Privacy Policy

1. Who we are

Gayle Hocking Health (“we”, “us”, “our”) provides osteopathy, cranial osteopathy, somatic movement teaching, Vitafield HILDA diagnostic services, and on‑demand recorded somatic classes. Gayle Hocking is the data controller responsible for your personal data.

• Email: gayle@gaylehockinghealth.co.uk
• Phone: 07788 710 677
• Location: Virginia Water / Runnymede, Surrey
• Registered office: 6A Beer Road, Seaton, EX12 2PA · Company No. 16733238
• ICO registration number: 00011977332

2. What this policy covers

This policy explains how we collect, use, store and protect your personal information when you visit our websites (gaylehockinghealth.co.uk and ondemand.gaylehockinghealth.co.uk), book or attend appointments, purchase on‑demand classes, or contact us. It is provided in accordance with the UK GDPR and the Data Protection Act 2018.

3. The information we collect

• Identity & contact data — name, email, phone, postal address, date of birth.
• Health data (special category data) — medical history, symptoms, treatment records, clinical notes and information you share during consultations. This is necessary to provide safe osteopathic care.
• Booking data — appointment details, history and correspondence (managed via our booking system).
• Payment data — handled securely by our third‑party payment processor for both in‑clinic and on‑demand payments. We do not store full card details.
• Account & purchase data (on‑demand classes) — your email and a record of classes you have purchased.
• Technical & usage data — IP address, browser/device information and cookie data when you use our sites (see our Cookie Policy).
• Marketing preferences — whether you have consented to receive updates from us.

4. How we use your information and our lawful bases

Under the UK GDPR we must have a lawful basis to use your personal data. Where we process special category (health) data, we rely on an additional condition under Article 9.

You can withdraw consent (for example, for marketing) at any time, without affecting the care we provide.

5. Clinical records and professional standards (GOsC)

As a registered osteopath, Gayle is bound by the General Osteopathic Council’s Osteopathic Practice Standards, including the duties of confidentiality and proper record‑keeping. Your clinical records are kept securely and confidentially, and are shared only where you consent or where we are legally or professionally required to do so.

6. Marketing and advertising standards (ASA / CAP)

Any marketing we send is intended to be legal, decent, honest and truthful, in line with the UK Code of Non‑broadcast Advertising (the CAP Code), enforced by the Advertising Standards Authority (ASA). We only make health claims we can substantiate, we do not target vulnerable individuals, and any testimonials are genuine and used with consent. Every marketing email includes a clear and easy way to unsubscribe.

7. Cookies and analytics

Our websites use cookies for essential functionality and, where required, with your consent. You can manage your choices through our cookie banner and your browser settings. For full details, please see our Cookie Policy.

8. Who we share your data with

We use trusted third‑party providers (“processors”) under contract, who act only on our instructions. By category, these include:

• Clinical records & online booking software — to manage appointments and patient records.
• Email marketing software — to send updates to those who have opted in.
• Accounting & invoicing software — to manage payments and bookkeeping.
• A secure payment processor — for in‑clinic and on‑demand payments.
• A transactional email provider — for service emails, such as class access links.
• Website hosting, database & content-delivery providers — to run our websites securely.
• A video-hosting provider — for our free introductory videos.
• Our business bank — into which payments settle.
• Professional advisers (such as our accountant and insurer) and regulators, where we are legally required to share information.

We never sell your personal data.

9. International transfers

Some of our providers may process data outside the UK. Where they do, we ensure appropriate safeguards are in place — such as UK adequacy regulations or the Information Commissioner’s International Data Transfer Agreement (IDTA) or Addendum to the EU Standard Contractual Clauses.

10. How long we keep your data

• Clinical / osteopathic records: retained in line with GOsC and professional indemnity guidance — generally at least 8 years after your last treatment for adults, and for children until their 25th birthday (or 8 years after the last contact, whichever is longer).
• Booking, payment and tax records: retained as required by law (typically 6 years).
• Marketing data: retained until you unsubscribe or ask us to stop.

11. How we protect your data

We use appropriate technical and organisational measures — including secure, access‑controlled systems, encryption in transit, and reputable processors — to keep your information safe and to prevent unauthorised access, loss or misuse.

12. Your rights

Under the UK GDPR you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected;
• request erasure of your data (subject to our legal record‑keeping duties);
• restrict or object to our processing;
• data portability; and
• withdraw consent at any time.

To exercise any of these rights, please contact gayle@gaylehockinghealth.co.uk. We will respond within one month.

13. Complaints

If you have any concerns about how we handle your data, please contact us first so we can put things right. You also have the right to complain to the Information Commissioner’s Office (ICO) — ico.org.uk · 0303 123 1113.

14. Use of artificial intelligence (AI)

We use artificial intelligence (AI) in a limited and transparent way. Some images on our websites are original photographs, taken and used with consent, that have been subtly animated using AI to add gentle movement. We do not use AI to make decisions about your care, we do not use AI to process your health information, and we do not use AI chatbots to interact with you. Where we use AI to help prepare general (non‑personalised) educational or exercise material, no personal or health information is entered, and all content is reviewed by Gayle before use. If our use of AI changes, we will update this policy and provide any disclosures required by law.

15. Changes to this policy

We may update this policy from time to time. The latest version will always appear on this page, with the “last updated” date shown above.