Last updated: 28 October 2026
At York Podiatry Ltd, we take your privacy seriously. We are committed to protecting your personal information and handling it responsibly, confidentially and in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with and what rights you have.
This policy applies to patients, prospective patients, website visitors and other individuals who interact with York Podiatry.
York Podiatry Ltd is the data controller responsible for your personal information.
Data Controller: Rebecca Hargreaves
Business: York Podiatry Ltd
Location: Arabesque House, Monks Cross Drive, York, YO32 9GW
Email: info@yorkpodiatry.co.uk
York Podiatry Ltd is registered with the Information Commissioner’s Office (ICO).
If you have any questions about this policy or how we handle your personal information, please contact us using the details above.
The information we collect depends on how you interact with us.
Patient and clinical information
When you receive treatment from us, we may collect:
Health information is special category personal data under the UK GDPR and receives additional protection.
Website and technical information
When you visit our website, we may collect information such as:
Some of this information is collected using cookies and similar technologies, subject to your cookie preferences and applicable requirements.
Communications and enquiries
If you contact us by telephone, email, online form or another method, we may retain the information you provide to respond to your enquiry and manage our relationship with you.
We use personal information for the following purposes:
We only use your information where we have an appropriate legal basis and, where health information is involved, a valid condition for processing special category data.
The UK GDPR requires us to identify a lawful basis for processing personal information. Where we process health information, we must also satisfy an additional condition for special category data.
Depending on the circumstances, we may rely on the following.
Providing healthcare and managing appointments
We process information where necessary to take steps at your request before providing services, perform our arrangements with you and manage your treatment.
Healthcare and clinical records
We may process health information where necessary for the provision of healthcare, subject to the applicable legal requirements and professional confidentiality obligations.
Legal and regulatory obligations
We process information where necessary to comply with legal obligations, including relevant healthcare, accounting and regulatory requirements.
Legitimate interests
We may process information for legitimate business purposes, such as managing our practice, maintaining security, improving our services and handling enquiries, provided these interests do not override your rights and freedoms.
Consent
Where required, we rely on your consent for specific activities, such as optional marketing communications or the use of non-essential website cookies.
Where consent is the applicable legal basis, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
The lawful basis for a particular activity depends on its purpose and circumstances. We do not assume that consent is the legal basis for every aspect of your healthcare.
York Podiatry occasionally uses Motics Copilot, an AI-assisted clinical documentation tool, to help members of our clinical team prepare clinical notes.
Motics is not used at every appointment.
How it works
When Motics is used during a consultation, it records and transcribes the conversation to help create your clinical notes. Your clinician remains responsible for reviewing the record and ensuring it is accurate and appropriate.
How your information is protected
Your consultation may contain personal and sensitive health information. According to the information provided by Motics, audio recordings are automatically deleted 48 hours after recording.
Motics states that access to session data for technical support is permitted only when express written permission has been given.
The information available to us does not establish the retention period for all transcripts or AI-generated notes. These records may be subject to different retention arrangements from the audio recording itself.
Your choice
You can raise any questions or concerns about the use of Motics with your clinician. If you do not wish to have your consultation recorded using Motics, please tell us before recording begins. We will discuss the arrangements with you, and declining its use will not affect your ability to receive treatment.
Further information
Please read our separate Motics Copilot Privacy Policy for further information about this service via the link on our home page.
We maintain clinical records to support safe, effective and continuous healthcare.
Clinical photographs, assessment measurements and other diagnostic information may be collected where relevant to your assessment, treatment, monitoring or clinical record.
We handle these records confidentially and only use or disclose them for appropriate purposes.
If we wish to use identifiable patient photographs or other clinical information for publicity, educational or promotional purposes, we will address the relevant permissions and legal requirements separately.
We do not sell your personal information.
Where necessary and appropriate, we may share information with:
We expect organisations processing personal information on our behalf to handle it appropriately and in accordance with applicable data protection requirements.
Where information is shared with another healthcare professional, we will do so on an appropriate basis and in accordance with our professional and confidentiality obligations.
We use tools to understand how visitors use our website, improve our online services and measure the effectiveness of our advertising.
