PATIENT DATA PROTECTION AND PRIVACY NOTICE
We have updated this notice to reflect mandatory new data complaint handling rules introduced on June 19, 2026 following changes to the UK GDPR and Data Protection Act on February 5, 2026.
Victoria Manship MCFHP|MAFHP trading as Dittons Footcare UK GDPR Compliant / Data (Use and Access) Act 2025 /Updated June 2026
This Data Protection and Privacy Notice explains how and why we collect, use and protect your personal information when you attend a foot health appointment, purchase a product or service, contact us or otherwise engage with our practice. You will receive this notice when registering as a new patient.
ABOUT US
Victoria Manship trading as Dittons Footcare is registered with the Information Commissioner's Office (ICO) as a data controller
.
ICO Registration Number: ZA426591
Practice address: 9 Leaf Close, Thames Ditton KT7 0YQ
Email: dittonsfootcare@gmail.com
Telephone: 07849 591863
Website: www.dittonsfootcare.co.uk
1. WHAT PERSONAL DATA WE COLLECT
When you register with Dittons Footcare or book an appointment you may provide:
- Your name, contact details and postal address
- Medical history and relevant health information
- Consultation notes and treatment details
- Payment information
- Any information shared through email, WhatsApp or SMS messages or booking forms.
Special Category (Health) Data
We also collect health information, which is classified as 'special category data' under UK GDPR and is given the highest level of legal protection. This includes:
- Medical history, diagnoses, and ongoing conditions
- Current medications and known allergies
- Vascular and neurological assessment findings
- Wound care and infection records
- Mobility and disability information
- Clinical photographs of feet or nails (with your consent)
- Any other health information relevant to your foot care
Your information is store securely on an encrypted, password protected electronic system. Paper records are stored in secure filing cabinet with strict physical access controls on the premises of Dittons Footcare.
Use of AI technology for consultation notes
To support accurate record-keeping, we may use a secure, GDPR-compliant AI transcription tool during clinical appointments.
- Audio is used only to create accurate consultation notes
- Transcriptions are anonymised and checked before being added to your clinical record
- All audio and draft transcripts are permanently deleted after processing
- No patient-identifiable data is retained by the AI provider
This process helps maintain accurate, timely records while fully protecting your confidentiality.
2. WHY WE COLLECT YOUR DATA (LAWFUL BASIS)
We process your personal data under the following lawful bases:
- Legitimate interests (Article 6(1)(f) UK GDPR): We process your data to provide foot health care services and run our practice.
- Contractual necessity (Article 6(1)(b) UK GDPR): Processing is necessary to deliver the care you have engaged us to provide.
- Healthcare provision (Article 9(2)(h) UK GDPR): We process your health data because it is necessary for the provision of health care treatment.
- Consent (Articles 6(1)(a) and 9(2)(a) UK GDPR): For clinical photography, marketing communications, or any use of your data beyond direct care — where you have given us your explicit consent.
- Recognised legitimate interests — safeguarding vulnerable individuals
Article 6, Data (Use and Access) Act 2025, in force 5 February 2026:
Where processing is necessary for safeguarding vulnerable individuals, the usual balancing test is presumed satisfied. Particularly relevant for domiciliary care of frail, elderly, or at-risk patients.
3. HOW WE USE YOUR DATA
We use your information to:
- Provide, plan, and manage your foot health treatment
- Maintain accurate clinical records of your care
- Contact you about appointments, including reminders and follow-ups
- Refer you to other healthcare professionals where clinically appropriate, with your knowledge
- [With your consent] Take and store clinical photographs to monitor your treatment progress
4. WHO WE SHARE YOUR DATA WITH
We will not sell, rent, or share your personal data with third parties for marketing purposes. We may share relevant information with:
- Your GP or other healthcare professionals involved in your care, where clinically necessary
- Our software provider(s), who process data on our behalf under a Data Processing Agreement (Article 28, UK GDPR). This includes our clinical records system WriteUpp
We will always inform you if we need to share information about you beyond routine care purposes.
5. HOW LONG WE KEEP YOUR DATA
We retain your data in accordance with the following retention schedule:
Data Retention Periods
Adult clinical records — 8 years from the date of last treatment (NHS Records Management Code)
Children's clinical records — Until the patient's 25th birthday (or 26th if aged 17 at last treatment)
Deceased patient records — Minimum 8 years from date of death
Marketing consent / email lists — Until you withdraw consent, or 2 years after last engagement
Appointment records (non-clinical) — 2 years
6. YOUR RIGHTS
Under UK GDPR, you have the following rights regarding your personal data:
- Right to Access: You may request a copy of all personal data we hold about you (a Subject Access Request). We will respond within one calendar month. Where we need to clarify your request before we can respond effectively, we may contact you first — pausing the response period while we await your reply, as permitted under the Data (Use and Access) Act 2025 (★ in force 5 February 2026).
- Right to Rectification: You may ask us to correct any inaccurate or incomplete information we hold about you.
- Right to Erasure: You may ask us to delete your data. Please note that we may be unable to delete clinical records where we have a legal obligation to retain them (see retention schedule above).
- Right to Object: You may object to us processing your data based on legitimate interests. For marketing communications, this right is absolute.
- Right to Data Portability: In certain circumstances, you may request your data in a portable format.
- Right to Restrict Processing: You may ask us to restrict how we use your data while a complaint or query is being resolved.
7. NEW - DATA (USE & ACCESS) ACT 2025 Right to complain to us directly
Under the Data (Use and Access) Act 2025 (in force 19 June 2026), you have a statutory right to raise a data protection complaint directly with us before contacting the ICO. We will acknowledge your complaint within 30 days and respond without undue delay.
To raise a complaint, please see our Data Protection Complaints Procedure available on request
HOW TO EXERCISE YOUR RIGHTS
To make any request regarding your data, or to raise a concern, please contact us:
- Email: dittonsfootcare@gmail.com
- Correspondence: 9 Leaf Close, Thames Ditton KT7 0YQ
RIGHT TO COMPLAIN TO THE ICO
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
We would encourage you to contact us directly in the first instance, so we may have the opportunity to resolve your concerns.
CONTACT & DATA CONTROLLER
For the purposes of UK GDPR and the Data (Use and Access) Act 2025, Victoria Manship is the data controller for your personal information.
Email: dittonsfootcare@gmail.com
Website: www.dittonsfootcare.co.uk
KEEPING THIS NOTICE UP TO DATE
We review this Privacy Notice at least annually and whenever our practices change. The current version was last updated in August 2026.
Version: [1.0] | Date: August 2026 | Next review: August 2027
