Last updated: 1/9/26
1. Who we are
Southam Chiropractic is the data controller for the personal information described in this notice. In this notice we call ourselves "we", "us" and "our".
We run the clinic at 50 Coventry Street, Southam, Warwickshire CV47 0EP and the website at https://southam.uk-chiropractic.co.uk.
If you have any question about this notice, or you want to exercise any of the rights in section 11, contact us:
Email:[email protected]
Phone:01926 298 102
Post: Southam Chiropractic, 50 Coventry Street, Southam CV47 0EP
Please tell us if your contact details change so that what we hold about you stays accurate.
2. What this notice covers
This notice applies to:
visitors to our website
people who contact us or fill in a form, including offer and voucher forms
patients of the clinic
people who receive marketing from us
3. What we collect, why we use it, and our lawful basis
Information
Why we use it
Lawful basis
Enquiry information: your name, email address, phone number, and anything you tell us in a form, email, text, live chat, social media message or phone call
To reply to you, to answer questions about treatment, and to arrange an appointment
Article 6(1)(b) UK GDPR, taking steps at your request before entering into a contract. Where no appointment follows, Article 6(1)(f), our legitimate interest in responding to enquiries and keeping a record of them
Appointment and account information: appointment history, attendance, payments, invoices, correspondence with you
To provide and manage your care and to keep proper business records
Article 6(1)(b), performance of our contract with you, and Article 6(1)(c), our legal obligations for accounting and tax records
Health information: your symptoms, medical history, lifestyle information relevant to treatment, examination findings, treatment notes, consent forms, imaging and reports, and correspondence with your GP or other clinicians
To assess you, plan and deliver chiropractic care, keep clinical records, and refer you on where appropriate
Article 6(1)(b) or 6(1)(f), plus Article 9(2)(h) UK GDPR, processing necessary for the provision of health care and treatment, met in UK law by paragraph 2 of Schedule 1 to the Data Protection Act 2018. See section 4
Call information [ONLY INCLUDE IF CALLS ARE RECORDED]: recordings and notes of calls to and from the clinic and our appointment booking team
To confirm what was agreed, to train our team, and to check the quality of the service
Article 6(1)(f), our legitimate interest in accurate records and service quality. We tell you at the start of the call that it is recorded
Marketing information: your contact details, your marketing preferences, and whether you opened or clicked our messages
To send you clinic news, offers and appointment reminders you have asked for
Article 6(1)(a), your consent, or Article 6(1)(f) where we contact existing patients about similar services, in line with the rules in section 6
Website and device information: IP address, approximate location, device and browser type, pages viewed, how you reached the site, and identifiers set by advertising and analytics tools
To run and secure the website, to understand how it is used, and to measure and improve our advertising
Article 6(1)(f) for information that is strictly necessary to run and secure the site. For everything else, Article 6(1)(a), your consent, given through our cookie banner. See section 7
Reviews and feedback: what you tell us or post about the clinic
To respond to you and to improve the service
Article 6(1)(f), our legitimate interest in understanding and improving the service
Where we rely on legitimate interests, you can ask us for the balancing assessment behind that decision.
If you do not give us information we need to treat you safely, or that we are required by law to record, we may not be able to offer you an appointment. We will tell you at the time if that happens.
If we ever want to use your information for a new purpose that is not covered here, we will tell you first and explain the lawful basis for it.
4. Health information
Information about your health is "special category" information and gets extra protection under the UK GDPR.
We collect it because we cannot assess or treat you safely without it. We rely on Article 9(2)(h) UK GDPR, which allows the processing of health information where it is necessary for medical diagnosis and the provision of health care and treatment. The condition we meet in UK law is paragraph 2 of Schedule 1 to the Data Protection Act 2018. That condition applies because your information is handled by, or under the responsibility of, a health professional who owes a duty of confidentiality, or by another person who owes an equivalent duty.
Everyone at the clinic who can see your clinical records is bound by a duty of confidentiality. Our chiropractors are registered with, and regulated by, the General Chiropractic Council.
We do not collect information about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic or biometric data, or criminal convictions and offences.
5. Children
We treat children at the clinic. Where a patient is under 16 we take health information and consent to treatment from a person with parental responsibility, unless the child is competent to consent for themselves.
