquiries, appointments and agreed services: to take steps at your request before entering a contract and to carry out our contract with you, under Article 6(1)(b) UK GDPR.
• Safe clinical care and administration: our legitimate interests in providing and managing a safe, effective orthotic service, communicating with patients and coordinating relevant care, under Article 6(1)(f).
• Accounting and other legal duties: compliance with applicable legal obligations, under Article 6(1)(c).
• Security, complaints and legal claims: our legitimate interests in protecting patients and the practice, maintaining service standards and establishing or defending claims, or a legal obligation where applicable.
• Optional marketing and identifiable promotional photographs or stories: consent where required, under Article 6(1)(a). Booking an appointment does not itself amount to consent to promotional emails or publication of a patient story.

Health information is special-category data. For assessment, treatment and management of healthcare, we rely on Article 9(2)(h), with the relevant UK legal requirements and professional confidentiality safeguards. Where necessary for legal claims, Article 9(2)(f) may apply. Identifiable health information used for optional publicity requires a separate appropriate basis, normally your explicit consent under Article 9(2)(a). Consent to treatment is separate from the legal basis for keeping clinical records.

Who may receive information?

Access is limited to people who need information for their role. Relevant recipients may include our clinical and administrative staff; healthcare professionals involved in your care; orthotic manufacturers receiving the prescription, measurements, scans or other information needed to make your device; and technology providers supporting bookings, communications, website hosting, security, accounts and records.

Our online booking service is provided through Cliniko. We use Xero for quotations and invoicing. Google services support website analytics, spam prevention and our public business listing; Windsor.ai is used to access search and business-profile reporting. Information shared with manufacturers or referrers should be limited to what is necessary for the purpose.

For a VIM Health appointment, VIM also processes information for its own booking, physiotherapy and clinic services. Its privacy information applies to that processing. We coordinate relevant information where needed for joint care. We may also disclose information where required by law, to safeguard someone, or to professional advisers, insurers or regulators where justified.

International processing

Some technology providers and their support teams operate outside the UK. Any restricted transfer requires an applicable lawful transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards. You can contact us for details of the providers, countries and safeguards relevant to your information. Cliniko publishes its UK GDPR information.

How long we keep information

Retention depends on the purpose and type of record. For clinical records, we consider continuity of care, the patient's age, professional requirements, advice from our indemnity provider and the time during which a complaint or claim may arise. Children's records may need to be retained for longer. Financial records are kept for applicable accounting and tax requirements. Enquiries that do not lead to care are retained only as needed to handle the enquiry and any related follow-up or dispute. Legal holds can require longer retention.

Contact us if you would like the retention period or criteria applying to a particular record. We do not promise immediate deletion of information that must be retained for care or legal reasons.

Your choices and rights

Depending on the circumstances, you may request access to your information, correction, deletion, restriction of use or a portable copy. These rights have legal limits. We may need to check your identity and any authority to act for another person.

Your right to object: you may object to processing based on legitimate interests. You can object to direct marketing at any time.

Where we rely on consent, you may withdraw it by contacting us. This does not affect processing that was lawful before withdrawal. For optional published material, we can stop future use and remove material under our control, but may not be able to retrieve copies already distributed or held by others.

Children, photographs and clinical decisions

We consider the child's interests, understanding and the authority of the person acting for them. Clinical photographs, scans and measurements used for care are treated as health information. Permission to use material publicly is separate from permission to record it for treatment. Clinical decisions are made by your clinician; this website does not provide an automated diagnosis or prescription.

Contacting us securely

Please keep website enquiries brief and avoid sending detailed medical reports or sensitive photographs through a general enquiry form. Ask us how best to provide them. Relevant clinical and contact information is necessary to assess and provide safe care; if you choose not to provide it, we may be unable to offer some services.

Concerns about your privacy

Please contact us so we can investigate. You also have the right to complain to the Information Commissioner's Office. We review this notice when our services or data practices change.