Privacy Policy

1. Who we are

These pages are operated by Didcot Chiropractic Clinic ("we", "us", "our").


Clinic address: 198A Broadway, Didcot, Oxfordshire, OX11 8RN


Contact email: [email protected]


Contact phone: 01235 510097


We are the data controller for the personal data described in this policy, meaning we decide how and why it is used.

2. What personal data we collect

When you complete a form on any of these pages, whether to claim the £35 new patient voucher or to book a slot at the free injury and movement assessment, we collect:


  • Your first and last name

  • Your email address

  • Your phone number

  • Attribution data submitted via hidden fields alongside your form entry: marketing campaign parameters (UTM Source, Medium, Campaign, Platform), the page URL you submitted from, and ad click identifiers (Meta's fbclid and Google's click ID) used to match your enquiry to the ad that brought you here

  • Technical data such as your IP address, browser type, and how you interact with these pages, collected automatically via cookies and similar technologies (see Section 6)


We also collect anything you tell us when our booking team follows up by phone, email, or text to arrange your appointment or confirm your event slot, including a recording of that call.


If you go on to book an appointment, our booking system PracticeHub will separately collect your appointment details, and where a payment is taken it is processed by Stripe. We do not see or store your full card details.


We do not knowingly collect any personal data beyond what is listed above, or what you choose to tell us directly.

3. How we collect your data

We collect data when you:


  • Complete a form on any of these pages, to claim the new patient voucher or to book a slot at the free assessment event

  • Book an appointment through our online booking system

  • Attend an appointment or an assessment event

  • Contact us directly by phone, email, or messaging

  • Speak to our booking team when they call or text you about your enquiry

  • Browse these pages, via cookies and tracking technologies

4. How we use your data and our legal basis

We use your personal data to:


Purpose

Legal basis

Respond to your enquiry and send you the voucher or event slot you requested

Legitimate interests, taking steps at your request before entering into a service arrangement with you

Contact you by phone, email, or text to arrange your appointment or confirm your event slot

Legitimate interests / performance of a contract

Record calls with our booking team to confirm what was agreed and to check the quality of the service

Legitimate interests

Take payment for your appointment

Performance of a contract

Carry out and record your assessment

Provision of health care and treatment (see Section 5)

Send you marketing communications, where you have opted in

Consent

Improve these pages and our services

Legitimate interests

Comply with legal or regulatory obligations

Legal obligation


Where we rely on legitimate interests, we have considered that this processing is necessary and proportionate, and does not override your rights. You can ask us for details of this assessment at any time using the contact details above.

5. Special category data (health information)

This form only asks for your first name, last name, email, and phone number, plus hidden attribution fields (see Section 2). It does not ask you to describe any injury, condition, or symptom, so we do not collect health information through it.


If you tell us about an injury, condition, or symptom when we contact you, or when you attend, we record it so that we can assess you and deliver your care. Your assessment findings, examination results, report of findings, and treatment notes are all health information.


All of the above counts as special category (health) data under Article 9 UK GDPR, and we rely on Article 9(2)(h), processing necessary for medical diagnosis and the provision of health care and treatment, met in UK law by paragraph 2 of Schedule 1 to the Data Protection Act 2018. This data is subject to the additional safeguards described in Section 13.

6. Cookies and tracking technologies

These pages, and our online booking system, use the following cookies and similar technologies:


Set by these pages


Tool

Cookie ID

Domain

Category

Duration

Purpose

GA4

_ga

Funnel domain

Analytics

400 days

Distinguishes unique visitors for Google Analytics

GA4

ga<container ID>

Funnel domain

Analytics

Session

Maintains the current GA4 session state

GA4

_gid

Funnel domain

Analytics

24 hours

Identifies the visitor for session tracking

Google Ads (Conversion Linker)

gclaw

Funnel domain

Advertising

90 days

Detects the ad click ID (gclid) in the URL and attributes a conversion back to the ad that drove it, the core conversion tracking cookie

Google Ads

gclau

Funnel domain

Advertising

90 days

Browser identifier supporting conversion measurement alongside gclaw

Meta Pixel

_fbp

Funnel domain

Advertising

90 days

Tracks visits across sites to deliver Meta advertising

Meta Pixel

_fbc

Funnel domain

Advertising

90 days

Stores the ad click ID to attribute a conversion to the ad that drove it

Cloudflare

__cf_bm, __cf_logged_in, cf_clearance, CF_VERIFIED_DEVICE_*

.cloudflare.com

Essential

30 min to 1 year

Bot management and security checks, confirms the visitor has passed Cloudflare's checks

