top of page

Privacy Policy

Last updated: 18 August 2026

1. Who we are

This website (kaizenosteopathy.co.uk) is operated by Kaizen Integrated Health Limited, trading as Kaizen Osteopathy ("we", "us", "our"), a manual therapy and osteopathy practice based at:

Red Lion House, 600 London Road, High Wycombe, HP11 1EX

Company registration number: 16113285

Treatment is provided by David Shah, a registered osteopath (General Osteopathic Council registration number 12229).

The person responsible for data protection matters at Kaizen Osteopathy is David Shah, who can be contacted at david@kaizenosteopathy.co.uk

We are the data controller for the personal information described below and are registered with the Information Commissioner's Office under registration number ZB514690

​

2. What information we collect

We collect information about you in the following ways.

​

a) Booking and clinical information

When you book an appointment or receive treatment with us, we collect and store information via our practice management system, Jane App, including:

  • Contact details (name, email address, phone number, address)

  • Appointment history and booking details

  • Clinical notes, assessment findings, and treatment records

  • GP letters, referral correspondence, and scan or imaging results you share with us

  • Invoicing and payment records (payments are currently made by bank transfer following invoices raised through Jane App, and we do not currently process or store card details)​

​

b) Rehabilitation and exercise programmes

Where we prescribe you a rehabilitation or exercise programme, we use PhysiTrack to build and share it with you. This involves storing your name, contact details, and the details of the programme prescribed, together with any feedback or progress information you choose to record within the platform.

​

c) Messages sent to us by email, text, or WhatsApp

We publish an email address and a WhatsApp number so that you can reach us easily, and we hold the correspondence you send us through these channels.

We ask that you use email, text, and WhatsApp for practical matters such as arranging, changing, or confirming appointments. If you send us clinical information through these channels, for example describing your symptoms or sending a photograph, we will record anything clinically relevant in your patient record in Jane App and will not rely on the message thread as your clinical record.

WhatsApp messages are handled by WhatsApp Ireland Limited (part of Meta) and are protected by end to end encryption in transit, but they are stored on the device we receive them on. Please do not send us sensitive clinical information by WhatsApp if you would prefer it not to be held in this way. You are always welcome to send it through Jane App or by email instead, or to raise it in person at your appointment.

We periodically delete message threads once the information in them has been recorded in your patient record or is no longer needed.

​

d) Email newsletter and marketing

If you choose to opt in to our mailing list, for example by ticking a sign-up box or subscribing via a form, we collect your name and email address and store this using our email marketing provider, Zoho, to send you updates, offers, or practice news.

We do not add you to this list without your consent. You can unsubscribe at any time using the link in any email we send, or by contacting us directly, and we will stop processing your data for marketing purposes as soon as reasonably practicable.

​

e) Contact form enquiries

Our website (built on Wix) includes a contact form which collects your name and email address when you submit an enquiry. We use this only to reply to you directly. It is not added to any mailing list or automated system unless you separately opt in to our newsletter.

​

f) Photographs, video, and case studies

We do not photograph, film, or record you, and we do not use your information or images in any teaching material, case study, or social media content, unless you have given us separate written consent for that specific purpose.

Consenting to treatment does not mean you have consented to any of this. Any consent you do give for imagery or case study use is entirely separate, is never a condition of receiving treatment, and can be withdrawn at any time by contacting us. Where you withdraw consent we will stop using the material going forward, though we may not always be able to recover copies that have already been shared or reposted by others.

Where a photograph or video is taken purely for clinical purposes, for example to record posture or range of movement so that we can compare it at a later appointment, it forms part of your clinical record and is stored in Jane App with the same protections as the rest of your record.

​

g) Information collected automatically

Our website is hosted on Wix, which automatically places essential cookies on your device, for example for site security and basic functionality. These cannot be disabled and do not require consent under UK GDPR and PECR, as they are strictly necessary for the site to work.

We do not currently have any analytics, advertising, or marketing cookies enabled on the site. If we add any in future, we will add a cookie consent banner and update this policy.

​

3. Why we use your information and our legal basis

Providing osteopathy and manual therapy treatment, and keeping clinical records Contract (to provide the treatment you have requested) and legal obligation (professional record keeping duties required by the General Osteopathic Council).

Prescribing and monitoring rehabilitation programmes Contract (part of the treatment you have requested).

Invoicing and payment records Contract and legal obligation (accounting and tax records).

Sharing information with GPs, consultants, or other clinicians involved in your care Legitimate interests or your explicit consent, as appropriate to the situation.

Sharing information with a club, team, or organisation that has arranged or is paying for your treatment Your explicit consent. See Section 4 below.

Sending you email newsletters via Zoho Consent, which you can withdraw at any time.

Using photographs, video, or case study material Your explicit consent, which you can withdraw at any time.

Responding to general enquiries Legitimate interests (responding to people who contact us).

Clinical and health information is "special category data" under UK GDPR. We only process this where it is necessary for the purposes of preventative or occupational medicine, medical diagnosis, or the provision of health treatment, and where we have appropriate safeguards in place, as permitted under Article 9(2)(h) UK GDPR and Schedule 1 of the Data Protection Act 2018.

​

4. Who we share your information with

Jane App (janeapp.co.uk) is our clinical and booking management provider, who host your booking, clinical, and invoicing records on our behalf as a data processor.

PhysiTrack is our rehabilitation programme provider, who host your exercise programme and any related progress information on our behalf as a data processor.

