Last updated: November 2026

This page explains what personal information we collect at One Chiropractic, why we collect it, how we look after it and the choices you have. We’ve kept it in plain English. If anything isn’t clear, email hello@onechiropractic.co.uk and we’ll explain.

Who we are

One Chiropractic is run by Dr Paul Holmes, a chiropractor registered with the General Chiropractic Council (registration number 03786). Neuro Sync Ltd (company number SC574831) is the data controller for the information described here. That means we decide how it’s used and we’re responsible for looking after it.

Suite 76, Bonnington Bond, 2 Anderson Place, Edinburgh EH6 5NP
Email: hello@onechiropractic.co.uk
Phone: 0131 202 2345

The information we collect

When you book or get in touch: your name, contact details, date of birth, appointment details and anything you tell us in a message or through our website contact form.
When you come for care: your health history, symptoms, examination findings, diagnosis, care plan and notes on the treatment and advice you receive, your consent, and any letters or reports to or from other health professionals. Photos or videos are only taken if they’re part of your assessment and you’ve agreed. Health information is “special category” data under data protection law, and we treat it with extra care.
When you pay: what you’ve paid for and when. Card payments are handled by our payment provider, so we never see or store your full card number.
When you phone: our calls are answered by a call answering service, who take your name, number and reason for calling and pass the message on to us.
When you use our website: if you accept cookies, information about how you use the site, such as the pages you visit, your device and browser, your approximate location and how you found us (for example, from a Google ad). See “Cookies” below.

How we use it, and why we’re allowed to

To assess and treat you. This is the care you’ve asked us to provide. For your health information, the law allows this because it’s healthcare provided by a regulated professional under a duty of confidentiality (UK GDPR Article 9(2)(h)).
To manage your appointments, including booking, reminders, rescheduling and memberships, as part of providing the service you’ve asked for.
To keep clinical records for as long as our regulator, the General Chiropractic Council, requires.
To take payments and keep accounts, as part of our service and to meet our legal and tax obligations.
To reply to your enquiries. We have a legitimate interest in answering questions from people who contact us.
To understand how our website is used and how our adverts perform, only if you’ve agreed through the cookie banner.
To share information with your GP or another health professional, only with your permission, apart from the rare situations described below.

We don’t sell your information, and we won’t send you marketing unless you’ve told us you’re happy to hear from us. You can opt out at any time.

Who we share it with

We use a small number of trusted companies to run the clinic. They only handle your information on our instructions and must keep it secure and confidential:

PracticeHub, our practice management system, for online booking, patient records and appointment reminders
Stripe, for card payments
Google, for clinic email, website analytics (Google Analytics), advertising (Google Ads) and the map on our website
our call answering service
our website host and the IT and admin software we use to run the clinic
our accountant, who sees financial information only, never your clinical notes

We’ll only share your health information with another health professional, such as your GP, with your permission. Very occasionally we may have to share information without your consent: if the law requires it, or to protect you or someone else from serious harm. If that happens, we’ll tell you first wherever we can.

Information processed outside the UK

Some of our providers, such as Google and Stripe, may process information outside the UK. When they do, it’s protected by safeguards recognised under UK law, such as UK adequacy regulations or approved contract terms.

How long we keep it

Clinical records: 8 years from your last visit, in line with General Chiropractic Council guidance. For children, until their 25th birthday (or 26th if they were 17 when treatment ended), if that’s longer.
Payment and accounting records: 6 years, for tax purposes.
Enquiries from people who don’t go on to book: up to 12 months.
Website analytics: up to 14 months.

After that, information is securely deleted.

Keeping it safe

Your records are kept in secure, password-protected systems. Only people who need to see them can, and everyone who works with us is bound by confidentiality.

Your rights

You have the right to:

see a copy of the information we hold about you, free of charge
ask us to correct anything that’s wrong
ask us to delete your information. We’ll do this where we can, but we’re required to keep clinical records for the periods above
ask us to limit or stop using your information in certain ways
ask for a copy in a format you can pass to another practitioner
withdraw your consent at any time, for example to cookies or to us contacting your GP

To use any of these rights, email hello@onechiropractic.co.uk. We’ll reply within one month, and we may ask you to confirm your identity first.

If you’re unhappy with how we’ve handled your information, please talk to us first and we’ll do our best to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Cookies

Cookies are small files stored on your device when you visit a website. Essential cookies make the site work and remember your cookie choices. Everything else is only used if you accept it in the cookie banner, and you can change your mind at any time through the cookie settings on our site or by clearing cookies in your browser.

Cookie	Provider	What it does
cookieadmin_consent	One Chiropractic	Essential. Remembers your cookie choices.
_ga, _ga_XXJK13QHQV	Google Analytics	Shows us how visitors use the site so we can improve it. Kept for up to 2 years.
_gcl_au	Google Ads	Tells us whether a visit came from one of our adverts and led to a booking. Kept for up to 90 days.

The map on our website is provided by Google Maps, and our online booking and payment system (PracticeHub and Stripe) may set cookies needed for booking and secure payment. These are covered by Google’s and Stripe’s own privacy policies.

Children

If a patient is under 16, we’ll ask a parent or guardian to complete forms and give consent on their behalf, and we’ll discuss their care with them.

Changes to this policy

We’ll update this page if anything changes. The date at the top shows when it was last updated.