Privacy Policy
Who we are
Walnut Grove Limited (“Walnut Grove Clinic”, “we”, “us”) is a multi-disciplinary health and wellbeing clinic based in Portishead, offering clinical therapies, complementary treatments and wellbeing classes delivered by independent practitioners and employed staff. Walnut Grove Clinic also operates Walnut Grove Studio, a dedicated space for group classes and movement-based sessions.
Walnut Grove Wellbeing Community Interest Company (“Walnut Grove CIC”) is a separate registered company that runs community classes and sessions. Walnut Grove CIC has its own board of directors and is not owned by Walnut Grove Limited.
This policy covers personal data collected by both organisations. Where a section applies to only one organisation, this is stated. Where it applies to both, we refer to them together as “Walnut Grove”.
Walnut Grove Limited
Slade Road, Portishead, Bristol, BS20 6BB.
Walnut Grove Wellbeing Community Interest Company
Slade Road, Portishead, Bristol, BS20 6BB.
For the purposes of UK data protection law, Walnut Grove Limited and Walnut Grove Wellbeing Community Interest Company are working towards acting as joint controllers for personal data shared between the two organisations, such as contact details held on Jane App used to book classes and contact participants. The organisations are agreeing the respective responsibilities of each party in relation to this data, and this policy will be updated once that agreement is finalised.
Data Protection Officer (acting for both organisations)
Denise Riddell
Telephone: +44 1275 818303
Email: denise@walnutgroveclinic.com
What this policy covers
This privacy notice explains what personal data we collect about you, why we collect it, how we use and store it, who we share it with and how long we keep it.
It applies to:
- Patients and clients receiving treatment at Walnut Grove Clinic
- People attending classes or sessions at Walnut Grove Studio or Walnut Grove CIC
- People who enquire about our services via our website, telephone or in person
- People who sign up to our newsletter
- Visitors to our website
Walnut Grove Limited and Walnut Grove CIC are formalising an arrangement to share personal data, specifically contact details held on Jane App, so that Walnut Grove Limited reception can contact CIC participants and manage bookings on the CIC’s behalf. This data is held and protected to the same data protection standards described throughout this policy, regardless of which organisation collected it.
The personal data we collect
Treatment and clinical data
To provide you with care at Walnut Grove Clinic, we need to collect personal and medical information. Depending on the nature of your treatment, this may include:
- Your name, date of birth, address, telephone number and email address
- Medical history, current health conditions, medications and relevant lifestyle information
- Clinical notes, assessment findings and treatment records
We only collect information that is relevant and necessary for your care. Your data is held securely and access is restricted to practitioners and staff directly involved in your care or the administration of your treatment. Non-clinical administrative staff who handle data have signed a GDPR data processor agreement.
Class and session data
To book you onto a class or session at Walnut Grove Studio or Walnut Grove CIC, we collect your name, contact details, and any relevant health or accessibility information you choose to share with us, so that instructors can support you safely.
Walnut Grove CIC participants complete a health form before attending classes. This is scanned and stored on Jane App in the same way as Studio class information, so that instructors can support you safely. Class and attendance numbers are also recorded on Jane App to help us understand how popular each class is.
Booking and appointment data
Online appointments and class bookings are managed through Jane App (Jane Software Inc.), an independent clinic management and booking platform. When you book online, personal information you provide is held and processed by Jane App on our behalf under a data processing agreement. Please refer to Jane App’s privacy policy for further details.
Walnut Grove CIC bookings are taken by telephone rather than online. Your details are then recorded on Jane App by a member of staff, and are held and protected in the same way as bookings made directly online.
Contact form enquiries
If you contact us via the enquiry form on our website, the information you submit (typically your name, email address and message) is transmitted to us via Brevo (formerly Sendinblue), an email delivery service acting as our data processor. This data is not stored on our website server. Brevo retains a transmission log in accordance with their own data retention policy.
The same contact form on this website (walnutgroveclinic.com) is used for enquiries relating to Walnut Grove Clinic, Walnut Grove Studio and Walnut Grove CIC. Enquiries submitted about Walnut Grove CIC through this website are received by Walnut Grove reception, who pass these on to the relevant Walnut Grove CIC admin team for handling.
Telephone enquiries
We use a telephone answering service to handle calls when reception is unavailable. This service acts as a data processor on our behalf and is contracted to handle your information securely. Voice messages are stored on the servers of our telephone answering provider, Intouch Systems, and are deleted once your message has been processed.
Newsletter subscriptions
If you choose to sign up to our newsletter, your name and email address will be stored and processed by MailerLite, our email marketing platform. You will be asked for your explicit consent at the point of sign-up. You can unsubscribe at any time using the link in any newsletter we send, or by contacting us directly.
Website analytics
Our website uses Google Analytics 4 (GA4), implemented via Google Tag. This collects anonymised and pseudonymised data about how visitors use our website, including pages visited, time spent on site and approximate geographic location. This data is used solely to help us understand and improve our website. Analytics cookies are only placed with your consent. See our Cookie Policy for full details.
Why we use your data and our lawful basis
| Purpose | Data type | Lawful basis |
|---|---|---|
| Providing clinical treatment and care (Clinic) | Medical and personal data | Article 9(2)(h) UK GDPR, health treatment; Contract |
| Booking classes and sessions (Studio and CIC) | Contact and booking data | Contract |
| Responding to enquiries | Contact details | Legitimate interests |
| Sending newsletters | Name and email | Consent |
| Analysing website usage | Pseudonymous analytics data | Consent |
| Meeting legal and regulatory obligations | Clinical records | Legal obligation |
| Accounting and payment processing | Financial data | Legal obligation; Contract |
| Processing insurance claims | Authorisation code, membership and policy number | Consent; Contract |
Where we rely on consent as our lawful basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Who we share your data with
We do not sell your personal data. We only share it in the following circumstances.