Zoho is our email marketing provider, who host subscriber mailing list data on our behalf as a data processor, if you have opted in to our newsletter.

Wix is our website hosting platform, who process contact form submissions and essential site cookies on our behalf as a data processor.

WhatsApp Ireland Limited (Meta) processes any messages you choose to send us through WhatsApp.

GPs, consultants, physiotherapists, or other healthcare professionals may receive information from us, but only where it is relevant to your care and only with your knowledge, for example when we produce a referral letter or respond to a request for clinical information.

Clubs, teams, employers, or other organisations. Where your treatment is arranged, requested, or paid for by a third party such as a sports club or governing body, we will agree with you in advance what may be shared with them and will not share clinical detail beyond that without your explicit consent. Where clinically appropriate, this may include sharing information with a team doctor, physiotherapist, or performance staff who are involved in managing your care. You remain our patient, and your right to confidentiality is not reduced by the fact that someone else has arranged or paid for your treatment.

We do not sell your personal information to third parties.

​

5. Where your information is stored

Jane App: your clinical, booking, and invoicing data is stored on Jane App's UK regional data centre (London), as our clinic account is configured to store data within the UK.

PhysiTrack: programme and account data is stored on servers within the United Kingdom and European Union.

Zoho: mailing list data is stored on servers located within the European Union (France, Belgium, and Germany). This falls within the UK's adequacy regulations for the EU, so no additional international transfer safeguards are required.

Wix: contact form submissions may be processed and stored by Wix outside the UK and EEA (Wix operates data centres in locations including the US, Ireland, Israel, South Korea, and Taiwan). Where this happens, Wix relies on Standard Contractual Clauses and additional safeguards under its Data Processing Agreement to protect your information in line with UK GDPR requirements.

Email and WhatsApp: correspondence is held on our business email account and on the practice device used to receive messages, both of which are password protected.

If any provider changes where they store data, we will update this policy accordingly.

​

6. Security

We take reasonable steps to protect your personal information, including relying on our providers' security measures. Jane App encrypts data both in transit and at rest and restricts access via individual staff logins, and Brevo holds ISO 27001 certification for its data security practices. Devices used to access patient information are password protected and encrypted.

Access to your clinical records within our practice is limited to those directly involved in your care or the running of the practice.

No system can be guaranteed 100% secure, but if we become aware of a data breach affecting your information, we will act promptly to investigate and, where required, notify the ICO and affected individuals in line with our obligations under Articles 33 and 34 UK GDPR.

​

7. Children and young people

We may treat patients under the age of 18, for example young athletes referred for sports massage or osteopathic treatment.

Where a patient is under 16, we will usually seek the consent of a parent or guardian before providing treatment. A patient under 16 may consent to their own treatment where we assess them as having sufficient maturity and understanding of what is proposed, in line with the principle of Gillick competence.

Patients aged 16 and 17 are presumed to be able to consent to their own treatment in their own right.

Clinical records for children and young people are handled with the same safeguards as for adult patients. Where a parent or guardian requests access to a young person's records, we will consider the young person's own views and their right to confidentiality before responding.

Our website and newsletter are not directed at children, and we do not knowingly collect marketing data from anyone under 18.

​

8. Automated decision-making

We do not use your personal information for any automated decision-making or profiling that produces legal or similarly significant effects on you.

​

9. How long we keep your information

In line with the record keeping requirements set by the General Osteopathic Council, we retain patient records for a minimum of 8 years after your last consultation. For patients treated as children, we retain records until their 25th birthday, or their 26th birthday where the patient was 17 at the conclusion of treatment. We do not retain records for longer than necessary beyond this unless there is a specific clinical or legal reason to do so.

If David Shah were to stop practising, retire, or become unable to continue running the practice, arrangements would be made to ensure patient records continue to be stored securely and remain accessible in line with GOsC requirements, and patients would be informed where practicable.

Invoicing records are kept for as long as required for tax and accounting purposes, currently 6 years. Newsletter subscriber data is kept until you unsubscribe. Message threads on email, text, and WhatsApp are deleted periodically once the information in them has been recorded in your patient record or is no longer needed. Records are disposed of securely, for example by permanent deletion from Jane App, once the applicable retention period has passed.

​

10. Your rights

Under UK data protection law, you have the right to:

  • Access the personal information we hold about you

  • Ask us to correct inaccurate information

  • Ask us to erase your information, though we may need to retain clinical records to meet our professional and legal obligations

  • Object to or restrict certain processing

  • Withdraw consent at any time, for example by unsubscribing from our newsletter or withdrawing consent for use of photographs

  • Request a copy of your data in a portable format

  • Complain to us directly, and to the Information Commissioner's Office, if you believe we have not handled your information properly

To exercise any of these rights, contact us using the details in Section 1. We will respond within one month of receiving your request, and will tell you if we need longer because your request is particularly complex.

There is no charge for exercising these rights.

If you are unhappy with how we have handled your information, please see our Data and Service Complaints page, which explains how to raise a concern with us and how to escalate it to the Information Commissioner's Office if you remain dissatisfied.

​

11. Cookies

See Section 2(g) above for details of the essential cookies placed by our website host, Wix. We do not currently use any analytics, advertising, or non-essential cookies. If this changes, we will add a cookie consent banner and update this policy.

​

12. Governing law

This policy is governed by the laws of England and Wales.

​

13. Changes to this policy

We may update this policy from time to time, for example when our business contact details change or if we introduce new tools or services. The "last updated" date at the top of this page will reflect the most recent version.

bottom of page