Privacy Policy

01. Who we are

Assure Healthcare Ltd, trading as Assure Health, is the data controller for the information we hold about you. That means we decide what information is collected and how it is used, and we are responsible for looking after it.

We handle your information in line with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

If you have any questions about this policy or about your information, contact us at hello@assurehealthni.com or on 028 9079 6666.

02. What information we collect

If you visit our website

If you contact us by email or by phone, we collect your name, your contact details and whatever you choose to tell us. If you consent to analytics cookies we also collect information about your visit, such as your approximate location, the pages you view and how long you spend on them.

If you are a patient

To provide care we collect and hold:

Your name, date of birth, address, phone number and email address
An emergency contact, and next of kin details where these are clinically relevant
Your medical history, current medication and any allergies
Clinical notes, assessment findings, diagnoses and treatment plans
Results from tests carried out in clinic, including video gait analysis, Footscan pressure plate data, and strength and movement testing results held in the VALD system
Photographs or scans where these are clinically relevant and you have agreed to them
Correspondence with your GP or a specialist where we refer you on
Exercise and rehabilitation programmes prescribed to you through SimpleSet, our exercise prescription software

Payments and appointments

We also hold details of your appointments, invoices and payment history. Card payments are taken in clinic through Square. Your card number is handled by Square and is never stored by us.

If you use the Assure Health Booking Site

Our Pilates classes are booked through the Assure Health Booking Site, which we own and run ourselves. You do not need to be a clinic patient to use it. If you book a class through the booking site we collect:

Your name, email address and phone number
The classes you book and attend
Your answers to a short health questionnaire, covering matters such as heart conditions, chest pain or dizziness, joint problems, current medication, diabetes, recent injuries or surgery, and pregnancy
An emergency contact
A signed declaration confirming that the information you have given is accurate

We ask those health questions because exercise is not suitable for everyone in every circumstance, and because your instructor is a chartered physiotherapist who needs to know about anything affecting how you should move. Your answers are reviewed before your first class and are taken into account when your instructor adapts exercises for you.

Class payments are taken through Stripe. Your card number is handled by Stripe and is never stored by us.

03. Why we use it, and our lawful basis

We only use your information where the law allows. The bases we rely on are:

To provide your care: we process your information to deliver the treatment you have asked for. For health information specifically, we rely on the health purposes basis, which covers medical diagnosis and the provision of health care.
To meet our legal and professional obligations: we are required to keep accurate clinical records, and our clinicians are bound by the standards of their professional regulators.
To run the clinic: we use your contact details to confirm, remind and reschedule appointments, to take payment and to answer your questions.
To keep people safe: in rare circumstances we may need to share information to protect a child or an adult at risk, or where someone is at risk of serious harm.
With your consent: for analytics cookies, and for anything optional such as marketing emails. You can withdraw consent at any time.

04. Health information

Health information is what the law calls special category data. It is given extra protection because of how sensitive it is, and we treat it accordingly.

We process it on the basis that it is necessary for medical diagnosis and the provision of health care, carried out by professionals who are under a duty of confidentiality.

Everyone in our clinical team who can see your records is bound by that duty, both professionally and under the common law.

This includes the health questionnaire you complete in the Assure Health Booking Site before attending a Pilates class. Those answers are health information, and we protect them in exactly the same way as any other health information we hold about you.

05. Confidentiality

Everything you tell us is confidential. We follow:

The Health and Care Professions Council standards of conduct, performance and ethics
Royal College of Podiatry guidance on clinical records
Chartered Society of Physiotherapy standards, for our physiotherapy service
The Caldicott principles for handling patient identifiable information
The common law duty of confidence

We will never share your information with anyone for marketing purposes.

06. Who we share it with

We do not sell, trade or rent your personal information, and we do not share your clinical records with anyone without a clear reason. The Assure Health Booking Site is our own system rather than a third party service, but the companies that host it and support it are listed below.

Cliniko: our practice management system, which holds your clinical records, appointments and contact details. Cliniko is operated by Red Guava Pty Ltd and acts as our data processor under a written agreement.
SimpleSet: our exercise prescription software, which holds your name and the rehabilitation programme prescribed to you, so it can be sent to your phone with video demonstrations.
VALD: the strength and movement testing system we use in clinic, which holds your test results so we can compare them when we retest you.
OVHcloud: the hosting provider for the Assure Health Booking Site. OVHcloud stores the booking site's information on our behalf as our data processor. They do not access it or use it for their own purposes.
Stripe: our payment provider for Pilates classes booked through the Assure Health Booking Site. Stripe processes your payment on our behalf. We do not see or store your card number.
Resend: the service that delivers emails sent by the Assure Health Booking Site, such as booking confirmations and class reminders. It handles your email address and the contents of those emails.
Your GP or a specialist: where we refer you on or write to them about your care. We will normally tell you when we are doing this.
Your insurer: only where you are claiming for treatment, and only what is needed to process that claim.
Square: our card payment provider, operated by Block, Inc. Square processes your payment on our behalf. We do not see or store your card number.
Google: if you consent to analytics cookies, information about your visit to our website.
Others where the law requires it: for example to comply with a court order, to meet a request from a regulator, or to protect someone from serious harm.

07. Where your information is stored

We use a small number of trusted systems to run the clinic. Each one holds a different part of your information, and each is covered by a written agreement with us. Here is where your information sits and what protects it.

