Effective Date: 15th July 2026
This Privacy Policy describes how Infinite Podiatry & Physio Ltd collects, uses, shares and protects information about you when you use our services, including our clinic, website, mobile applications, social media and online booking and payment tools.
By accessing or using our services, you agree to this Privacy Policy.
IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE OUR SERVICES.
This Privacy Policy contains the following sections:
Infinite Podiatry & Physio Ltd collects a variety of information that you provide directly to us. We process your information, when necessary, to provide the treatment and services you have requested, where we have obtained your prior consent, or where we have a legitimate interest to do so — for example, to provide treatment, invoicing and billing, service improvement, analytics, research and reporting.
Without your information, we cannot provide the services you have requested, or you may be limited in your use of them. Information may be visible to team members beyond your direct clinician — for example, our reception and administrative team access your data to arrange appointments, create letters, summaries and invoices.
The types of data we collect directly from you may include:
We collect information from you through:
Clinical Records
We are required to generate records of all treatment provided. The Health and Care Professions Council (HCPC) mandates that clinical records are kept for a minimum period — see ‘How Long We Store Your Information’ below. This does not affect your right to request that we stop using or restrict other data about you, but your clinical records and notes must be retained in line with HCPC guidance.
When you use our services that connect to the internet — including our website or online booking and payment tools — we and our service providers automatically collect certain technical information, such as your IP address, browser type and settings, pages viewed, referring/exit pages, device type, operating system, and date/time information.
We use an AI-powered telephone/reception service (Verbalise) to help manage incoming patient calls, enquiries and appointment bookings. This may involve call recordings, transcripts and the information you provide during the call (such as your name, contact details and reason for enquiry), which are processed in order to arrange your care and are linked to your patient record where relevant.
We use a number of third-party systems to run the practice and deliver your care. Where these tools handle patient data, they act as our data processors and are contractually required to protect your information appropriately. These currently include:
We use your information for purposes including to:
To collect the information described in ‘Information We Automatically Collect’, we and our service providers use server logs, cookies, tags, and similar tracking technologies. A cookie is a small text file placed on your device when you visit our site, used to recognise your session, remember your preferences, understand how you use our website, and measure the effectiveness of content and advertising.
You can change your browser settings to be notified when a cookie is set, or to block cookies altogether. Consult your browser’s help section for instructions.
1. Analytics
We may use third-party web analytics services (such as Google Analytics) on our website to understand how visitors use our site and to inform service improvements.
2. Online Advertising
We run marketing, including on Facebook/Meta, to promote our services. This may involve the use of cookies or similar tracking technologies by these platforms to measure and target advertising. Where we post photographs or video of patients as part of this marketing, this is only ever done with your explicit written consent, and you may withdraw that consent at any time.
We share your information with the third-party service providers listed above, to the extent necessary for them to perform services on our behalf, such as clinical record-keeping, billing, payment processing, communications and IT.
If the ownership of all or substantially all of our business changes, we may transfer your information to the new owner so that services can continue. Your information would remain subject to the protections of this Policy unless and until you are notified of an updated policy.
Our Facebook page and Google Business Profile allow patients to leave public reviews or comments. Anything posted publicly in this way is not confidential and may be visible to other users and search engines. Please take care when posting in these spaces.
We may share aggregated or de-identified information, such as usage trends, which cannot reasonably be used to identify you.
We will occasionally disclose your information to third parties, but ONLY with your specific consent — for example, writing to your GP to update them on your treatment.
We use general-purpose AI tools, including Claude and ChatGPT, for internal administrative tasks such as drafting correspondence or business planning. We do not enter any patient-identifiable data into these tools. Our AI receptionist (Verbalise) is a separate, dedicated system used specifically to manage patient calls and bookings, as described above.
You may ask us at any time not to use your contact information for marketing by contacting us using the details below. You can also opt out of marketing emails using the unsubscribe link in those emails.
Regardless of your marketing preferences, we may still need to retain and use certain information as required by law or professional regulation — for example, we must retain your clinical records for the periods set out below.
Our services may contain links to third-party websites or integrations. If you choose to use these, you may be disclosing information to those third parties and, depending on how their service works, to their users or the public. We are not responsible for the content or privacy practices of third-party websites or services, and we encourage you to review their own privacy policies.
Our services are available to patients of all ages. For children under 16, we generally require consent from someone with parental responsibility, which may be:
Some children under 16 may be able to give their own consent if they are assessed as able to fully understand the information given to them (‘Gillick competence’).
We retain children’s clinical records for longer than our standard adult retention period, in line with HCPC and NHS records management guidance — see ‘How Long We Store Your Information’ below.
Infinite Podiatry & Physio Ltd complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Some of our service providers may store or process data outside the United Kingdom, including in the United States or elsewhere. Where we or our processors transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or reliance on a provider’s participation in the UK extension to the EU–US Data Privacy Framework, as applicable.
If you are in the European Union or Switzerland and have questions or complaints about this Privacy Policy, please contact us at info@infinite-podiatry.com.
You have the right to ask us about the information we hold about you, and to access, rectify, or request deletion of it, or to restrict or object to our processing of it. Please contact us using the details below. We may ask you to complete a Subject Access Request for certain requests.
Where you have provided consent for processing, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before you withdrew it.
If you are unhappy with how we have handled your information, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection, at ico.org.uk.
We retain your information for as long as necessary to fulfil the purposes described in this Policy, or as required by law or professional regulation, including:
We may amend this Policy at any time to reflect changes in the law, our data practices, our services, or advances in technology. Any updated Policy will be made available through our website. If we make a material change, we will provide appropriate notice and, where required, seek your consent.
We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure or access. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. If you have questions about security on our services, contact us at info@infinite-podiatry.com.
The data controller for your information is Rachel Green, Infinite Podiatry & Physio Ltd, 7 St Peter’s Street, Hereford, HR1 2LE.
If you have questions or complaints about this Privacy Policy, please contact us at info@infinite-podiatry.com.
