Privacy Policy | CMC Osteopathy

Last updated: 15 September 2026

CMC Osteopathy (“we”, “us” or “our”) is a private osteopathy clinic based in England.

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and protect personal information when you use our website, contact us, or book and receive osteopathy services from us.

1. Who is responsible for your information?

The data controller responsible for your personal information is:

CMC Osteopathy
Owner: Connor McCarthy
Address: 28 Wittersham Close, ME5 7NA
Email: connormccarthy@cmc-osteopathy.co.uk
Website: https://www.cmc-osteopathy.co.uk

If you have any questions about how we use your personal information, please contact us using the details above.

2. Information we collect

Information provided when booking or receiving treatment

Appointments are booked through Jane, our online clinic booking and management platform.

Depending on your interaction with us, we may collect information such as:

your name;
contact details, such as your telephone number, email address and address;
appointment and booking information;
payment and billing information where applicable;
information about your health, symptoms, medical history and treatment;
information contained within your clinical/patient records; and
other information you provide to us that is relevant to your care.

Health information is treated as particularly sensitive information and is handled with appropriate confidentiality and security.

Jane provides the online booking and clinic-management platform. Jane’s privacy notice explains how Jane processes information through its platform. Your clinic/practitioner remains responsible for your patient information held through Jane.

You can read Jane’s Privacy Notice on its website.

3. Information collected through our website

Our website is primarily an information website.

We do not currently provide an online payment facility through our website and we do not currently operate a marketing email subscription.

Our website contains links to external services, including Jane for appointment booking and WhatsApp for communication.

If you follow one of these links, your information may be processed by that third-party service under its own privacy policy and terms.

4. How we use your information

We use personal information where necessary to:

provide osteopathy services to you;
arrange and manage appointments;
communicate with you about appointments and treatment;
maintain accurate and appropriate patient records;
provide safe and appropriate healthcare;
respond to enquiries and communications;
process payments where applicable;
comply with legal, regulatory and professional obligations;
maintain the security of our services and systems; and
deal with complaints, legal claims or insurance matters where necessary.

We do not use your personal information for direct marketing unless we have a lawful basis to do so and, where required, your consent.

5. Our lawful bases for using your information

Depending on the circumstances, we rely on one or more of the following lawful bases under UK data protection law:

Contract: where processing is necessary to arrange or provide services to you.
Legal obligation: where we need to process information to comply with a legal or regulatory requirement.
Legitimate interests: where processing is necessary for the legitimate operation and administration of the clinic, provided those interests are not overridden by your rights.
Health and social care purposes: where we process health information as necessary for the provision and management of healthcare and treatment, in accordance with applicable data protection law.
Consent: where we specifically ask for your consent and consent is the appropriate lawful basis.

Where we process information concerning your health, we apply the additional protections required for special category personal data.

6. Who we share information with

We only share personal information where there is a lawful reason to do so and only where reasonably necessary.

Depending on the circumstances, this may include:

Jane, our clinic-management and appointment-booking provider;
payment providers where applicable;
other healthcare professionals where necessary for your care and where appropriate;
insurers, professional advisers or legal representatives where necessary;
regulatory or law-enforcement bodies where we are legally required to provide information; and
technology and service providers who help us operate our business.

We do not sell your personal information.

Where information is shared with another healthcare professional, we will normally seek your consent unless there is another lawful reason to share it, such as where disclosure is necessary to protect your vital interests or is otherwise required or permitted by law.

7. Jane

We use Jane to provide online appointment booking and clinic-management services.

Jane states that clinics and practitioners control their patients’ information, including contact information, billing details and patient records, while Jane provides the technology platform used to manage that information.

You can read Jane’s current Privacy Notice here:

https://jane.app/legal/privacy-notice

If you have questions about your patient information held by CMC Osteopathy, please contact us directly.

8. WhatsApp

We may use WhatsApp to communicate with patients where you choose to contact us through WhatsApp.

WhatsApp is operated by Meta. Information sent through WhatsApp is subject to WhatsApp’s own terms and privacy policies.

Please avoid sending highly sensitive medical information through WhatsApp unless it is necessary and you are comfortable doing so.

9. Google Maps

Our website may display or link to Google Maps to help visitors find our clinic locations.

Google may process information when its services are loaded or used. Where applicable, Google Maps and associated non-essential technologies will be subject to our cookie-consent settings.

10. Cookies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to function correctly, maintain security or remember essential settings. These may be used without consent where permitted by law.

Other cookies or similar technologies, such as analytics or certain third-party technologies, are not essential and will only be used where the appropriate consent has been obtained.

For more information, please see our Cookie Policy.

You can change or withdraw your cookie choices using the cookie settings available on our website.

11. How long we keep information

We keep personal information only for as long as it is reasonably necessary for the purposes for which it was collected, taking account of our legal, regulatory, professional and insurance obligations.

Patient/clinical records will normally be retained for at least eight years after your last consultation. Where the patient is a child, records will normally be retained until the patient’s 25th birthday, in accordance with current General Osteopathic Council guidance.

Some information may need to be retained for longer where this is necessary because of legal claims, regulatory requirements, insurance requirements or other legal obligations.

When information is no longer required, it will be securely deleted or disposed of.

12. Keeping your information secure

We take reasonable and appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Access to patient information is limited to people who need it for legitimate professional or business purposes.

No method of transmitting or storing information can be guaranteed to be completely secure, but we take appropriate steps to reduce the risks.

13. Your data protection rights

Depending on the circumstances and subject to legal exemptions, you may have rights under UK data protection law, including the right to:

ask for access to the personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to restrict how we use your information;
object to certain processing;
ask for your information to be deleted where there is no lawful reason for us to continue holding it; and
withdraw consent where we rely on consent as our lawful basis.

Some rights do not apply in every circumstance. For example, information that we are required to retain for legal, regulatory or professional reasons may not be capable of being deleted simply because you request deletion.

If you wish to exercise any of your rights, please contact us using the details at the top of this Privacy Policy.

14. Complaints

If you have concerns about how we have handled your personal information, please contact us first so that we have an opportunity to address your concerns.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection.

The ICO website is:

https://ico.org.uk/

15. Third-party websites

Our website contains links to third-party websites and services, including Jane, WhatsApp, Google and other services.

We are not responsible for the privacy practices, content or security of third-party websites. We recommend reviewing their privacy policies before providing them with personal information.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or how we process personal information.

The latest version will always be available on our website.

Last updated: 15 September 2026