Skip to content Skip to footer

The Pain Clinic (website url address: appreciates your business and trust. Please read this Privacy Policy, providing consent to both documents in order to have permission to use our services.

Updated January 2024.
This document sets out policy for The Pain Clinic.


The Pain Clinic Telehealth Consultations (also referred to as “we”, “us” or “our”) is the trading name of The Pain Clinic. Our registered address is Unit 3, Woodgrove Farm, Fulbrook Hill, Fulbrook, Burford OX18 4BH.


This Policy is designed to help you understand what kind of information we collect in connection with our services and how we will process and use this information. In the course of providing you with services we will collect and process information that is commonly known as personal data.

This Policy describes how we collect, use, share, retain and safeguard personal data.

This Policy sets out your individual rights; we explain these later in the Policy but in summary these rights include your right to know what data is held about you, how this data is processed and how you can place restrictions on the use of your data.


Personal data is information relating to an identified or identifiable natural person. Examples include an individual’s name, age, address, date of birth, gender and contact details.

Personal data may contain information which is known as special categories of personal data. This may be information relating to and not limited to an individual’s health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, or data relating to sexual orientation.


In order for us to provide and administer the best healthcare services for you, we will collect and process personal data about you. We will collect, hold and process personal data such as an individual’s name, address, date of birth, gender, contact details and address along with data relating to your personal health, wellbeing, ethnicity, medication or other statutory required data.

We may also need to collect personal data relating to others, such as your insurers or general practitioner in order to satisfy legal or regulatory requirements. In most circumstances, you will provide us with this information. Where you disclose the personal data of others, you must ensure you are entitled to do so.

We will not share your personal data with third parties for marketing purposes.

We may share personal data with others, such as your insurers or solicitors, but always with your consent, or legally, when we are required to do so by law.

Where we collect data directly from you, we are considered to be the controller of that data i.e. we are the data controller.

Where we use third parties to process your data, these parties are known as processors of your personal data.

We use a company named Cliniko, who provide a web based highly secure electronic patient record system. We also use Cliniko to send secure service emails to our clients.

These companies are GDPR compliant and adhere to the strictest rules regarding confidentially and patient data.

A data ‘controller’ means the individual or organisation which, alone or jointly with others, determines the purposes and means of the processing of personal data.

A data ‘processor’ means the individual or organisation which processes personal data on behalf of the controller.

If you object to the collection, processing and use of your personal data we may be unable to provide you with all our healthcare services.

For the purposes of meeting the Data Protection Act 2018 territorial scope requirements, the United Kingdom is identified as the named territory where the processing of personal data takes place, ie, your data is not stored outside of the UK.


We are legally obliged to collect, process and hold personal data when assessing, examining or administrating healthcare under UK Statutory health care regulations. We require this data in order to be professionally informed about you and your health, to ensure we can provide you with the best healthcare service we can.


The retaining of data is necessary where required for contractual, legal or regulatory purposes. Sometimes we may need to retain your data for longer, for example if we are representing you or defending ourselves in a legal dispute or as required by law or where evidence exists that a future claim may occur.

Client records shall be kept for at least 8 years following the last occasion on which treatment was given. In the case of treatment to minors, it is advisable that records should be kept or at least 7 years after they reach the age of majority (18).

The Statute of Limitation in the UK (i.e. time when an individual is able to bring a claim) is 6 years for certain injury claim situations, or 6 years after the individual reaches the age of majority in the case of minors. However, these 6 years start from the date that the injury was discovered, not from the time that the alleged incident that caused it occurred. There are also instances, for example if treating a vulnerable client, where the statute may be overturned. Your records are your best line of defence in any claim situation hence the need to keep these for at least 7 years. It will be for you to determine, in view of your own client base, whether you choose to keep the records for longer than the 7 years noted in the policy wording, and then note this in your Privacy Notice for your clients.

There are provisions under the GDPR with regards to keeping records to defend yourself in a claim situation ( gdpr/individual-rights/right-to-erasure/ – When can I refuse to comply with the right of erasure), which clearly give you the right to hold your client records to comply with your insurance Terms and Conditions, should your client make a request for them to be deleted under their Right of Erasure.


This will only apply if you have provided us with consent and asked us to pass on your personal data to a third party abroad.


Individuals are provided with legal rights governing the use of their personal data. These grant individuals the right to understand what personal data relating to them is held, for what purpose, how it is collected and used, with whom it is shared, where it is located, to object to its processing, to have the data corrected if inaccurate, to take copies of the data and to place restrictions on its processing. Individuals can also request the deletion of their personal data.

These rights are known as Individual Rights under the Data Protection Act 2018. The following list details these rights:

– The right to be informed about the personal data being processed;

– The right of access to your personal data;

– The right to object to the processing of your personal data

– The right to restrict the processing of your personal data;

– The right to rectification of your personal data;

– The right to erasure of your personal data;

– The right to data portability (to receive an electronic copy of your personal data);

– Rights relating to automated decision making including profiling.

Individuals can exercise their Individual Rights at any time. As mandated by law we will not charge a fee to process these requests. However, if your request is considered to be repetitive, wholly unfounded and/or excessive, we are entitled to charge a reasonable administration fee.

In exercising your Individual Rights, you should understand that in some situations we may be unable to fully meet your request, for example if you make a request for us to delete all your personal data, we may be required to retain some or all data for regulatory and other statutory purposes.

You should understand that when exercising your rights, a substantial public or vital interest may take precedence over any request you make. In addition, where these interests apply, we are required by law to grant access to this data for law enforcement, legal and/or health related matters.​


We will take all appropriate technical and organisational steps to protect the confidentiality, integrity, availability and authenticity of your data, including when sharing your data with any authorised third parties.


We may sell, transfer or otherwise share some or all of our assets including your Personal Data in connection with an acquisition, merger or sale of some or all of our assets. The information transferred and shared remains subject to the promises made in any pre-existing Privacy Policy


If you are dissatisfied with any aspect of the way in which we process your personal data please contact our Data Protection Officer. You also have the right to complain to the UK’s data protection supervisory authority, the Information Commissioner’s Office (ICO). The ICO may be contacted via its website which is, by live chat or by calling their helpline on 0303 123 1113.


If you have any questions regarding this Policy, the use of your data and your Individual Rights please contact Danielle Pain, The Pain Clinic at Unit 3, Woodgrove Farm, Fulbrook Hill, Fulbrook, Burford OX18 4BH

Or by email at [email protected]

Embedded Content

Pages on this site may include embedded content, like YouTube videos, for example. Embedded content from other websites behaves in the exact same way as if you visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website. Below you can find a list of the services we may use:


The Facebook page plugin may be used to display our Facebook timeline on our site. Facebook has its own cookie and privacy policies over which we have no control. There is no installation of cookies from Facebook and your IP is not sent to a Facebook server until you consent to it. See their privacy policy here: Facebook Privacy Policy .


We may use the Twitter API to display our tweets timeline on our site. Twitter has its own cookie and privacy policies over which we have no control. Your IP is not sent to a Twitter server until you consent to it. See their privacy policy here: Twitter Privacy Policy .


We may use YouTube videos embedded on our site. YouTube has its own cookie and privacy policies over which we have no control. There is no installation of cookies from YouTube and your IP is not sent to a YouTube server until you consent to it. See their privacy policy here: YouTube Privacy Policy.