Privacy Notice.
Motion Works Chiropractic
Privacy Notice
Last updated 27 September 2026
This notice explains how we collect, use, keep and share personal information when you visit our website, contact us, use our patient portal or receive chiropractic care. It also explains your choices and how to raise a concern.
Who we are and how to contact us
HGW CHIRO LIMITED, trading as Motion Works Chiropractic, is the controller of your personal information. This means we decide why and how it is used for our clinic services.
Privacy contact: Harry Whitaker
Email: hello@mwchiro.co.uk
Telephone: 01904 900 123
Correspondence address: Welton House, 30 Burnby Lane, Pocklington, York, YO42 2QD
Our clinic is at The Padel Farm, Sutton-on-the-Forest, York. The address above is our correspondence address. Please use the contact details above for privacy questions, rights requests or complaints.
The information we use
We collect only information relevant to the service, enquiry or obligation involved. Depending on your circumstances, this includes:
• Identity and contact information: your name, address, date of birth, telephone number, email address, relevant sex or gender information, preferred form of address, emergency contact details and your NHS number where relevant to identifying you and coordinating your care.
• Care information: symptoms, medical and surgical history, medication, allergies, relevant lifestyle and activity information, examination findings, assessments, treatment plans, consent records, rehabilitation progress, referrals and relevant test or imaging reports. Clinical photographs may form part of your record where appropriate and explained to you.
• Booking and payment information: appointments, attendance, charges, invoices, payment status and payment references. Stripe handles card processing; our clinic systems may display limited card details or payment tokens.
• Communications and administration: enquiries, correspondence, portal account details, marketing preferences, consent records, complaints, incident reports and information needed for legal claims. We do not record telephone calls.
• Website information: technical information such as IP address, browser or device details, access logs and information you submit through online forms. See the website section below for more details.
Health information receives additional protection under data protection law. Please avoid sending unnecessary medical details through a general website contact form; we can explain how to provide relevant information for your care.
Why we use your information
UK data protection law requires a lawful basis for each use of personal information. We use the bases below according to the activity involved, rather than applying every basis to every use.
Providing care and patient portal services
We use information to arrange appointments, assess and treat you, provide rehabilitation advice, manage payments, communicate about your care and operate your patient portal. Our basis is Contract where this is necessary to provide the service you request or take steps at your request before providing it (Article 6(1)(b)).
Where another person, such as a parent, makes the contract, we may instead rely on Legitimate interests for the patient's information: providing and administering the requested care safely, while protecting the patient's rights. We assess and document that balance.
Keeping clinical records and managing the practice
We rely on Legitimate interests for retaining necessary records after treatment and for appropriate clinical administration, service improvement and security. Our interests are continuity and safety of care, accountability and protecting the clinic and patients in a dispute. Where a specific legal obligation requires processing, we rely on Legal obligation instead.
Safeguarding and emergencies
We rely on Recognised legitimate interest for necessary safeguarding of children and adults who meet the statutory definition of being at risk (Article 6(1)(ea)). This can involve sharing relevant information to protect them from harm or neglect. Where disclosure is specifically required by law, we rely on Legal obligation. In a life-threatening emergency, Vital interests may apply.
Legal requirements and complaints
We rely on Legal obligation for processing required by law, including required tax records and binding court orders (Article 6(1)(c)). For general enquiries, complaints and legal claims, we rely on Legitimate interests in responding fairly, investigating concerns and establishing, exercising or defending our rights (Article 6(1)(f)). Contract applies where an enquiry is necessary to arrange or deliver your care.
Marketing and feedback
We may email or text you about our own similar services where we collected your contact details directly during a purchase or genuine discussions about buying our services, offered a clear and simple opt-out when collecting them, and you did not opt out. We include an easy opt-out in every marketing message. This is the PECR soft opt-in; our UK GDPR basis is Legitimate interests in promoting relevant services to existing or prospective patients, balanced against your rights. Where these conditions are not met, we obtain opt-in Consent before electronic marketing. You can opt out at any time without affecting care. Necessary appointment and care messages are separate. We do not use clinical information to target marketing without explicit consent.
Website operation
Our basis for necessary website delivery and security is Legitimate interests in operating a reliable, secure service. Information submitted in an enquiry is used under Contract or Legitimate interests as described above. Technologies requiring consent are used only with that consent
Additional protection for health information
Alongside an Article 6 lawful basis, we use an additional condition for health information:
• Clinical care, clinical records and related patient portal functions: Article 9(2)(h), health or social care, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Processing is by, or under the responsibility of, a health professional subject to confidentiality obligations.
• Safeguarding: where its requirements are met, Article 9(2)(g), substantial public interest, with Schedule 1, Part 2, paragraph 18 for safeguarding children and individuals at risk. This includes the condition's limits on obtaining consent and the required appropriate policy document. The healthcare condition may apply where the activity forms part of providing care.