For online services, where we rely on your consent, a child aged 13 or over can give that consent themselves. For a child under 13 we need the consent of a person with parental responsibility. This follows Article 8 of the UK GDPR as modified by section 9 of the Data Protection Act 2018.
We do not knowingly collect information through the website from a child under 13 without that consent. If you believe we have, contact us and we will delete it.
6. Marketing
We will only send you marketing emails or texts if you have asked us to, or if you are an existing patient and the marketing is about similar services.
If you are an existing patient we may rely on the "products and services soft opt-in" in regulation 22 of the Privacy and Electronic Communications Regulations 2003. That means we gave you a simple way to say no when we first took your details, and every message we send includes a simple way to opt out.
You can opt out at any time by using the unsubscribe link in any email, replying STOP to any text, or emailing us at [email protected]. We will act on it, and opting out of marketing does not affect appointment reminders or messages about your care.
We do not sell your information, and we do not share it with other organisations for their own marketing.
We may share a secure, hashed version of your email address or phone number with Meta or Google so that we can show our own adverts to you or exclude you from them. We only do this where you have consented. You can object at any time by emailing us.
7. Cookies and similar technologies
This section replaces our previous separate cookie policy. Everything about cookies is now in one place.
How we ask for your consent
Cookies are small files placed on your device when you visit a website. Similar technologies, including tracking pixels and scripts, work in the same way.
When you first visit the site you are shown a cookie banner. Cookies that are strictly necessary to deliver the site and keep it secure are set automatically, because the law does not require consent for those. Everything else, including analytics and advertising, is only set if you accept it. Rejecting is as easy as accepting, and nothing non-essential runs until you have made a choice.
You can change or withdraw your choice at any time using the cookie settings link at our Cookie Control Centre.
You can also block or delete cookies in your browser settings. Some parts of the site may then not work properly. Browser settings are not how we ask for or record your consent. That is done through the banner.
The cookies we use
[VERIFY BEFORE PUBLISHING] The tables below are taken from Civet's GHL Cookie List Setup SOP (v1.0, August 2026), GHL funnel-level section. Booking for this client runs on GHL natively, so no separate booking platform section applies and no TM3, PracticeHub, Jane or Cliniko rows are needed. One step from the SOP still has to be done: open the live funnel, accept all cookies, and check Application then Cookies in DevTools. The GA4 ga<container ID> cookie carries a property-specific suffix that has to be read off the live site rather than typed as the placeholder, and any cookie that does not actually appear should be deleted from the table rather than published.
Strictly necessary. Always on, no consent needed.
Cookie
Set by
What it does
How long it lasts
__cf_bm, __cf_logged_in, cf_clearance, CF_VERIFIED_DEVICE_*
Cloudflare (.cloudflare.com)
Bot management and security checks, confirms the visitor has passed Cloudflare's checks
30 minutes to 1 year
msgsndr_id
GoHighLevel
GoHighLevel's own visitor identifier for the funnel
14 days
cookie-config, current_url
GoHighLevel
GoHighLevel's own site configuration and current-page tracking, required for the funnel to function
1 year
Analytics. Only set if you accept analytics cookies.
Cookie
Set by
What it does
How long it lasts
_ga
Google Analytics 4
Distinguishes unique visitors for Google Analytics
400 days
ga[container ID]
Google Analytics 4
Maintains the current GA4 session state
Session
_gid
Google Analytics 4
Identifies the visitor for session tracking
24 hours
Advertising. Only set if you accept advertising cookies.
Cookie
Set by
What it does
How long it lasts
gclaw
Google Ads
Detects the ad click ID in the web address and stores it, so a booking can be attributed back to the advert that led to it
90 days
gclau
Google Ads
Browser identifier that supports conversion measurement alongside gclaw
90 days
_fbp
Meta (Facebook and Instagram)
Tracks visits across sites to deliver Meta advertising
90 days
_fbc
Meta
Stores the ad click ID so a booking can be attributed to the advert that led to it
90 days
Accepting analytics or advertising cookies means information about your visit is shared with Google or Meta. What they do with it is set out in their own privacy policies, which we do not control. See also sections 8 and 9.
