General Privacy Policy

Who are we? 

Johnston Podiatry is a private podiatry clinic located in Bishopbriggs, Glasgow. The podiatrists who work for Johnston Podiatry are all registered with the Health and Care Professions Council (HCPC). 

What information do we collect?

When you book an appointment online, visit us in person or contact us by telephone, we record and store certain information about you. This information can include: 

• Name

• Date of birth

• Home address 

• Telephone number(s) 

• Email address 

• The nature of your podiatric issue 

• Limited transaction-related information (if paying by card online, in person or by telephone) 

We also ask you to complete a medical history before certain appointments to enable us to provide safe and appropriate care. This form requests the information stated above, as well as some special category data such as: 

• Your physical and mental health, including any medical conditions you may have 

• Lifestyle choices relevant to your foot health

Why do we ask for this information?

Podiatrists are medical professionals who require certain information to make an informed diagnosis. In order to recommend the right treatments for your individual needs, it is important that you are honest and accurate when telling us about your health. Some conditions and medications affect your feet and may change how we treat certain issues. We use the contact details you provide us (such as your phone number and email address) to contact you about appointments, to send you booking confirmation emails and SMS reminders, and to send you any invoices or documentation you may require. We are legally required to retain clinical records for a minimum of 8 years. Certain information you provide us is included in these clinical records.  

How do we share your information? 

Occasionally we may need to share your information with a third party with your consent (e.g. with your GP). If we do need to share your information, we will do so in accordance with UK GDPR (General Data Protection Regulation) and DPA (Data Protection Act) legislation. We may share your information with:

• Your GP (or nurse) or other healthcare professional

• Your parent / legal guardian if you are under the age of 16 

• Your welfare guardian or carer (if applicable)

We would also be required to share your information if instructed to by law enforcement or regulatory authorities. 

How do we collect your information?

We gather information about you in a number of ways, including: 

• If you make an appointment online 

• If you telephone 

• If you email 

• If you visit the clinic 

How do we store your data? 

We operate a paperless system in our clinic using a practice management software called Cliniko to store patient information. Cliniko stores some of this data outside of the European Economic Area (EEA). Cliniko stores and processes information securely and in accordance with applicable UK data protection law. Further information about Cliniko’s security practices is available on their website at https://www.cliniko.com/security/. Access to your patient file and information is limited to authorised members of staff, namely our reception staff and podiatrists, who require access to manage appointments, treatment records, and clinic administration.

Third party data processors 

We use trusted third party data processors to process and store your data. These providers process personal data on our behalf under strict data processing agreements:

• Cliniko - Practice management software used to store patient details and clinical notes

• Stripe - Used in conjunction with Cliniko to process online payments for appointments

• Elavon - Used to process in-person card payments or card payments made by telephone 

Lawful basis for Processing

We do not rely on consent or legitimate interests alone to provide clinical care. We process your personal data because it is necessary to deliver and manage your care and the clinic’s operations. We use the following lawful bases of UK GDPR law to process your data: 

Article 6 (1) (b) - Performance of a contract - Processing is necessary to provide podiatry assessment, diagnosis, treatment, appointment management, patient communications and associated administrative functions including billing and payments.

Article 6 (1) (c) - Compliance with a legal obligation - Processing is necessary to comply with applicable legal and regulatory obligations, including clinical record retention, accounting and tax requirements, safeguarding obligations, and reporting obligations where required by law or professional regulation.

Article 9 (2) (h) - Health or social care purposes - Processing of special category personal data (including health data) is necessary for the provision of health care or treatment and the management of health care systems and services, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

Data Controller 

Jean Johnston is the data controller at Johnston Podiatry. Any queries regarding your information or how we store it can be sent to reception@johnstonpodiatry.co.uk. 

Your rights as a data subject 

Under UK GDPR law, you have the right to the following: 

• To access your personal data

• To be informed about how and why your data is used

• To rectification (correction of inaccurate data)

• To erasure (in certain circumstances)*

• To restrict processing

• To object to processing

• To data portability

• To rights related to automated decision-making (not currently used by us)

*Please note that your right to erasure (or right to be forgotten) cannot override our legal obligation to retain your clinical notes for the minimum term. 

You may request a copy of the information we hold on you by writing to the clinic. You can object to (or restrict) the processing of your data, however this may affect our ability to treat you or offer you appointments. If you feel that we have not fulfilled our legal obligations in how we process or store your data, you have the right to complain to the ICO (Information Commissioner’s Office.) However, in the first instance we would ask you to report the issue to us so that we can try to resolve it. If you would like to discuss your options, please email us at reception@johnstonpodiatry.co.uk.

Updates to this policy 

We may update this privacy policy from time to time. The latest version will be available on our website.