Skip to main content

Privacy Policy

Last updated: 2 October 2026

1. Introduction

Burton Clinic Limited (“Burton Clinic”, “we”, “us” or “our”) is committed to protecting your privacy and maintaining the confidentiality of your personal information.

This Privacy Policy explains how we collect, use, store, share and protect your information when you visit our website, contact us, make an enquiry, book an appointment or receive treatment.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable legislation.

This policy applies to our website, https://www.burtonclinic.co.uk/, and our associated services.

2. Who We Are

Burton Clinic Limited is the data controller responsible for determining how and why your personal information is processed in connection with our services.

Our details

For questions about this policy or your personal information, please contact us using the details above.

3. Definitions

For the purposes of this policy:

Personal data: Information relating to an identified or identifiable individual, such as your name, contact details or certain online identifiers.

Special category data: Personal information requiring additional protection, including information about your physical or mental health.

Processing: Any operation performed on personal information, including collection, recording, storage, use, sharing and deletion.

Data controller: The organisation responsible for determining the purposes and means of processing personal information.

Data processor: An organisation processing personal information on behalf of a data controller.

Data subject: The individual to whom personal information relates.

4. Information We Collect

Depending on how you interact with Burton Clinic, we may collect the following categories of information.

Identity and contact information

Your name, date of birth, postal address, telephone number, email address and other relevant contact details.

Health and clinical information

Where necessary to provide healthcare services, we may collect medical histories, information about symptoms and medical conditions, assessment findings, treatment notes and other relevant clinical information.

Health information is treated as confidential and receives additional protection under data protection legislation.

Appointment and booking information

Appointment dates, booking history, cancellations, appointment preferences and relevant referral information.

Enquiry information

Information you voluntarily provide when contacting us, requesting a free discovery call, submitting a website form or communicating with our team.

Technical and website information

Depending on your interaction with our website and your cookie preferences, we may process:

  • IP addresses and approximate geographical information.
  • Browser, device and operating-system information.
  • Website usage and interactions.
  • Information about how visitors reach our website.
  • Cookie identifiers and associated technical information.

Marketing preferences

Where applicable, we may record your preferences regarding optional communications, downloadable resources and website tracking.

We only collect information appropriate to the relevant purpose.

5. How We Collect Information

We collect personal information through several channels, including:

  • Online appointment bookings.
  • Website enquiry forms, including free discovery-call requests.
  • Telephone calls and email correspondence.
  • In-person consultations and treatment.
  • Downloadable resources and voluntary email subscriptions, where offered.
  • Website analytics and advertising measurement technologies, subject to applicable consent requirements.
  • Referrals and communications from other healthcare professionals, where appropriate and lawful.

Information may be collected directly from you or, where appropriate, from an authorised representative or another healthcare provider.

6. How and Why We Use Your Information

We process personal information for the following purposes.

Healthcare and treatment

To arrange appointments, undertake assessments, provide treatment, maintain clinical records and communicate with patients about their care.

Appointment administration

To manage bookings, confirmations, cancellations and appointment-related communications.

Responding to enquiries

To respond to telephone, email and website enquiries, including requests for free discovery calls.

Providing requested resources

To provide downloadable materials or other information that you have specifically requested.

Marketing communications

To send optional marketing communications where we have an appropriate legal basis and comply with applicable electronic marketing requirements.

You can unsubscribe from optional marketing communications at any time.

Website improvement

To understand website performance, maintain security and improve the experience we provide to visitors.

Advertising measurement

Where the necessary consent has been provided, to understand whether our advertising generates relevant website interactions and enquiries.

Legal and professional obligations

To comply with applicable healthcare, accounting, tax, regulatory and other legal requirements.

We do not sell patient records or use confidential clinical information to create advertising audiences.

7. Our Legal Bases for Processing

We rely on different legal bases depending on the nature and purpose of the processing.

Legal basis Examples of processing
Contract Arranging appointments and providing requested services.
Legal obligation Maintaining records and meeting applicable legal or regulatory requirements.
Legitimate interests Responding to appropriate enquiries, maintaining website security and managing our business, where those interests are not overridden by your rights.
Consent Optional website analytics, advertising technologies and certain marketing communications, where required.

Processing health information

Information about your health is classified as special category data under UK GDPR.

In addition to an appropriate Article 6 legal basis, we rely on an applicable Article 9 condition when processing health information.

