Privacy policy

Who I am

I am Mihai Apostol, a registered osteopath with the General Osteopathic Council (registration number 21866), practising as BodyEase Manual Therapy, a sole-practitioner clinic based at 9 Hospital Bridge Road, Twickenham, TW2 5UL.

I am the data controller for the personal information described in this policy, and I am registered with the Information Commissioner's Office (registration reference ZC186080).

Contact: hello@bodyease.eu or 07746 219424.

What information I collect

Depending on how you interact with the practice, I may collect:

• Contact details: name, date of birth, address, phone number, email address, emergency contact.
• Health information: presenting complaint, medical history, medications, allergies, surgical history, pregnancy status, safety screening answers, examination findings, and treatment notes. This is "special category data" under UK GDPR and is given extra protection.
• Administrative information: your GP's details (only where you choose to provide them, for communication about your care), how you heard about the practice, and appointment/payment records.
• Communications: messages sent via WhatsApp, email, or the contact form.

Why I process your information, and my legal basis

• To assess and treat you: processing your health information is necessary for the provision of health care, under UK GDPR Article 9(2)(h), and subject to the same duty of confidentiality that applies to all registered health professionals.
• To run the practice: processing contact and administrative details (booking, reminders, invoicing) is necessary to perform my contract with you, or is in my legitimate interest in running the practice efficiently.
• Marketing communications (occasional newsletters or updates) are sent only if you have separately and explicitly opted in, and you can withdraw that consent at any time.

How long I keep your records

In line with the General Osteopathic Council's Osteopathic Practice Standards, clinical records for adult patients are retained for a minimum of 8 years from your last treatment. Records for patients under 18 are retained until their 25th birthday. After this period, records are securely deleted.

Who I share information with

Your clinical notes are kept on paper. They are held securely at the premises where you are treated, and are not stored in any cloud service or third-party clinical records system.

I do not sell your information. It is shared only with the following, each acting as a data processor on my behalf:

• Hostinger – hosting for this website and the secure database used for new-patient intake forms.
• Meta (WhatsApp Business) – used strictly for booking and administrative messages. Please avoid sharing detailed clinical information over WhatsApp; anything relevant to your care is transferred to your main clinical record.

I may also disclose information where required by law, or in a genuine emergency to protect your safety or the safety of others (for example, where a safety screening response indicates a possible medical emergency).

Your rights

Under UK GDPR, you have the right to:

• Ask for a copy of the information I hold about you, free of charge (a "subject access request").
• Ask me to correct inaccurate information.
• Ask me to erase your information, though this may be limited by my professional obligation to retain clinical records for the periods described above.
• Withdraw consent to marketing communications at any time.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your information has been handled incorrectly.

To exercise any of these rights, contact hello@bodyease.eu.

Safety and confidentiality

All clinical information is treated as strictly confidential, consistent with the General Osteopathic Council's Osteopathic Practice Standards. I am the only person with access to your clinical record.

Changes to this policy

I may update this policy from time to time.