GHL (native)

msgsndr_id

Funnel domain

Essential

14 days

GoHighLevel's own visitor identifier for the funnel

GHL (native)

cookie-config, current_url

Funnel domain

Essential

1 year

GHL's own site configuration and current-page tracking, required for the funnel to function


Set by our online booking system (PracticeHub)


Tool

Cookie ID

Domain

Category

Duration

Purpose

Stripe

__stripe_sid

Funnel domain

Essential

30 minutes

Fraud prevention during an active payment session

Stripe

__stripe_mid

[confirm in DevTools]

Functional

1 year

Device identifier Stripe uses for fraud risk scoring across sessions

Google Ads

gclau

PracticeHub domain

Advertising

90 days

Links ad clicks to conversions for Google Ads

Google / DoubleClick

IDE

.doubleclick.net

Advertising

13 months

Ad personalisation and conversion measurement

Google / DoubleClick

DSID

.doubleclick.net

Advertising

2 weeks

Identifies signed-in Google users for ad targeting and retargeting

Google / DoubleClick

ar_debug

.doubleclick.net

Advertising

90 days

Supports Google ad delivery and measurement

Google / DoubleClick

mggpc

.doubleclick.net

Advertising

[confirm in DevTools]

DoubleClick technical cookie for ad frequency capping

PostHog

ph_phc_<project key>

[confirm in DevTools]

Analytics

[confirm in DevTools]

Product analytics identifier used by PracticeHub


Essential cookies are necessary for these pages and the booking system to function and do not require consent. All other categories above (Analytics, Advertising, Functional) are not essential and will only be set with your consent, which you can give or withdraw at any time via the cookie consent banner on these pages.


7. Who we share your data with

We may share your data with:


  • GoHighLevel (GHL), who hosts this funnel and processes your data on our behalf to manage enquiries and communications

  • PracticeHub, our practice management and online booking system, who processes your appointment and patient data on our behalf

  • Stripe, who processes payments for appointments booked online

  • Civet Media Ltd, our marketing agency, who processes your data on our behalf to run and measure our advertising campaigns, and whose Virtual Reception team contacts you to arrange your appointment

  • Cloudflare, who provides security and bot-management services for this website

  • Meta and Google, where you have consented to advertising cookies, so that we can measure and improve our advertising


We do not sell your personal data to anyone.

8. International transfers

Some of the providers listed in Section 7 may store or process data outside the UK, for example in the United States. Where this happens, we ensure appropriate safeguards are in place, such as the UK Extension to the EU-US Data Privacy Framework, the ICO's International Data Transfer Agreement, or the ICO's International Data Transfer Addendum to the European Commission's standard contractual clauses, so your data continues to be protected to UK standards.

9. How long we keep your data

We keep your personal data for 26 months from your last contact with us, after which it is securely deleted, unless we are required to keep it for longer to meet a legal, accounting, or regulatory requirement.


Call recordings are kept for 12 Months.


If you become a patient, your clinical records are kept for longer, in line with General Chiropractic Council requirements.


10. Your rights

Under UK data protection law, you have the right to:


  • Access the personal data we hold about you

  • Ask us to correct inaccurate data

  • Ask us to delete your data

  • Ask us to restrict how we use your data

  • Object to our use of your data, including an absolute right to object to direct marketing

  • Receive your data in a portable format

  • Withdraw consent at any time, where we rely on consent


To exercise any of these rights, contact us using the details in Section 1. There is no charge. We will respond within one month, and we will tell you within that month if a complex or repeated request means we need longer.


If you are unhappy with how we have handled your data, tell us first using the details in Section 1. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

11. Marketing communications

We will only send you marketing messages by email, text, or phone where you have given consent, or where the law otherwise permits it. You can opt out at any time by contacting us or using the unsubscribe link in any marketing message.

12. Children

We treat patients of all ages, including babies and children. Where the patient is a child, the appointment or event slot is booked by a parent or another adult with parental responsibility, and we take consent to treatment and any health information from that adult unless the child is old enough and able to consent for themselves.


13. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Where we hold health information under Section 5, we apply additional access controls so that this data is only visible to those involved in delivering your appointment or assessment.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised.

15. Contact us

If you have any questions about this policy or how we handle your data, contact us at [email protected], on 01235 510097, or at Didcot Chiropractic Clinic, 198A Broadway, Didcot, Oxfordshire, OX11 8RN.

Last updated

1/9/26