Our website and digital marketing provider, HMDG, manages these tools on our behalf.
Google Analytics 4
We use Google Analytics 4 to understand how visitors interact with our website. This may include information about pages visited, website interactions, devices and approximate location.
Google Search Console
We use Google Search Console to monitor our website’s visibility and performance in Google Search and understand how people find our services online.
Google Ads conversion tracking
We use Google Ads conversion tracking to measure interactions associated with our advertising, which may include enquiries, calls and booking clicks.
HMDG has advised us that we do not intentionally send personal details such as patient names, email addresses or telephone numbers to Google Analytics or Google Ads through these tools.
However, website tracking technologies may process technical identifiers and other usage information. The information collected depends on the relevant configuration and your cookie preferences.
Cookies and your choices
Our website has a cookie consent banner that allows you to accept all cookies, reject all cookies or customise your preferences. Your choices are saved for 180 days.
Analytics and advertising cookies are configured to be set only after the required consent has been given.
Where you reject cookies, Google Consent Mode v2 may allow restricted, cookieless signals to be sent to Google, depending on the configuration. Therefore, rejecting cookies does not necessarily mean that no information of any kind is transmitted to Google.
You can find out more about how Google processes information in the Google Privacy Policy.
We use Cliniko for online booking services.
When you follow a link to the booking platform, your information may be processed by that provider in accordance with its own privacy and cookie policies.
Please refer to the provider’s policies for further information about how it handles personal information.
We retain personal information only for as long as necessary for the purposes for which it was collected, taking account of applicable legal requirements, professional guidance, clinical needs and our obligations to maintain appropriate records.
Clinical records are retained in accordance with the applicable healthcare record-retention requirements and our retention schedule.
Other information, including financial records, enquiries, website data and administrative records, is retained for the relevant period required by law or justified by the purpose for which it was collected.
Retention periods may differ according to the type of information, the age of the patient, the nature of the treatment and other relevant circumstances.
When information is no longer required, we take appropriate steps to securely delete or dispose of it, subject to any legal or professional requirement to retain it.
Audio recordings made through Motics Copilot are stated by Motics to be automatically deleted after 48 hours. This does not necessarily apply to transcripts, AI-generated notes or clinical records, which may be retained separately.
Some of our service providers may process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable data protection law. Depending on the circumstances, this may include relying on an adequacy regulation or decision, appropriate safeguards or another lawful transfer mechanism.
If you require further information about international transfers relevant to your personal information, please contact us.
We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures include appropriate access controls, staff confidentiality responsibilities and the use of systems and service providers intended to support the secure management of information.
Access to patient information is restricted to those who need it for legitimate professional or operational purposes.
Although we take reasonable steps to protect personal information, no method of electronic storage or transmission can be guaranteed to be completely secure.
Under data protection law, you may have the right to:
These rights are subject to legal conditions and exemptions. For example, we may need to retain certain clinical records to meet our legal or professional obligations, even where deletion is requested.
To exercise your rights, please contact us at info@yorkpodiatry.co.uk.
We may need to verify your identity before responding to a request. We will respond within the applicable legal time limits.
We may contact you about our services where we have an appropriate legal basis and any required consent.
You can opt out of marketing communications at any time by following the unsubscribe instructions provided or contacting us directly.
Opting out of marketing will not affect necessary communications relating to your appointments, treatment or ongoing care.
Our website may contain links to third-party websites and services, including our online booking platform and privacy notices.
When you visit another organisation’s website, its own privacy policy and terms may apply. We are not responsible for the privacy practices of third-party websites, so we encourage you to read their policies.
We may update this Privacy Policy from time to time to reflect changes in our services, systems, legal obligations or data protection practices.
The latest version will be published on our website, with the date of the most recent update shown at the beginning of the policy.
If you have questions or concerns about how we use your personal information, please contact:
Rebecca Hargreaves
Data Controller, York Podiatry Ltd
Email: info@yorkpodiatry.co.uk
We will do our best to address your concerns.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Further information is available at the Information Commissioner’s Office website.
We encourage you to contact us first if you have a concern, so that we have an opportunity to help resolve it.
