Privacy PolicY

Version 1.0, 9 September 2026 

1.1 Nadine Chiro Limited, trading as Nadine Cheli, is the controller of the personal information described in this policy. We are a company registered in England and Wales with company number 14392706, and our registered office is at 6 Mendip Way, Corby, England, NN18 8GJ.

1.2 You can contact us about anything in this policy by email at nadine@nadinechiro.com or by post at Mrs Nadine Cheli, Summertown Clinic, 362 Banbury Road, Summertown, Oxford, OX2 7PP 

1.3 We are registered with the Information Commissioner’s Office under registration reference ZB480521.

1.4 Nadine Cheli is a chiropractor registered with the General Chiropractic Council, registration number 04030, and is subject to a professional duty of confidentiality.

1.5 This policy covers both of our services, chiropractic care and movement coaching. Where something applies to only one of them, we say so.

2.1 Most of the information we hold comes directly from you: when you enquire, book, complete a health questionnaire or consent form, attend an appointment or a session, email or message us, pay us, sign up for a free resource, or use our website.

2.2 We also receive information from:

• Summertown Clinic, where you book a chiropractic or in-person coaching appointment through the clinic;

• your GP or another healthcare professional, where you have asked us to obtain or share information;

• a parent or guardian, where you are under 18;

• our payment providers, who confirm to us that a payment has been made; and

• our website and platform providers, in the form of technical and usage information.

3.1 To provide chiropractic care we collect and use:

• your name, address, date of birth, contact details and emergency contact details;

• your health information, including your symptoms, medical history, medication, allergies, test and imaging results, lifestyle information, our examination findings, our working diagnosis, the care we provide and the advice we give;

• records of the consent you give;

• correspondence between us; and

• payment information.

3.2 To provide movement coaching we collect and use:

• your name, contact details and, for live sessions, your telephone number;

• the health screening information you give in our health and participation questionnaire, including conditions, injuries, symptoms, surgery, pregnancy, allergies and medication;

• your goals, our observations of your movement, and the coaching we provide;

• recordings of one-to-one online sessions and of live group sessions, which may include your image and voice if you choose to appear;

• the exercise programmes we prescribe for you;

• messages you send us and we send you, including WhatsApp messages and voice notes, where you buy that service;

• records of the consent you give; and

• payment information.

3.3 We also collect and use:

• your name and contact details, and your marketing preferences, to send you information about our services where you have asked us to, and to send you free resources you have requested;

• your name, contact details and the details of your concern, to deal with enquiries, complaints and claims;

• records of payments, invoices and receipts, to run our business and meet our accounting and tax obligations; and

• technical and usage information about your visit to our website. Section 11 explains our use of cookies.

4.1 Under data protection law we must have a lawful basis for using your personal information. Ours are as follows.

4.2 To provide our services to you, we rely on contract, because we need the information to enter into and perform our contract with you.

4.3 For your health information in connection with chiropractic care, which is special category information and has extra protection, we rely on Article 9(2)(h) of the UK GDPR, the provision of health care and treatment by a health professional who is subject to a duty of confidentiality, together with the condition in paragraph 2 of Schedule 1 to the Data Protection Act 2018. We maintain the appropriate policy document that this condition requires, and a copy is available on request.

4.4 For the health screening information you give us for movement coaching, we rely on your explicit consent, under Article 9(2)(a). We ask for that consent when you complete the questionnaire. You may withdraw it at any time, although if you do we will not be able to continue coaching you safely and will have to stop.

4.5 To keep records, to defend ourselves and to bring or respond to legal or regulatory claims, we rely on our legitimate interests and, for special category information, on Article 9(2)(f), the establishment, exercise or defence of legal claims.

4.6 To meet our legal obligations, including our accounting and tax obligations and our professional record-keeping obligations, we rely on legal obligation.

4.7 To send you marketing and to provide free resources you have asked for, we rely on your consent, and on our legitimate interests in telling existing clients about services similar to those we have already provided. You can withdraw your consent or object at any time, using the unsubscribe link in any message or by contacting us.

4.8 In an emergency, where it is necessary to protect your life or someone else’s and you cannot give consent, we rely on vital interests, under Articles 6(1)(d) and 9(2)(c).

4.9 To improve our services and run our business, we rely on our legitimate interests in operating and developing a safe and effective practice. We have considered your rights and interests in reaching this view, and you can object at any time.

5.1 As well as data protection law, we are bound by a professional duty of confidentiality in relation to your health information.

