top of page

Privacy Policy

Effective date: 19 June 2026
Last reviewed: 2 September 2026

This Privacy Policy explains how Carlisle Road Foot Care collects, uses, stores and shares personal information. It applies to patients, prospective patients, website visitors and anyone who contacts or deals with the clinic.

We are committed to handling personal information fairly, lawfully, transparently and securely in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable law.

1. Who we are

The data controller is Elaine McLaughlin trading as Carlisle Road Foot Care. This means that we decide why and how personal information is used.

Contact details

Carlisle Road Foot Care
63–65 Carlisle Road
Derry City
BT48 6JL

Email: info@carlisleroadfootcare.com
Telephone: 028 71 374097

Please use these details if you have a question about how we handle personal information or wish to exercise one of your data-protection rights.

2. Personal information we collect

Depending on how you interact with us, we may collect:

  • Identity and contact details, including your name, date of birth, address, telephone number, email address and emergency-contact details.

  • Appointment and administrative information, including bookings, reminders, attendance, cancellations, correspondence and communication preferences.

  • Health and clinical information, including your medical history, medication, allergies, symptoms, diagnoses, assessments, treatment plans, clinical notes, consent records, photographs, scans, gait or biomechanical measurements and treatment outcomes.

  • Payment and transaction information, including amounts paid, refunds and limited payment references. Full card details are normally processed by our payment provider and are not retained by us.

  • Information supplied by another person or organisation, such as a parent, guardian, carer, GP, consultant, insurer or other healthcare professional.

  • Website and device information, such as your IP address, browser type, device information, pages viewed and cookie choices, where collected through Wix or related website technologies.

Health information is classed as special category personal data and receives additional protection under data-protection law.

3. How we obtain information

We usually obtain information directly from you when you:

  • Contact the clinic.

  • Book an appointment online or by telephone.

  • Complete a form.

  • Attend an appointment.

  • Make a payment.

  • Correspond with us.

We may also receive relevant information from a parent, guardian, carer, healthcare professional, referral source, insurer or another person acting with appropriate authority.

Online bookings are made through Cliniko and our website is hosted by Wix. Information submitted through these services is also handled in accordance with their privacy information and contractual safeguards.

4. Why we use personal information and our lawful bases

Providing healthcare

We use identity, contact, appointment and clinical information to:

  • Assess your needs.

  • Provide podiatry and related healthcare.

  • Maintain accurate clinical records.

  • Arrange follow-up care.

  • Communicate with you about your treatment.

Our lawful basis under the UK GDPR is usually the performance of a contract, taking steps at your request before entering a contract and/or our legitimate interests in operating a safe and effective healthcare service.

When we process health information, we usually rely upon Article 9(2)(h) of the UK GDPR: processing necessary for medical diagnosis, the provision of health treatment or the management of health services by, or under the responsibility of, a professional subject to confidentiality obligations.

Appointments and service communications

We use your contact details to arrange appointments and send:

  • Booking confirmations.

  • Appointment reminders.

  • Notification of appointment changes.

  • Aftercare information.

  • Other communications connected with your care.

These are service communications and not promotional marketing.

Our lawful basis is the performance of a contract and/or our legitimate interests in managing appointments and reducing missed visits.

Payments, accounts and legal obligations

We process payment and transaction information to:

  • Take payment.

  • Provide receipts.

  • Arrange refunds.

  • Maintain financial records.

  • Respond to payment disputes.

  • Meet tax, accounting and other legal obligations.

Our lawful bases are the performance of a contract, compliance with legal obligations and our legitimate interests.

Safety, complaints and legal claims

We may use relevant information to:

  • Protect patients and staff.

  • Manage complaints.

  • Investigate incidents.

  • Establish, exercise or defend legal claims.

  • Prevent fraud.

  • Meet professional or regulatory requirements.

Our lawful bases may include compliance with a legal obligation and our legitimate interests.

For special category information, we may rely upon the provision of healthcare or the establishment, exercise or defence of legal claims.

Website operation

We may use necessary website information to keep our website secure and functioning properly.

Non-essential analytics or similar cookies should only be used in accordance with the choices presented through our website’s cookie controls. You can review or change your choices through the cookie settings available on the website.

5. Children and people acting for patients

We may process information about children and young people where they receive our services.