• Legal claims: Article 9(2)(f), where necessary to establish, exercise or defend legal claims. Routine care-related complaint handling may instead fall within the healthcare condition.
• Life-threatening emergencies: Article 9(2)(c), where necessary to protect vital interests and the person is physically or legally incapable of giving consent.
If another use requires explicit consent, we ask for it separately. Consent to examination or treatment is different from consent as a data protection basis. Withdrawing treatment consent does not automatically require us to erase records we still have a lawful reason to keep.
Where information comes from
• You, through appointments, telephone calls, emails, website enquiries, online booking, registration forms and the patient portal.
• Our own clinical observations, assessments, treatment notes and progress reviews.
• Parents, people with parental responsibility, family members, carers or authorised representatives, where appropriate.
• Other healthcare professionals, such as GPs and consultants, through relevant referrals, correspondence or reports.
• Insurers, professional advisers or relevant authorities where necessary for an authorised insurance matter, complaint, claim, legal obligation or safeguarding concern.
When someone gives us information about another person, we ask them to provide only what is necessary and, where appropriate, make that person aware of this notice.
If you do not provide information
You can choose not to provide information. However, without information needed to identify you, assess you safely, arrange your appointment or take payment, we may be unable to provide some or all of our services. We will explain this. Receiving marketing is never a condition of treatment.
Who we share information with
We share only what is necessary for the relevant purpose. Access within the clinic is limited to people who need the information for their work and are subject to confidentiality obligations.
• PracticeHub, operated by Zyricon Limited: our practice management provider for bookings, forms, clinical records, patient portal functions, communications and billing.
• Google Workspace: our email hosting and communications provider, including patient enquiries and correspondence.
• Stripe: our payment services provider. Stripe processes some information on our behalf and acts as an independent controller for activities such as fraud prevention and compliance with financial law.
• Framer: our website hosting provider, including technical operation and any website forms it processes for us.
• Other healthcare professionals when appropriate for your care; insurers where necessary for an authorised insurance matter; and professional advisers such as our accountant, solicitor or indemnity insurer when needed.
• Safeguarding organisations, courts, regulators and other authorities where disclosure is legally required or otherwise lawfully justified.
Accountants receive relevant financial information rather than routine access to clinical notes. Renting premises at The Padel Farm does not give the landlord access to your patient records.
Confidentiality and protecting your information
Clinical information is also protected by our professional and common law duties of confidentiality. We obtain and record express consent for referrals and disclosures to other healthcare providers, unless a legal requirement or justified exception permits disclosure without consent.
Where disclosure without consent is necessary, we assess the circumstances, limit what is shared and record our reasons. We tell you where appropriate, unless doing so would be unlawful or could increase a risk of harm or prejudice a relevant investigation.
We use appropriate organisational and technical measures to protect information, including access restrictions, secure handling of records and suitable contractual arrangements with processors. No online system can be guaranteed completely secure. Please contact us promptly if you believe your information has been lost, accessed or disclosed improperly.
Website forms and cookies
Our website is hosted using Framer. Technical information is processed to deliver and protect the website. Framer's built-in analytics is designed to provide website usage statistics without tracking cookies or persistent visitor identifiers. Enquiry forms collect the information you choose to enter so we can respond.
Booking, payment or other third-party features may involve their own technologies and privacy information. Where we use optional cookies or similar technologies requiring consent, we explain their purposes and providers and obtain consent before they run. You can change those choices through the available consent controls. Necessary service technologies may operate without consent where permitted by law.
Information processed outside the UK
Some of our providers and their suppliers are based outside the UK or process information internationally. An overseas provider's registered address is not necessarily the location of its servers. Transfers and overseas access must have a lawful transfer mechanism where required.
PracticeHub
PracticeHub provides our practice management services. UK-based hosting or support does not necessarily mean that all processing stays within the UK. Its public website identifies the operator as Zyricon Limited in Cyprus. Where information is transferred to that Cyprus entity, UK adequacy regulations for the European Economic Area apply. Any onward restricted transfers require an applicable adequacy decision or appropriate contractual safeguards. We can provide further information about the hosting and access arrangements applicable to our account on request.
PracticeHub Trust Centre — link to be added once the current URL for our account is confirmed.
Google Workspace
For standard UK business accounts, the contracting provider is Google Cloud EMEA Limited in Ireland. Transfers to Ireland are covered by UK adequacy regulations. Google also uses international infrastructure and subprocessors. Google's published Workspace arrangements rely on the UK Extension to the EU-US Data Privacy Framework for covered transfers to Google LLC in the United States and provide contractual safeguards for other restricted transfers as applicable.
Google international transfer arrangements
Google Workspace subprocessors
Stripe
Stripe's standard data processing agreement for UK accounts is with Stripe Payments Europe, Limited in Ireland, and its services include US and other international processing. Transfers to Ireland are covered by UK adequacy regulations. For covered transfers to Stripe, LLC in the United States, Stripe relies on the UK Extension to the EU-US Data Privacy Framework. Its transfer addendum also provides EU Standard Contractual Clauses with the UK Addendum where applicable.
