Privacy Policy
Last updated: 21 September 2026
Foundation Movement Osteopathy respects your privacy and is committed to protecting your personal information. This policy explains how we collect, use, store and share information when you visit our website, contact us, book an appointment or receive care.
1. Who we are
The data controller responsible for your personal information is Sebastian Murtagh, trading as Foundation Movement Osteopathy.
Foundation Movement Osteopathy
26 Wallingford Road
Cholsey
Wallingford
OX10 9LG
Email: seb@foundationmovement.co.uk
Website: foundationmovement.co.uk
2. Information we collect
Depending on how you interact with us, we may collect:
Your name, date of birth, address, email address and telephone number.
Appointment details and correspondence.
Medical history, symptoms, assessment findings, diagnoses, treatment records and rehabilitation plans.
Relevant information supplied by you or, where appropriate, other healthcare professionals.
Records of consent, payments and invoices.
Information submitted through our website’s contact form.
Technical information about website visits, such as IP address, browser, device and pages viewed, depending on the website features and cookie settings in use.
Please use the website contact form for general enquiries and avoid including detailed medical information.
3. How we use your information
We use your information to:
Respond to enquiries and arrange appointments.
Assess your needs and provide osteopathic care, gait assessments and rehabilitation advice.
Maintain accurate clinical records and support continuity of care.
Communicate about appointments and treatment.
Process payments and maintain financial records.
Meet professional, legal and regulatory obligations.
Handle complaints and establish, exercise or defend legal claims.
Operate, protect and understand the use of our website.
We do not sell your personal information.
4. Our lawful bases for processing
Under the UK General Data Protection Regulation and the Data Protection Act 2018, we rely on the following bases where applicable:
Contract: To take steps at your request before providing services and to deliver the services you book.
Legal obligation: To meet applicable legal requirements, including relevant financial and record-keeping obligations.
Legitimate interests: To manage enquiries, administer and protect our practice, maintain appropriate records and deal with complaints or claims, where these interests do not override your rights.
Consent: Where required for particular optional activities, such as certain cookies or electronic marketing. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
Health information receives additional protection. We process it where necessary for healthcare, including assessment and treatment, subject to professional confidentiality. Where applicable, we may also process it for establishing, exercising or defending legal claims.
Consent to examination and treatment is obtained separately from the lawful bases used to process your information.
5. Our website, contact form and booking system
Squarespace
Our website is hosted by Squarespace. Squarespace processes information needed to operate the website and may process technical information about visits.
When you submit our contact form, the information you provide is processed through Squarespace so that we can receive, store and respond to your enquiry.
Google Workspace
We use Google Workspace for our clinic email. Enquiries, form notifications and other correspondence sent to our clinic email are processed and stored through this service.
PracticeHub
Our online booking buttons link to our PracticeHub booking page. When you follow these links, you leave our Squarespace website.
PracticeHub processes information entered into its booking system to support appointment booking and practice administration. Information processed through PracticeHub on our behalf remains subject to our responsibilities as data controller.
Spam protection
Our contact form uses Google reCAPTCHA to help prevent spam and automated abuse. This service may process technical information, including your IP address and browser or device information, to distinguish genuine visitors from automated activity.
Further information is available in the privacy information published by Squarespace, Google and PracticeHub.
6. Cookies and similar technologies
Our website and services used through it may use cookies or similar technologies for essential functions, security and, where enabled, analytics.
Where consent is required for optional cookies, these should only operate after you have given consent. You can manage your choices through the website’s cookie controls where available, and through your browser settings.
Blocking certain cookies may affect how parts of the website work.
The PracticeHub booking page may use its own cookies. Please refer to the information and controls provided there.
7. Sharing your information
We only share personal information where necessary and appropriate. Recipients may include:
Service providers supporting website hosting, email, booking, practice administration, IT and payment processing.
Healthcare professionals involved in your care, with your permission where appropriate or where another lawful justification applies.
An orthotics laboratory or supplier where needed to fulfil a prescription or order.
Professional advisers, insurers or legal representatives where necessary to deal with a complaint or claim.
Regulators, public authorities or other organisations where disclosure is required or permitted by law.
We limit the information shared to what is necessary for the purpose. Providers processing information on our behalf are subject to appropriate contractual requirements.
8. International transfers
Some technology providers may process personal information outside the UK.
Where this occurs, we must ensure that appropriate safeguards apply, such as UK adequacy regulations or approved contractual safeguards, as required by data protection law.
You can contact us for further information about the safeguards relevant to your personal information.
9. How long we retain information
We retain personal information for as long as necessary for its purpose, taking account of applicable legal, professional and insurance requirements.
Adult clinical records: We normally retain these for at least eight years after your last treatment or discharge.
Children’s clinical records: We normally retain these until the patient’s 25th birthday, or 26th birthday if they were aged 17 at the end of treatment, and for at least eight years after the last treatment, whichever is later.
General enquiries: We retain correspondence for as long as needed to resolve the enquiry and any related follow-up. If an enquiry becomes relevant to your care, it may form part of your clinical record.
Appointment and financial records: We retain these for the periods needed to administer our services and meet applicable accounting, tax and legal requirements.
Information may be retained longer where necessary for an ongoing complaint, legal claim or other justified requirement. When no longer needed, it will be securely deleted, destroyed or anonymised.
10. Keeping your information secure
We use appropriate technical and organisational measures to protect personal information from unauthorised access, loss, misuse or disclosure.
Access is limited to people and service providers who need the information for an authorised purpose.
No online service or email system can be guaranteed completely secure. Please avoid sending detailed health information through the general website enquiry form.
If a personal data breach occurs, we will assess it and make any notifications required by law. Where a breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.
11. Your rights
Depending on the circumstances, you have the right to:
Request access to your personal information.
Ask us to correct inaccurate or incomplete information.
Request deletion of your information.
Request restrictions on its use.
Object to processing based on legitimate interests.
Receive certain information in a portable format.
Withdraw consent where processing relies on consent.
Complain to the Information Commissioner’s Office.
These rights are subject to conditions and exceptions. For example, a request for deletion may not mean that we can delete clinical records that must be retained.
To exercise your rights, email seb@foundationmovement.co.uk or write to the address below. We may request proportionate information to verify your identity.
We normally respond within one month. If a permitted extension is necessary, we will explain why.
12. Marketing
We will not treat an enquiry or appointment booking as automatic consent to receive marketing.
If we send electronic marketing, we will do so only where permitted by law and provide a way to opt out. You can also contact us at any time to ask us to stop sending marketing messages.
13. Automated decision-making
We do not make decisions about your clinical care based solely on automated processing that produces legal or similarly significant effects.
Our website’s spam-protection service may automatically assess form activity to help prevent abuse.
14. Complaints
If you are concerned about how we handle your information, please contact us at seb@foundationmovement.co.uk.
You also have the right to complain to the UK Information Commissioner’s Office:
Website: ico.org.uk
Telephone: 0303 123 1113
You do not need to contact us before making a complaint to the ICO.
15. Changes to this policy
We may update this policy to reflect changes in our services, systems or legal obligations. The latest version will appear on our website with an updated revision date.
16. Contact us
For questions about this policy or your personal information, contact:
Sebastian Murtagh
Foundation Movement Osteopathy
26 Wallingford Road
Cholsey
Wallingford
OX10 9LG
Email: seb@foundationmovement.co.uk