5.2 We will disclose confidential health information only where you have consented, where the law requires it, including a court order, where it is necessary to protect you or someone else from serious harm, or where the public interest in disclosure outweighs the duty of confidence, for example a serious safeguarding concern.

6.1 We share personal information with:

• Summertown Clinic, in relation to bookings, attendance and payment for appointments at the clinic, and in relation to the clinical records held on the clinic’s system;

• our software and service providers, who process information on our instructions, and which are listed at section 12;

• other healthcare professionals, including your GP, where you ask us to or consent to it;

• our accountant, insurers, insurance brokers and professional advisers;

• regulators and other authorities, including the General Chiropractic Council and the Information Commissioner’s Office, where we are required or entitled to do so; and

• emergency services and safeguarding bodies, where clause 5.2 applies.

6.2 We do not sell your personal information, and we do not share it for anyone else’s marketing.

7.1 Some of our providers are based outside the United Kingdom, or store information outside it. Where that happens we make sure that your information is protected to the standard required by UK data protection law, either because the country has UK adequacy regulations, or by using the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with any additional safeguards needed.

7.2 You can ask us for details of the safeguards that apply to any particular transfer.

8.1 Chiropractic clinical records: at least eight years from the date of your last appointment. Where you were under 18 when you were first seen, until your 25th birthday. This reflects the requirements that apply to registered chiropractors.

8.2 Movement coaching records, including your health and participation questionnaire and our coaching notes: six years from the end of our work with you, which reflects the period during which a claim might be brought.

8.3 Recordings of one-to-one online sessions: at least 12 months from the session, after which we review and delete them once they are no longer needed.

8.4 Recordings of live group sessions: for as long as we make the relevant run of the programme available to participants, and in any event at least 12 months from the start date.

8.5 Consent records: for as long as we hold the information the consent relates to, and for six years afterwards.

8.6 Accounting and payment records: six years from the end of the financial year to which they relate.

8.7 Marketing information: until you unsubscribe or withdraw your consent, and we review our marketing list every two years.

8.8 Enquiries that do not lead to a booking: we review enquiry correspondence periodically and delete it once it is no longer needed, and in any event within two years.

8.9 When a retention period ends we delete the information securely, or anonymise it so that it can no longer be linked to you.

9.1 We keep your information on password-protected, access-controlled systems, we use providers who offer appropriate security, we limit access to those who need it, and we take care over how we send information to you and to others.

9.2 No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours, and we will tell you if the risk to you is high.

10.1 You have the right to:

• access the personal information we hold about you, and ask for a copy;

• ask us to correct information that is inaccurate or incomplete;

• ask us to delete information, although we cannot delete clinical records we are required to keep;

• ask us to restrict how we use your information;

• object to our using your information where we rely on legitimate interests, and to object at any time to direct marketing;

• ask us to transfer information you gave us to you or to another organisation, where we rely on consent or contract and the information is held electronically; and

• withdraw your consentat any time, where we rely on consent. Withdrawing consent does not affect anything we did before you withdrew it.

10.2 To exercise any of these rights, contact us at hello@nadinecheli.com. We will respond within one month, and we will tell you if we need longer because your request is complex.

10.3 There is no charge, unless a request is manifestly unfounded or excessive.

10.4 We do not make any decision about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.

11.1 Our website uses cookies and similar technologies. Cookies that are strictly necessary for the site to work are set automatically. Any other cookie, including anything used for analytics or advertising, is set only with your consent, which you give through the banner on the site and can withdraw at any time through the same banner or your browser settings.

11.2 [To be completed with the list of cookies the finished site actually sets, what each does and how long it lasts.]

12.1 The following providers process personal information on our behalf, under written terms that meet the requirements of Article 28 of the UK GDPR:

• Nookal, our clinic records and booking system, which holds clinical records;

• Rehab My Patient, which we use to prescribe exercise programmes;

• Funnel Sketchers, our course platform and customer relationship system, which holds forms, questionnaires and course content;

• Zoom, which we use for online sessions and which holds session recordings;

• WhatsApp, which we use for messaging support where you buy it;

• Google, whose Workspace services we use for email, file storage and forms;

• Stripe and SumUp, which process payments; and

• our website provider.

12.2 Some of these providers are based outside the United Kingdom or hold information outside it, and section 7 explains how those transfers are protected. You can ask us at any time for the current list and for details of where each provider holds information.

13.1 If you have a concern about how we use your personal information, please tell us first, at nadine@nadinechiro.com We will look into it and respond.