Data processors. We use trusted third-party service providers to help us operate our clinic, studio, community classes and website. Each is contracted to handle your data securely and only as instructed by us:
- Jane App, appointment and class booking, clinic management
- Brevo, contact form email delivery
- MailerLite, newsletter and email marketing
- Google, website analytics (GA4 via Google Tag)
- Intouch Systems, telephone answering service
- Xero, accounting and invoicing
- Squareup Europe Ltd, in-person card payments taken at the clinic
- Stripe, card payments taken remotely via Jane App, for example after a class or session
Clinical referrals. With your explicit consent, we may share relevant clinical information with your GP, a medical consultant or another healthcare provider involved in your care.
Insurance claims. Where you choose to claim through private medical insurance and give your consent, we may share relevant information, such as your authorisation code, membership number and policy number, directly with your insurance provider so that we can invoice them. The method of sharing depends on the individual insurer’s own process.
Walnut Grove CIC. Walnut Grove Limited and Walnut Grove CIC share contact details held on Jane App, so that Walnut Grove reception can contact CIC participants and manage bookings on the CIC’s behalf. See “What this policy covers” above for further detail on this arrangement.
Legal requirements. We may be required to share data with regulatory bodies, professional governing bodies, insurers or law enforcement where we have a legal obligation to do so.
International data transfers
Walnut Grove is based in the United Kingdom. We aim to keep your data within the UK and European Economic Area (EEA) wherever possible.
Some third-party processors we use, in particular Google, may transfer or store data outside the UK or EEA. Where this occurs, it is governed by appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or EU Standard Contractual Clauses (SCCs). We only use processors who can demonstrate adequate data protection standards.
How long we keep your data
| Data type | Retention period |
|---|---|
| Adult clinical records (Clinic) | 8 years from the end of treatment |
| Children’s clinical records (Clinic) | Until the patient reaches the age of 25 |
| Class and session booking data (Studio and CIC) | 7 years from the date of your last class or session |
| Contact form enquiries | As retained by Brevo per their data retention policy |
| Newsletter subscriber data | Until you unsubscribe or request deletion |
| Website analytics data | As per Google Analytics 4 data retention settings (default 14 months) |
After the relevant retention period, personal data is securely deleted, unless we are required to retain basic information to meet a continuing legal or regulatory obligation. For Studio and CIC class and session booking data, deletion after the 7 year period takes place on request. Requests must be submitted in writing by the data owner or, where applicable, their legal guardian.
Children and young people
Walnut Grove Clinic treats patients of all ages, including children and babies. Where a patient is under 18, consent for treatment is sought from a parent or legal guardian before treatment begins. Clinical records for patients who were under 18 at the time of treatment are retained until the patient reaches the age of 25.
Walnut Grove Studio and Walnut Grove CIC classes are for adults aged 18 and over. Eligibility to attend is assessed by instructors, who reserve the right to refuse or withdraw access to a class where they consider it unsafe or inappropriate for that individual.
Your rights under UK GDPR
You have the following rights in relation to the personal data we hold about you:
Right of access. You can request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR). There is no charge for this request. You will need to provide proof of identity. Please contact our Data Protection Officer using the details below.
Right of rectification. You can ask us to correct any personal data we hold about you that is inaccurate or incomplete.
Right to erasure. In certain circumstances you can ask for the data we hold about you to be erased from our records. This right is not absolute and may be limited by our legal obligation to retain clinical records.
Right to restrict processing. Where certain conditions apply, you have the right to ask us to limit how we use your data.
Right to data portability. You have the right to receive a copy of your data in a portable format and to have it transferred to another organisation where technically feasible.
Right to object. You have the right to object to certain types of processing, including direct marketing. If you no longer wish to receive our newsletter, you can unsubscribe at any time using the link in any email we send.
Rights related to automated decision-making. Walnut Grove does not use automated decision-making or profiling.
To exercise any of these rights, please contact our Data Protection Officer using the details at the top of this policy. If your enquiry relates to Walnut Grove CIC, please state this so we can direct your request correctly.
Cookies
Our website uses cookies. Analytics and non-essential cookies are only placed with your consent via our cookie consent tool. For full details of the cookies we use, what they do and how to manage your preferences, please see our Cookie Policy.
Data security
We take the security of your personal data seriously. We maintain appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure.
Should a personal data breach occur that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and report to the Information Commissioner’s Office (ICO) where required by law.
Contact us
To exercise your data rights, raise a concern or ask a question about how we handle your data, please contact:
Denise Riddell, Data Protection Officer
Telephone: +44 1275 818303
Email: denise@walnutgroveclinic.com
Address: Walnut Grove Limited, Slade Road, Portishead, Bristol, BS20 6BB
Complaints
If you have a concern about how we handle your personal data, please contact us in the first instance. If you remain unsatisfied, or do not receive a response within 30 days, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
ICO contact details:
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: +44 303 123 1113
Website: ico.org.uk/make-a-complaint
Changes to this policy
We may update this privacy policy from time to time. Any changes will be published on this page with an updated date at the top. We encourage you to review this policy periodically.