Our policies

 If it is your first appointment with us, then a deposit of 50% (minimum) of the treatment price, will be taken at the time of booking to secure your appointment. 
•  All treatments are subject to availability and prices

•  Osteopathic treatment times are indicative as we provide the best treatment for you at the time i.e. for a 30 minute follow up appointment, hands on treatment may range from 5 minutes to 25 minutes, with the average being 20 minutes.

• Treatment times quoted for sports massage and myofascial release allow for consultation, appropriate examination and preparation including time for you to change.
• Treatments, Prices and Times may change without prior notice.
• Late arrivals will result in your treatment time being reduced or rescheduled, while full payment will still be required.
• Gift Vouchers are valid for 6months from the date purchased.
• Gift Vouchers bought on promotion can only be used against full price individual treatments.
• A deposit of 50% will be required on all bookings over 60mins, if two therapists are booked, or on packages.

We do our best to accommodate any last minute emergency appointments, but we are not able to do this if someone fails to show and does not let us know. 

Therefore in respect of all our patients who may want or need an appointment, and our Osteopaths (who do not receive payment if a patient does not arrive) we operate a strict 24-hour cancellation policy.

Any treatments cancelled or rescheduled within 24 hours of the scheduled time, will be charged at 50% of the full treatment price.

Clients that fail to arrive for treatment without cancellation will be charged the full amount.

The clinic reserves the right to take payment in advance for treatments, for patients that are not able to adhere to our cancellation policy and repeated non adherence may result in the clinic unable to take any future bookings from a patient

Scope

This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The General Data Protection Regulation (GDPR) which is EU wide and far more extensive than its predecessor the Data Protection Act, along with the Privacy and Electronic Communications Regulations (PECR), seek to protect and enhance the rights of EU data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU and its storage within the EEA. 

​

1 – ARC Osteopathy, based inside the Beechwood Smile and Implant Centre, 109 Banstead Road, Carshalton Beeches, SM5 3NPwhich hereafter for the purposes of this Privacy Notice will be referred to as ARCCB, is pleased to provide the following information:

​

2 - Who we are
The Osteopaths diagnose and treat health conditions. Treatments are carried out in accordance with the Institute of Osteopathy’s patient charter http://www.iosteopathy.org/osteopathy/the-patient-charter/. 

​

3 - Personal Data 

a) For the purposes of providing treatment, ARC CB may require detailed medical information. We will only collect what is relevant and necessary for your treatment. When you visit our centre, we will make notes which may include details concerning your medication, treatment and other issues affecting your health. This data is always held securely, is not shared with anyone not involved in your treatment, although for data storage purposes it may be handled by pre-vetted staff who have all signed an integrity and confidentiality agreement. To be able to process your personal data it is a condition of any treatment that you give your explicit consent to allow ARC CB to document and process your personal medical data. Contact details provided by you such as telephone numbers, email addresses, postal addresses may be used to remind you of future appointments and provide reports or other information concerning your treatment. 

b) For marketing purposes, ARC CB may also use the contact details provided by you to respond to your enquiries, including making telephone contact and emailing information to you which the centre believes may be of interest to you. 

c) In making initial contact with the centre you consent to ARC CB maintaining a marketing dialogue with you until you either opt-out (which you can do at any time) or we decide to desist in promoting our services. ARC CB may occasionally also act on behalf of its patients in the capacity of data processor, when we may promote other practitioners based at our premises, who may not be employed by us. ARC CB do not broker your data and you can ask to be removed from our marketing database by emailing or phoning the centre using the contact details provided at the end of this Privacy Notice. 

d) Some basic personal data may be collected about you from the forms and review you complete, from records of our correspondence and phone calls and details of your visits to our website, including but not limited to, personally identifying information like the Internet Protocol (IP) addresses. 

e) ARC CB websites and Social Media channels use cookies, which is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. Cookies help ARC CB to identify and track visitors and their website access preferences. ARC CBs websites visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using ARC CBs websites.

f) ARC CB will only collect the information needed so that we can provide you with the services you require, the business does not sell or broker your data. 

​

4 - Legal basis for processing any personal data
To meet our contractual obligations obtained from explicit Patient Consent and legitimate interest to respond to enquiries concerning the services provided.

​

5 - Legitimate interests pursued by ARC CB
To promote treatments for patients with all types of health problems indicated for health care. 

​

6 – Consent
By agreeing to this privacy notice you are consenting to ARC CB processing your personal data for the purposes outlined. You can withdraw consent at any time by using the postal, email address or telephone number provided at the end of this Privacy Notice.