Where appropriate, this includes processing necessary for the provision of healthcare by, or under the responsibility of, an appropriately qualified professional subject to confidentiality obligations.

Other lawful conditions may apply in particular circumstances.

We do not rely on cookie consent as the legal basis for providing clinical treatment or maintaining necessary medical records.

Withdrawing consent

Where processing relies on your consent, you may withdraw that consent at any time.

Withdrawing consent does not affect processing that was lawful before consent was withdrawn or processing that is justified by another applicable legal basis.

8. Medical Records and Confidentiality

We recognise the sensitive nature of medical information and our professional obligations to protect patient confidentiality.

We implement appropriate technical and organisational measures to protect clinical information against unauthorised access, loss, misuse and disclosure.

Access to medical records is restricted to authorised individuals who require the information for legitimate clinical or administrative purposes.

We may share relevant clinical information with other healthcare professionals where appropriate and lawful, taking account of applicable confidentiality requirements and your circumstances.

We do not disclose medical records to Google Analytics, Google Ads or other advertising platforms for targeted advertising.

9. Appointment Booking and Cliniko

We use Cliniko to support our appointment-booking and practice-management processes.

When you book an appointment online, information submitted through the booking system may include your identity, contact information, appointment preferences and other details relevant to your booking.

This information is processed in accordance with the applicable arrangements between Burton Clinic and Cliniko.

Cliniko’s privacy information is available at:

https://www.cliniko.com/policies/privacy/

We may use privacy-conscious measurement to understand whether visitors successfully complete online bookings.

Where such measurement is implemented, it will be subject to appropriate consent and configured to avoid deliberately transmitting patient names, contact details, medical conditions or other sensitive booking information to advertising platforms.

10. Website Enquiries and Gravity Forms

Our website uses Gravity Forms to manage certain enquiries, including requests for free discovery calls.

When you submit an enquiry, we use the information you provide to respond to your request and, where appropriate, arrange further contact.

Enquiry information may be accessible to authorised Burton Clinic personnel and relevant website service providers.

We may measure successful form submissions to understand website and advertising performance, subject to applicable consent requirements.

Our marketing measurement is intended to record the completion of an enquiry rather than the personal or medical information contained within it.

Submitting an enquiry does not automatically subscribe you to unrelated marketing communications.

11. Google Analytics, Google Ads and Google Tag Manager

We use Google services to understand website performance and advertise our services.

Google Analytics 4

Google Analytics helps us understand how visitors interact with our website.

Depending on our configuration and your consent preferences, information processed may include website interactions, device information, approximate location and online identifiers.

Optional analytics technologies are subject to the applicable consent requirements.

Google Ads

Google Ads enables us to advertise Burton Clinic’s services and measure the effectiveness of those advertisements.

Where appropriate consent has been provided, conversion measurement may record relevant interactions, such as eligible website enquiries.

We do not intentionally transmit patient names, email addresses, medical histories or other sensitive patient information to Google Ads.

We do not use patient medical information to create remarketing audiences.

Google Tag Manager

Google Tag Manager helps us manage website measurement technologies.

Individual technologies managed through Google Tag Manager must comply with our consent requirements and privacy safeguards.

Healthcare privacy

Because our website concerns healthcare services, we take additional precautions to avoid disclosing sensitive information through website tracking.

This includes reviewing form tracking, booking-related events and the information transmitted to analytics and advertising providers.

Further information

Google’s privacy information is available at:

https://policies.google.com/privacy

12. Cookies and Consent

Our website uses cookies and similar technologies.

Some technologies are essential for the website to function correctly.

Others help us understand website usage and measure advertising effectiveness.

Where required by law, we obtain your consent before activating optional analytics or advertising technologies.

You can accept, reject or customise optional cookies using our cookie-consent banner.

You can also change or withdraw your preferences using the cookie settings available on our website.

Rejecting optional cookies will not prevent you from accessing our healthcare services, although certain non-essential website features may be affected.

For further information about the technologies we use, please read our Cookie Policy:

https://www.burtonclinic.co.uk/cookie-policy/

13. Sharing Your Information

We only share personal information where there is an appropriate reason and lawful basis.