8. Who we share your information with
We share personal information with:
Our clinical and administrative team, and any locum or associate chiropractor treating you
GoHighLevel (LeadConnector), which powers our website forms, appointment booking, calendar, and email and text follow-up, and stores your enquiry and appointment records
[NAME OF WHERE CLINICAL RECORDS ARE HELD], where your clinical notes and treatment records are kept [CONFIRM: if clinical records are held in GoHighLevel, say so and delete this row. If they are on paper or in a separate system, name it]
Our appointment booking team [NAME OF SUPPLIER, for example Civet Media Ltd's Virtual Reception service], who contact enquirers on our behalf to book appointments
Advertising and analytics providers [Meta Platforms, Google], where you have consented to those cookies
Payment providers [NAME]
Your GP or another healthcare professional, where a referral or a report is needed and you have agreed to it
Our accountants, insurers, and professional advisers
Regulators, public bodies and law enforcement, where we are legally required to disclose information
Everyone who processes your information on our behalf is under a written contract that requires them to keep it secure, use it only on our instructions, and use it only for the purposes we have set.
9. Sending information outside the UK
Some of our suppliers are based outside the United Kingdom, or store information outside it. When we transfer your personal information out of the UK we make sure one of the following applies:
the country or the receiving organisation is covered by UK adequacy regulations, which means the UK government has decided it offers an equivalent standard of protection. This includes transfers to US organisations that have self-certified under the UK Extension to the EU-US Data Privacy Framework
we have a contract in place using the ICO's International Data Transfer Agreement, or the ICO's International Data Transfer Addendum attached to the European Commission's standard contractual clauses, supported by a transfer risk assessment
an exception in the UK GDPR applies, for example where the transfer is necessary for a contract with you
You can ask us for details of the safeguards that apply to a specific supplier by emailing [PRIVACY EMAIL ADDRESS].
10. How long we keep your information
Information
How long we keep it
Clinical records, adults
8 years from your last visit, as required by the General Chiropractic Council
Clinical records, children
Until the patient's 25th birthday, or their 26th birthday if they were 17 when treatment ended
Enquiries that do not lead to an appointment
[SUGGESTED: 24 months from your last contact with us, then deleted]
Financial and transaction records
[CONFIRM WITH YOUR ACCOUNTANT: the period required for tax and accounting purposes]
Marketing contact details and preferences
Until you opt out, and then only a record of your opt-out so we do not contact you again
Call recordings [IF USED]
[CONFIRM PERIOD]
Website and analytics information
For as long as the relevant cookie lasts, as set out in the tables in section 7
When we no longer need information we delete it or make it permanently anonymous. Anonymous information may be kept and used indefinitely, because it can no longer identify you.
11. Your rights
You have the right to:
be told how we use your information, which is what this notice is for
ask for a copy of the information we hold about you
have inaccurate information corrected
ask us to delete information, where there is no good reason for us to keep it
ask us to restrict how we use your information while a query is resolved
object to us using your information where we rely on legitimate interests. You have an absolute right to object to direct marketing, and we will stop
ask us to transfer information you gave us to another organisation, where we rely on your consent or on a contract with you and the processing is automated
withdraw consent at any time, where we rely on your consent. Withdrawing it does not affect anything we did before you withdrew it
To exercise any of these rights, email [email protected] or write to us at the address in section 1.
There is no charge. We may ask you for proof of identity before we release information, so that we do not disclose it to the wrong person, and we may ask you to narrow down a broad request. Where we do that, the time limit below pauses until you reply.
We will respond within one month. If your request is complex, or you have made several, we can extend that by up to two months, and we will tell you within the first month if that happens.
We can refuse a request, or charge a reasonable fee, if it is manifestly unfounded or excessive. If we refuse, we will tell you why and tell you how to complain.
12. Complaints
If you are unhappy with how we have handled your personal information, tell us first at [email protected]. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 https://ico.org.uk/make-a-complaint/
You can complain to the ICO at any point. You do not have to come to us first, although we would like the chance to put it right.
13. Other websites
Our website contains links to other websites, and may include plug-ins or embedded content from them. We are not responsible for how those sites handle your information. Read their privacy notices before you use them.
14. Changes to this notice
We review this notice regularly. Any change takes effect from the date at the top of this page. If a change materially affects how we use your information, we will tell you directly.