​

7 – Disclosure
ARC CB will keep your personal information safe and secure, only staff engaged in providing your treatment and our admin team will have access to your patient records and your contact details so that they can make appointments and manage your account. ARC CB will not disclose your Personal Information unless compelled to, in order to meet legal obligations, regulations or valid governmental requests. The practice may also enforce its Terms and Conditions, including investigating potential violations of its Terms and Conditions to detect, prevent or mitigate fraud or security or technical issues; or to protect against imminent harm to the rights, property or safety of its staff.

​

8 - Retention Policy
ARC CB will process personal data during the duration of any treatment and will continue to store only the personal data needed for eight years after the contract has expired to meet any legal obligations. After eight years all personal data will be deleted, unless basic information needs to be retained by us to meet our future obligations to you, such as erasure details. Records concerning minors who have received treatment will be retained until the child has reached the age of 25.

​

9 - Data storage
ARC CB stores medical and personal data in the United Kingdom and on Cliniko database servers in Australia.  Cliniko is currently GDPR compliant with new data protection standards.

​

10 - Your rights as a data subject
At any point whilst ARC CB is in possession of, or processing your personal data, all data subjects have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.

• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.

• Right to be forgotten – in certain circumstances, you can ask for the data we hold about you to be erased from our records.

• Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.

• Right of portability – you have the right to have the data we hold about you transferred to another organisation.

• Right to object – you have the right to object to certain types of processing such as direct marketing.

• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

In the event that ARC CB refuses your request under rights of access, we will provide you with a reason as to why, which you have the right to legally challenge. At your request ARC CB can confirm what information it holds about you and how it is processed.

​

11 - You can request the following information:

• Identity and the contact details of the person or organisation that has determined how and why to process your data.

• Contact details of the data protection officer, where applicable.

• The purpose of the processing as well as the legal basis for processing.

• If the processing is based on the legitimate interests of Osteopaths and information about these interests.

• The categories of personal data collected, stored and processed.

• Recipient(s) or categories of recipients that the data is/will be disclosed to.

• How long the data will be stored.

• Details of your rights to correct, erasure, restrict or object to such processing.

• Information about your right to withdraw consent at any time.

• How to lodge a complaint with the supervisory authority (ICO).

• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.

• The source of personal data if it wasn’t collected directly from you.

• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing. 

12- To access what personal data is held, identification will be required
ARCCB will accept the following forms of identification (ID) when information on your personal data is requested: a copy of your driving licence, passport, birth certificate and a utility bill not older than three months. A minimum of one piece of photographic ID listed above and a supporting document is required. If ARC CB is dissatisfied with the quality, further information may be sought before personal data can be released. All requests should be made to [email protected] or by phoning +44 (0) 20 3764 2913 or writing to us at the address further below.

​

13 Complaints regarding your personal data.
In the event that you wish to make a complaint about how your personal data is being processed by ARC CB, you have the right to complain to us. If you do not get a response within 30 days, you can complain to the ICO.

Data Protection Complaints Procedure (DUAA – Effective 19 June 2026)

Purpose This procedure explains how individuals can raise concerns about how their personal information is collected, used, stored, or shared. It meets the requirements of the Data Use and Access Act 2025 (DUAA) and associated ICO guidance (February 2026).

14.1. How individuals can make a complaint

Individuals may raise a data protection complaint in the following formats. We will accept complaints made:

• Using a data protection complaint form
• By email
• In writing
• Through our website or online portal
• In person (where applicable)

We will never refuse a complaint because it was not submitted through the “official” route.

14.2. Information we may need

To help us investigate, we may ask for:

• The nature of the concern
• Relevant dates, interactions, or evidence
• What outcome the individual is seeking
• Proof of identity (if needed to confirm who we are communicating with)
• A letter of authority or power of attorney if someone is acting on another person’s behalf

We will request this information as early as possible.

14.3. Acknowledging the complaint

We will:

• Acknowledge all data protection complaints within 30 days
• Confirm who is handling the complaint
• Explain the next steps and expected timescales

If the complaint is from a child or young person, we will assess their competence to exercise their rights and adapt our communication accordingly.

14.4. Investigating the complaint

We will:

• Review the issues raised and any relevant records
• Speak with staff involved (if applicable)
• Assess whether our data handling complied with DUAA and ICO guidance
• Identify any risks, errors, or areas for improvement
• Keep the individual updated if the investigation takes longer than expected

14.5. Responding to the complaint

We will provide a written response that includes:

• The outcome of our investigation
• Any actions we have taken or will take
• Any learning or improvements identified
• Information on the individual’s right to escalate the matter

14.6. If the individual is not satisfied

If the individual remains unhappy with our response, they may:

• Ask us to review the decision
• Raise their concern with the Information Commissioner’s Office (ICO)

We will provide the ICO’s contact details in our response.