Stripe international transfer arrangements
Framer
Framer uses international hosting and service providers. Its published data processing terms provide for adequacy mechanisms, including the UK Extension to the EU-US Data Privacy Framework where the recipient and transfer qualify, and contractual safeguards including the UK Addendum to the EU Standard Contractual Clauses where required.
Framer data processing and transfer terms
You can contact us for further information about destinations and the safeguards relevant to your information, or to request a copy of the applicable safeguards. We may redact confidential commercial information while providing a meaningful explanation of the protection available to you.
How long we keep information
We keep identifiable information only as long as necessary for its purpose. The periods and criteria below guide our retention and secure disposal. The same information may form part of more than one record; the relevant clinical or legal requirement takes priority over routine administrative deletion.
Clinical records
Adult records: eight years from the date of the last visit. Records of patients treated as children: until their 25th birthday, or 26th birthday if they were 17 when treatment ended. Later adult care is subject to the adult period. Relevant clinical correspondence, forms, consent records and reports follow the clinical record period.
Financial records
Invoices, receipts and company accounting records: six years from the end of the last company financial year they relate to, or longer where tax law or an ongoing HMRC enquiry requires it. Payment providers may retain their own records under separate legal obligations.
General enquiries and administration
Enquiries that do not lead to care: normally up to 12 months after the last substantive contact. If an enquiry becomes part of your care, complaint or claim, it follows the relevant retention period. Routine duplicate correspondence is deleted when no longer needed, after relevant information has been retained in the appropriate record.
Complaints and legal claims
Standalone complaint records: normally six years after closure. Material relevant to clinical care follows the clinical record period if longer. For actual or reasonably anticipated claims, investigations or safeguarding matters, we retain relevant material until the matter and any applicable appeal or limitation period have ended, with periodic review of the continuing need.
Marketing records
Marketing contact details are retained while valid consent or the soft opt-in applies and use remains necessary and appropriate. We review inactive marketing contacts after two years without meaningful engagement. If you unsubscribe, we stop promotional contact and keep only the minimum suppression information needed to respect your choice. Evidence of consent, soft opt-in eligibility and opt-out choices is retained only as long as needed to demonstrate compliance or address a dispute.
Website and system records
Identifiable technical and security logs are retained for the period needed to operate the service, investigate security incidents and meet applicable obligations, taking account of the provider's configured retention and backup cycles. Information submitted through forms follows the enquiry or clinical retention period. Anonymous statistics that no longer identify anyone are outside these personal-data retention periods.
We may extend retention where a specific legal requirement, documented professional indemnity requirement or ongoing dispute justifies it. We record the reason and review it. Records are securely deleted or anonymised when no longer required; backup copies expire through the provider's controlled backup cycle and are not used for routine purposes.
Your rights and choices
Depending on the circumstances and the lawful basis, you may ask us to:
• Give you access to your information and a copy of it.
• Correct inaccurate information or complete information that is incomplete. We may retain an audit trail of corrections to clinical records.
• Erase information where we no longer have a lawful reason to keep it.
• Restrict our use of information in specified circumstances.
• Transfer information you provided in a portable format where processing is automated and based on consent or contract.
You may object to processing based on legitimate interests or recognised legitimate interest. You have an absolute right to object to direct marketing. Where we rely on consent, you may withdraw it at any time; this does not affect the lawfulness of earlier processing.
These rights have legal limits. For example, a request to delete information does not automatically override necessary clinical record retention or the defence of a legal claim. We will explain any restriction or refusal and how you can challenge it.
Contact us using the details at the start of this notice. We may reasonably verify your identity or a representative's authority. We normally respond without undue delay and within one month. Where the law permits an extension or a pause for necessary clarification or identity information, we explain the position and applicable timescale. Requests are normally free of charge.
Children and young people
In simple terms: we keep information about you so we can understand your health and help you safely. We keep it private and share it only when there is a proper reason. If we are worried that you or someone else is unsafe, we may need to ask another professional for help. You can ask Harry what we have written about you or ask us to explain this notice.
Children have their own privacy rights. We take account of their understanding and ability to make decisions, and verify a parent's or representative's authority before providing access. We can explain this notice in language suited to the child or young person.
How to complain
Please contact Harry Whitaker at hello@mwchiro.co.uk, on 01904 900 123, or by post to Welton House, 30 Burnby Lane, Pocklington, York, YO42 2QD. You do not need to use a special form. We acknowledge data protection complaints within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay.
You may also complain to the Information Commissioner's Office (ICO), particularly if you remain unhappy after raising the issue with us. Telephone: 0303 123 1113. Postal address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We update this notice when our services or data practices change. The date at the start of this notice shows when it was last updated. We will draw significant changes to your attention where appropriate.