Who we are
Porch House Clinic is an independent musculoskeletal and podiatry clinic at 204 Leckhampton Road, Cheltenham, GL53 0AQ. The clinic is run by Andrew Hemming trading as Porch House Clinic, which is the "data controller" for your information.
We are registered with the Information Commissioner's Office (ICO), registration number ZC291061.
Questions about this policy or your information: email [email protected], call 01242 650810, or write to us at the address above.
What we collect, and why
When you contact us or book
Your name, contact details and the reason for your appointment, so we can reply, arrange and manage your appointments. Online bookings are handled by our booking system, Setmore, and emails by Google Workspace.
When you are our patient
To assess and treat you safely, we keep clinical records. These include your medical history, symptoms, examination findings, treatment notes and, if you have a DIERS 4D scan, your scan data and report. This is health information, which the law treats as "special category" data and protects more strictly.
When you use the chat assistant on this website
The chat assistant is an automated AI helper. What you type is sent securely to our website provider's server and processed by an AI service to generate replies. Conversations are stored so our team can review them and reply to any messages you leave, and are kept for 12 months. Please do not share detailed medical information in the chat: call or email us instead.
When you use the self-check quiz
The "Is a 4D scan right for me?" self-check runs entirely in your browser. Your answers are not saved or sent to us.
When you browse this website
We do not use advertising or analytics cookies on this website. Like all websites, our hosting provider (Cloudflare) processes basic technical information, such as your IP address and browser type, to deliver pages securely and protect against attacks. Some pages include content from other services, which may collect technical information under their own privacy policies: Google Fonts (typefaces), Google Maps (the map on our contact page) and YouTube in privacy-enhanced mode (videos about the DIERS technology).
Our legal reasons for using your information
- To provide your care: for health information, the provision of health care by a health professional (UK GDPR Article 9(2)(h)). For your other details, our contract with you to provide treatment, and our legitimate interest in running the clinic.
- To meet our legal and professional duties: for example, keeping clinical records as required by the Health and Care Professions Council and our professional bodies.
- To answer enquiries and chat messages: our legitimate interest in responding to people who contact us.
- Marketing: we only send marketing messages if you have agreed, and you can opt out at any time.
Who we share it with
We never sell your information. We only share it:
- With service providers who help us run the clinic and process data on our behalf under contract: our booking system (Setmore), email (Google Workspace), website hosting (Cloudflare), our website and chat assistant provider (CrackingSites) and the AI service it uses to generate chat replies.
- With other health professionals involved in your care and bound by professional confidentiality, such as other self-employed clinical practitioners, your GP or a consultant, or for a scan referral, with your agreement.
- Where the law requires it, or where there is a serious risk of harm to you or someone else.
Some of these providers may store data outside the UK. Where they do, they use safeguards recognised under UK law, such as approved contract clauses.
How long we keep it
- Clinical records: for adults, at least 8 years after your last appointment. For children, until their 25th birthday (or 26th if they were 17 at the end of treatment), or 8 years after the last appointment if that is later. This follows NHS records guidance, which professional bodies recommend.
- Enquiries that do not lead to an appointment: up to 12 months.
- Chat conversations: see above.
Keeping it safe
We use password-protected, access-controlled systems and only share information with people who need it to care for you or run the clinic.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct anything that is wrong
- ask us to delete your information, where we are not required to keep it
- object to, or ask us to restrict, how we use it
- withdraw your consent where we rely on it, such as for marketing
To use any of these rights, contact us using the details above. We will respond within one month, and there is normally no charge.
Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page.