Cliniko: holds your clinical records, appointments and contact details. Cliniko is operated by Red Guava Pty Ltd, an Australian company, and its servers are located outside the United Kingdom. Data is encrypted in transit and at rest.
Square: handles card payments. Square is operated by Block, Inc. and your payment information is primarily processed in the United States.
SimpleSet: holds your rehabilitation programme. SimpleSet is a Canadian company and its data is held on encrypted cloud servers. Canada is recognised by the United Kingdom as providing an adequate level of data protection.
VALD: holds your strength and movement testing results. VALD is operated by VALD Pty Ltd, an Australian company, and its data is held on encrypted third party cloud servers.
The Assure Health Booking Site: hosted by OVHcloud in France. OVHcloud is certified to ISO 27001, 27017, 27018 and 27701, which are international standards for information security and privacy management. France is covered by a United Kingdom adequacy decision, which means your information is given the same level of legal protection there as it would have here.
Stripe: handles payments for Pilates classes booked through the booking site. Stripe is operated by Stripe Payments UK Ltd, and your payment information is processed in the United States and other countries.
Resend: When you book a class or create an account, we send you transactional emails (such as booking confirmations) using Resend, a US-based email delivery service. Your email address and the content of these emails may be processed on servers located in the United States. Resend is certified under the UK-recognised Data Privacy Framework, which ensures your data is protected to a standard equivalent to UK law. You can review Resend's privacy policy at resend.com.

Where your information is transferred outside the United Kingdom, it is protected by the safeguards data protection law provides for this, being Standard Contractual Clauses together with the UK International Data Transfer Addendum, or by an adequacy decision where one applies.

You can read Cliniko's own privacy policy at cliniko.com and VALD's at vald.com.

08. Anonymised data and the VALD system

This section is about VALD specifically, not about Assure Health. We want to be clear about the difference.

Assure Health does not sell, share or reuse your information for any purpose beyond your care and running the clinic. That has not changed and will not change.

VALD, the company that makes the strength and movement testing equipment we use, states in its own terms that once test data has been anonymised or de-identified, so that it can no longer be linked to you, VALD owns that anonymised data and may use it for its own purposes, such as producing reports about groups of people by age or activity type.

This is common for platforms of this kind, and the data involved can no longer identify you. We are telling you because we would rather you heard it from us.

09. How long we keep it

We keep records for as long as we are required to, and no longer than necessary.

Adult clinical records: eight years after your last appointment, in line with Royal College of Podiatry guidance
Records for patients under 18: until their 25th birthday, or eight years after their last appointment, whichever is longer
Assure Health Booking Site health questionnaires, class bookings and declarations: eight years after your last class
Nail surgery and other invasive procedure records: fifteen years, in line with NHS guidance on records relating to procedures
Accounting and payment records: six years, as required by tax law
Email and phone enquiries: up to two years, unless you go on to become a patient
Website analytics: twenty six months

When these periods end, records are securely deleted or destroyed.

10. Children and young people

We assess and treat children, including through our Children's Lower Limb Assessment.

Consent is given by a parent or someone with parental responsibility
A parent or guardian is welcome to be present throughout the appointment
Children's records are kept until their 25th birthday, or eight years after their last appointment, whichever is longer
We do not knowingly collect information from children through our website

11. Booking and payment

Appointments booked through our website are handled by Cliniko, not by our website itself. When you click a booking link you are taken to Cliniko's booking system, and the information you enter there is collected by Cliniko on our behalf.

Our Pilates classes are booked through the Assure Health Booking Site. Unlike our other systems, the booking site is one we own and run ourselves rather than a service we buy in, so the information you enter there is collected by us directly rather than by a third party on our behalf.

Payments in clinic are taken by card and handled by Square. Payments for Pilates classes are taken through the booking site and handled by Stripe. In both cases your card details are handled by the payment provider and are not stored by us.

12. Cookies

Cookies are governed by the Privacy and Electronic Communications Regulations. Some cookies are strictly necessary for the website to work and do not require your consent. Anything else, including analytics, is only set if you agree to it.

When you first visit our site you are asked to accept or reject non essential cookies. Nothing is set until you choose. You can change your mind at any time using the Cookie settings link in the footer of any page.

For more information on how Google collects and processes data, see Google's Privacy Policy.

13. Automated decisions

We do not use your information to make automated decisions about you, and we do not use it for profiling. Every clinical decision about your care is made by a qualified clinician.

14. Security

We take the security of your information seriously. The measures we use include:

Encrypted storage of all clinical records
Individual staff logins, with access limited to those who need it
Secure destruction of any paper records
Encrypted connections across our website
Training for our team on confidentiality and data protection

No system is completely secure, but we take reasonable steps to protect your information.

15. If something goes wrong

If there is ever a breach involving your personal information, we will assess it straight away. Where the law requires it, we will report it to the Information Commissioner's Office within seventy two hours of becoming aware of it. Where a breach is likely to put your rights at serious risk, we will tell you directly and without delay.

16. Your rights

You have the right to:

Ask for a copy of the information we hold about you
Ask us to correct anything that is wrong or incomplete
Ask us to delete your information, although we cannot delete clinical records we are required to keep
Object to or ask us to restrict how we use your information
Withdraw consent at any time, where we rely on consent
Ask us to transfer your information to another provider

To exercise any of these rights, contact us at hello@assurehealthni.com. We will respond within one calendar month, though we may extend this by up to two further months if your request is particularly complex, in which case we will tell you within the first month. We may ask you to confirm your identity first. There is no charge.

17. Complaints

If you are unhappy with how we have handled your information, please tell us first at hello@assurehealthni.com and we will do our best to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. You can reach them at ico.org.uk or on 0303 123 1113.

18. Changes to this policy

We may update this policy from time to time. The date it was last updated is shown at the bottom of this page.

19. Contact us

If you have any questions about this policy or about the information we hold about you, please contact us:

Assure Healthcare Ltd, trading as Assure Health
127 Ballynahinch Road, Carryduff, Belfast BT8 8DJ
Email: hello@assurehealthni.com
Phone: 028 9079 6666