Depending on the circumstances, recipients may include:

  • Booking and practice-management providers.
  • Authorised healthcare professionals.
  • Website hosting and maintenance providers.
  • Email and communications providers.
  • Payment-processing providers.
  • Analytics and advertising measurement providers, subject to applicable safeguards and consent requirements.
  • Professional advisers.
  • Regulatory authorities and other organisations where disclosure is legally required or otherwise lawful.

Where an organisation processes personal information on our behalf, we seek to ensure appropriate contractual and security arrangements are in place.

Some organisations may act as independent data controllers for particular processing activities.

We do not sell personal information.

14. International Data Transfers

Some service providers, including certain technology providers, may process personal information outside the United Kingdom.

Where international transfers take place, we ensure that an appropriate legal transfer mechanism is available.

Depending on the circumstances, this may include UK adequacy regulations, the UK International Data Transfer Agreement or an appropriate UK Addendum to standard contractual clauses.

Additional safeguards will be implemented where required.

15. Data Security and Personal Data Breaches

We take appropriate technical and organisational measures to protect personal information.

These measures may include:

  • Secure website connections using HTTPS.
  • Restricted access to systems and records.
  • Appropriate security measures for clinical information.
  • Staff confidentiality arrangements.
  • Account access controls.
  • Internal procedures for identifying and managing personal data breaches.

Where a personal data breach meets the applicable legal reporting threshold, we will notify the Information Commissioner’s Office within the required timeframe.

Where legally required, we will also notify affected individuals.

Although we take appropriate precautions, no electronic system can be guaranteed to be completely secure.

16. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, subject to applicable legal, regulatory and professional obligations.

Different retention periods apply to different categories of information.

Clinical records

Clinical records are retained in accordance with applicable healthcare record-retention requirements and our clinical records policy.

Enquiry information

Website enquiries and related correspondence are retained for an appropriate period based on the nature of the enquiry, any subsequent relationship and applicable legal requirements.

Financial records

Financial information is retained for the periods required by relevant accounting, tax and other legislation.

Website analytics and advertising information

Information is retained in accordance with the relevant service settings, documented business requirements and applicable privacy obligations.

When information is no longer required, we securely delete or anonymise it, as appropriate.

17. Your Data Protection Rights

Under UK GDPR, you have a number of rights, subject to applicable conditions and exemptions.

These may include the right to:

  • Request access to your personal information.
  • Request correction of inaccurate information.
  • Request deletion in certain circumstances.
  • Request restriction of processing.
  • Object to processing in certain circumstances.
  • Request data portability where applicable.
  • Withdraw consent where processing relies on consent.
  • Challenge certain types of solely automated decision-making, where applicable.

Some information, particularly clinical records, may need to be retained despite a deletion request where there is an overriding legal or professional requirement.

To exercise your rights, please contact chris@burtonclinic.co.uk.

We will normally respond to valid requests within one month. Where permitted by law, this period may be extended for particularly complex requests, and we will explain any extension.

Requests are generally free of charge. In circumstances permitted by law, such as manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act.

We may need to verify your identity before fulfilling a request.

18. Children’s Personal Information

Where Burton Clinic provides healthcare services to children, we process their personal information in accordance with applicable data protection, healthcare consent and confidentiality requirements.

Where appropriate, we may communicate with parents or guardians.

However, parental involvement and consent requirements depend on the child’s circumstances, capacity and applicable law.

We take particular care to protect children’s personal information.

19. Automated Decision-Making and Profiling

We do not use solely automated decision-making that produces legal or similarly significant effects concerning patients.

We may use standard website analytics and advertising measurement technologies, subject to applicable consent requirements.

We do not use confidential clinical information to create advertising profiles or remarketing audiences.

20. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, technology, legal obligations or data protection practices.

The latest version will be published on our website, and the date at the top of this policy will indicate when it was last updated.

Where legally required, we will provide additional notice or obtain consent before introducing materially different processing activities.

21. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights or have concerns about how we handle your information, please contact:

Burton Clinic Limited

Unit 3, Lodge Farm Barns
New Road
Bawburgh
Norwich
NR9 3LZ

Company number: 16832114

Email: chris@burtonclinic.co.uk

Telephone: 01603 210933

Website: https://www.burtonclinic.co.uk/

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office

Website: https://ico.org.uk/

Telephone: 0303 123 1113

We encourage you to contact us first so that we have an opportunity to address your concerns.

Burton physio in norwich