Privacy Policy



1. Introduction & Scope

Nguyen’s Osteopathic Clinic (“we”, “our”, or “the Clinic”), operating inside St James Pharmacy & Travel Clinic in Woolwich, London, is committed to safeguarding the privacy, confidentiality, and security of all personal and medical information entrusted to us by our patients.

As a healthcare practice regulated under the Osteopaths Act 1993 by the General Osteopathic Council (GOsC), we process special category health data under the strictest clinical and legal protocols required by UK law, including the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and the Access to Health Records Act 1990.

2. The Data Controller

The designated Data Controller responsible for your personal health records is:

• Practitioner: Austin Duy Nguyen, M.Ost (Master of Osteopathy)
  Professional Registration: General Osteopathic Council (GOsC Reg. No. 12332)
  Clinic Address: St James Pharmacy, 52 Powis Street, Woolwich, London SE18 6LQ
  Email: nguyensosteopathy@gmail.com
  Telephone: 07882 843513
  Authoritative Primary Web: https://www.nguyensosteopathy.com/

3. What Personal & Medical Data We Collect

To provide safe, accurate, and effective osteopathic assessment and treatment, we must collect and maintain comprehensive clinical records. The data we collect includes:

• Identification & Contact Information: Full name, date of birth, residential address, telephone number, email address, and emergency contact details.
• Clinical & Medical History: Presenting symptoms, onset, pain characteristics, functional limitations, past medical and surgical history, prescription medications, allergies, imaging reports (MRI, X-ray, Ultrasound), and any relevant red-flag contraindications.
• Consultation & Objective Examination Records: Postural observations, orthopaedic and neurological examination findings, range of motion tests, clinical differential diagnoses, and treatment notes from each session.
• Consent Documentation: Signed or verbal informed consent records regarding proposed treatment modalities (e.g. joint articulation, spinal manipulation, Western medical acupuncture, focused shockwave therapy).
• Financial & Billing Data: Records of fees paid, payment dates, and itemised receipts provided for private health insurance reimbursement (we do not store full payment card numbers).

4. Lawful Basis for Processing Your Health Data

Under the UK GDPR, medical information is classified as Special Category Personal Data. We process your information strictly under the following lawful bases:

• Article 6(1)(b) — Contractual Healthcare Provision: Processing is necessary for the performance of our agreement to assess, treat, and support your musculoskeletal health.
• Article 9(2)(h) — Provision of Health or Social Care Treatment: Processing is necessary for the purposes of preventive medicine, medical diagnosis, the provision of health care or treatment, and the management of healthcare systems.
• Article 6(1)(c) — Statutory Clinical Legal Obligation: As a GOsC-registered healthcare professional, Austin Duy Nguyen has a statutory duty under UK osteopathic regulations to keep full, contemporaneous, and accurate patient health records.

5. Confidentiality & Information Sharing

All patient consultations, clinical examinations, and medical records are held in the strictest medical confidence. We never sell, rent, or trade your personal or health data to third parties for marketing purposes.

Your medical information will only be shared under the following limited and lawful circumstances:

• With Other Healthcare Professionals (With Your Consent): If we identify a need for medical imaging, consultant referral, or inter-disciplinary communication with your GP, orthopaedic consultant, physiotherapist, or imaging centre, we will share relevant clinical notes only after obtaining your explicit permission.
• Emergency Safeguarding / Vital Interests: Where disclosure is vital to protect your life or the safety of another individual (UK GDPR Article 9(2)(c)), or in statutory safeguarding child protection cases.
• Legal / Regulatory Subpoena: Where disclosure is mandated by an enforceable UK court order or formal regulatory proceedings under the General Osteopathic Council.

6. Data Storage & Security Protocols

We implement rigorous technical and organizational security measures to protect your health records against unauthorized access, loss, or misuse:

• Electronic medical records and online appointment booking are managed via encrypted, password-protected clinical management platforms hosted on ISO 27001-compliant servers within the UK and European Economic Area (EEA).
• Access to patient clinical files is restricted exclusively to Austin Duy Nguyen and authorized clinical personnel bound by professional confidentiality obligations.
• All digital communications and booking forms utilize Secure Sockets Layer (SSL / 256-bit TLS) encryption.

7. Statutory Medical Record Retention Periods

In accordance with the General Osteopathic Council (GOsC) guidance and UK Department of Health clinical records standards:

• Adult Records: Retained for a minimum of 8 years from the date of your last clinical treatment.
• Paediatric Records (Children & Young People): Retained until the patient reaches their 25th birthday (or until 8 years after the last treatment if the patient was 17 years old at the conclusion of treatment).
• Upon the expiration of the statutory retention period, digital records are permanently wiped and physical notes are securely shredded.

8. Your Rights Under UK Data Protection Law

Under the UK Data Protection Act 2018 and UK GDPR, you have the following rights regarding your personal information:

• Right of Access (Subject Access Request): You have the right to request a complete copy of your clinical treatment records. We will provide this free of charge within one calendar month of identity verification.
• Right to Rectification: You may request corrections to factual errors (such as an incorrect phone number or spelling of your name). Clinical notes reflecting practitioner observations cannot be retroactively erased, but patient addendums can be formally appended.
• Right to Restriction: You may request that we temporarily restrict the processing of your data while an accuracy query is being reviewed.
• Note Regarding the “Right to Erasure” (Right to be Forgotten): Under UK law, the right to erasure does not apply to clinical medical records held under Article 9(2)(h) and statutory healthcare retention mandates.

9. Cookies & Website Usage

Our website uses strictly essential technical cookies necessary for page navigation, security verification, and online appointment booking. We do not use intrusive third-party commercial tracking cookies. You may disable cookies in your browser settings at any time, although this may affect booking functionality.

10. Inquiries, Data Requests & Complaints

If you have any questions about this Privacy Policy, wish to exercise a Subject Access Request, or have concerns regarding how your data is handled, please contact our Data Controller:

You also have the statutory right to lodge a formal complaint with the UK supervisory authority for data protection:

Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · Website: https://ico.org.uk