13.2 You also have the right to complain to the Information Commissioner’s Office at any time:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Helpline: 0303 123 1113

Website: www.ico.org.uk/make-a-complaint

14.1 We may update this policy. The current version is available at www.nadinechiro.com and we will tell you about any significant change that affects you.

Version 1.0, 9 September 2026 

Nadine Chiro Limited trading as Nadine Cheli

Required by Schedule 1, Part 4, paragraphs 39 and 40 of the Data Protection Act 2018

Version 1.0, 9 September 2026

Review date: 9 September 2027

1.1 We process special category personal data, principally health information about our chiropractic patients and health screening information about our movement coaching clients.

1.2 Where we rely on the condition in paragraph 2 of Schedule 1 to the Data Protection Act 2018, health or social care purposes, paragraph 39 of Part 4 of Schedule 1 requires us to have an appropriate policy document in place explaining how we comply with the data protection principles and what our retention and erasure policies are. This is that document.

1.3 We keep this document under review, we retain it until six months after we stop the processing it covers, as paragraph 40 of Part 4 of Schedule 1 requires, and we make it available to the Information Commissioner on request.

2.1 Categories of data: health data, including symptoms, medical history, medication, allergies, examination findings, working diagnosis, treatment, advice, test and imaging results, and health screening responses.

2.2 Data subjects: chiropractic patients, movement coaching clients, and where relevant their parents or guardians.

2.3 Purposes: providing chiropractic care and movement coaching, keeping accurate clinical and coaching records, communicating with patients and clients, meeting our professional and legal obligations, and establishing, exercising or defending legal claims.

2.4 Article 6 basis: contract, legal obligation, legitimate interests and, in an emergency, vital interests.

2.5 Article 9 condition: Article 9(2)(h), health care and treatment provided by a health professional subject to a duty of confidentiality, together with paragraph 2 of Schedule 1 to the Data Protection Act 2018. We also rely on Article 9(2)(a) explicit consent for movement coaching health screening, Article 9(2)(f) for legal claims, and Article 9(2)(c) in an emergency.

2.6 Nadine Cheli is a health professional as defined in section 204 of the Data Protection Act 2018, and is subject to the professional duty of confidentiality owed by a registered chiropractor.

3.1 Lawfulness, fairness and transparency. We identify a lawful basis and, for special category data, a condition, before we process. We give patients and clients our privacy policy, and we explain at the point of collection what we are collecting and why.

3.2 Purpose limitation.We use health information only for the purposes in paragraph 2.3. If we ever wish to use it for a new purpose, we check that the new purpose is compatible, and if it is not we obtain consent or identify another lawful basis first.

3.3 Data minimisation.We collect only the information we need in order to provide care or coaching safely. Our health questionnaires are reviewed to make sure each question earns its place.

3.4 Accuracy. We record information at or close to the time of the appointment, we check key details with the patient or client, and we correct errors promptly when they are identified or pointed out to us.

3.5 Storage limitation.We keep health information for the periods in paragraph 4 and then delete it securely.

3.6 Integrity and confidentiality. Health information is held on access-controlled systems with individual credentials. Access is limited to those who need it. Devices are encrypted and password-protected. We use providers who offer appropriate technical and organisational security, and we put written processing terms in place with them. We do not send health information by unencrypted means where a more secure route is available.

3.7 Accountability. We keep a record of our processing activities, we document consent, we assess new tools and providers before adopting them, we deal with data subject requests within the statutory period, and we have a procedure for recognising and reporting personal data breaches, including reporting to the Information Commissioner within 72 hours where the breach is reportable.

4.1 Chiropractic clinical records: at least eight years from the date of last appointment, and where the patient was under 18 at first attendance, until their 25th birthday.

4.2 Movement coaching records, including health screening: six years from the end of the client relationship.

4.3 Consent records: for as long as we hold the information to which the consent relates, and for six years afterwards.

4.4 Records held for the purpose of legal or regulatory claims: until the relevant limitation or regulatory period has expired.

4.5 At the end of the retention period, records are deleted from live systems and from backups in the ordinary backup cycle, or anonymised.

4.6 Chiropractic clinical records are created and held on the records system operated at the clinic where we practise. We remain the controller of those records and remain responsible for retaining them for the periods above. Where we cease to practise at that clinic, we will make arrangements to obtain and retain a copy of the records for which we are responsible before access ends.

5.1 Nadine Cheli is responsible for compliance with this document, and for reviewing it at the review date above or sooner if our processing changes.