A parent or guardian may provide information and manage arrangements where appropriate. However, confidentiality and decision-making will be considered in light of the young person’s age, understanding and individual circumstances.

Where another person acts for an adult patient, we may ask for evidence of their authority or the patient’s consent before disclosing personal information.

6. Who we share information with

We only share personal information where this is necessary, lawful and proportionate.

Recipients may include:

  • Podiatrists, authorised clinic staff and self-employed clinicians working at the clinic who require the information to provide or support your care and who are bound by confidentiality obligations.

  • Other healthcare professionals, referral providers, laboratories, orthotic suppliers, insurers or care organisations where this is necessary for your care, requested by you or otherwise lawful.

  • Cliniko, which supports online booking, appointment administration and clinical practice management.

  • Wix, which hosts and supports our website and its technical features.

  • 123 Reg and relevant email-infrastructure providers, which support our clinic email service.

  • Barclaycard and associated payment networks or service providers, which process card payments.

  • Professional advisers, IT-support providers, insurers, regulators, law-enforcement bodies, courts or public authorities where necessary or required by law.

We do not sell personal information.

We require service providers acting on our behalf to protect personal information and use it only for authorised purposes.

7. International transfers

Some technology providers or their approved subcontractors may store or access information outside the United Kingdom.

Where this happens, we take reasonable steps to ensure that an appropriate legal safeguard is in place. These safeguards may include:

  • UK adequacy regulations.

  • The UK International Data Transfer Agreement.

  • The UK Addendum to approved standard contractual clauses.

  • Another lawful international-transfer mechanism.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet clinical, professional, insurance, tax and legal requirements.

Retention periods can vary according to the patient’s age, treatment, risk and whether there is a complaint or legal claim.

Our normal retention periods are:

  • Adult clinical records: At least eight years after the end of treatment or the last entry. Records may be kept longer where professional, insurance or legal considerations require it.

  • Children and young people: Until at least the patient’s 25th birthday, or their 26th birthday if they were aged 17 when treatment ended. Records may be retained for longer where required.

  • Financial and transaction records: Normally six years after the relevant accounting period or transaction.

  • General enquiries that do not lead to treatment: Normally up to 12 months, unless there is a reason to keep the information for longer.

  • Website and cookie information: In accordance with the relevant cookie settings and service-provider retention periods.

When information is no longer required, we securely delete, destroy or anonymise it.

9. Security

We use appropriate organisational and technical measures designed to protect personal information against:

  • Accidental loss or destruction.

  • Unauthorised access.

  • Unauthorised alteration.

  • Unlawful disclosure or use.

These measures include access controls, password protection, secure systems, confidentiality requirements, staff awareness and appropriate arrangements with service providers.

No internet or email service can be guaranteed to be completely secure. Please avoid sending unnecessary sensitive or medical information by ordinary email.

10. Your data-protection rights

Depending on the circumstances and subject to legal exceptions, you may have the right to:

  • Be informed about how your personal information is used.

  • Request access to the personal information we hold about you.

  • Ask us to correct inaccurate or incomplete information.

  • Ask us to erase information in certain circumstances.

  • Ask us to restrict how information is used in certain circumstances.

  • Receive certain information in a portable format.

  • Object to processing based on our legitimate interests.

  • Withdraw consent at any time where consent is the lawful basis. Withdrawal will not affect processing that was lawful before consent was withdrawn.

Some rights are limited where we must retain clinical information to meet professional, legal, insurance or patient-safety obligations.

We do not make decisions about patients using solely automated decision-making or profiling that produces legal or similarly significant effects.

To exercise one of your rights, contact us using the details provided at the beginning of this policy. We may need to verify your identity before responding.

We normally respond to requests within one month, although data-protection law allows additional time for complex or numerous requests.

11. Complaints

Please contact us first if you have a concern about how we use your personal information, so that we have an opportunity to investigate and resolve it.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information Commissioner’s Office

Website: www.ico.org.uk
Telephone: 0303 123 1113

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

12. Links to other websites

Our website may contain links to other websites and services, including Cliniko’s booking service and social-media platforms.

Those organisations are responsible for their own privacy practices. We recommend reading their privacy information when leaving our website.

13. Changes to this policy

We may update this Privacy Policy when our services, systems or legal obligations change.

The latest version will be published on www.carlisleroadfootcare.com with an updated effective or review date.

bottom of page