14.7. Recording and learning

We will:

• Log all data protection complaints
• Record outcomes and actions taken
• Identify themes or recurring issues
• Use learning to improve our data protection practices, staff training, and member/patient communications

14.8. Staff responsibilities

All staff must:

• Know how to recognise a data protection complaint
• Forward complaints immediately to the Data Protection Lead
• Support investigations promptly and transparently
• Complete any required training on DUAA and complaint handling

​

The details for each of these contacts are:

Alan Rowe at ARC Osteopathy 

Inside Beechwood Smile and Implant Centre, 109 Banstead Road, Carshalton Beeches, SM5 3NP
Telephone +44 (0) 20 3764 2913 or email [email protected]

​

ICO
Wycliffe House, Water Lane, Wilmslow, SK9 5AFTelephone +44 (0) 303 123 1113 or email: https://ico.org.uk/global/contact-us/contact-us-public/

Scope

​This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The General Data Protection Regulation (GDPR) which is EU wide and far more extensive than its predecessor the Data Protection Act, along with the Privacy and Electronic Communications Regulations (PECR), seek to protect and enhance the rights of EU data subjects. These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data and the unrestricted movement of personal data within the EU and its storage within the EEA.

​

1 – ARC Osteopathy, based inside the Wellness Therapy Centre, 3 Overtons Yard, Croydon CR0 1SL which hereafter for the purposes of this Privacy Notice will be referred to as ARCCR, is pleased to provide the following information:

​

2 - Who we are
The Osteopaths diagnose and treat health conditions. Treatments are carried out in accordance with the Institute of Osteopathy’s patient charter http://www.iosteopathy.org/osteopathy/the-patient-charter/. 

​

3 - Personal Data 

a) For the purposes of providing treatment, ARC CR may require detailed medical information. We will only collect what is relevant and necessary for your treatment. When you visit our centre, we will make notes which may include details concerning your medication, treatment and other issues affecting your health. This data is always held securely, is not shared with anyone not involved in your treatment, although for data storage purposes it may be handled by pre-vetted staff who have all signed an integrity and confidentiality agreement. To be able to process your personal data it is a condition of any treatment that you give your explicit consent to allow ARC CR to document and process your personal medical data. Contact details provided by you such as telephone numbers, email addresses, postal addresses may be used to remind you of future appointments and provide reports or other information concerning your treatment. 

b) For marketing purposes, ARC CR may also use the contact details provided by you to respond to your enquiries, including making telephone contact and emailing information to you which the centre believes may be of interest to you. 

c) In making initial contact with the centre you consent to ARC CR maintaining a marketing dialogue with you until you either opt-out (which you can do at any time) or we decide to desist in promoting our services. ARC CR may occasionally also act on behalf of its patients in the capacity of data processor, when we may promote other practitioners based at our premises, who may not be employed by us. ARC CR do not broker your data and you can ask to be removed from our marketing database by emailing or phoning the centre using the contact details provided at the end of this Privacy Notice. 

d) Some basic personal data may be collected about you from the forms and review you complete, from records of our correspondence and phone calls and details of your visits to our website, including but not limited to, personally identifying information like the Internet Protocol (IP) addresses. 

e) ARC CR websites and Social Media channels use cookies, which is a string of information that a website stores on a visitor’s computer, and that the visitor’s browser provides to the website each time the visitor returns. Cookies help ARC CR to identify and track visitors and their website access preferences. ARC CRs websites visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using ARC CRs websites.

f) ARC CR will only collect the information needed so that we can provide you with the services you require, the business does not sell or broker your data. 

​

4 - Legal basis for processing any personal data
To meet our contractual obligations obtained from explicit Patient Consent and legitimate interest to respond to enquiries concerning the services provided.

​

5 - Legitimate interests pursued by ARC CR
To promote treatments for patients with all types of health problems indicated for health care. 

​

6 – Consent
By agreeing to this privacy notice you are consenting to ARC CR processing your personal data for the purposes outlined. You can withdraw consent at any time by using the postal, email address or telephone number provided at the end of this Privacy Notice.

​

7 – Disclosure
ARC CR will keep your personal information safe and secure, only staff engaged in providing your treatment and our admin team will have access to your patient records and your contact details so that they can make appointments and manage your account. ARC CR will not disclose your Personal Information unless compelled to, in order to meet legal obligations, regulations or valid governmental requests. The practice may also enforce its Terms and Conditions, including investigating potential violations of its Terms and Conditions to detect, prevent or mitigate fraud or security or technical issues; or to protect against imminent harm to the rights, property or safety of its staff.

​

8 - Retention Policy
ARC CR will process personal data during the duration of any treatment and will continue to store only the personal data needed for eight years after the contract has expired to meet any legal obligations. After eight years all personal data will be deleted, unless basic information needs to be retained by us to meet our future obligations to you, such as erasure details. Records concerning minors who have received treatment will be retained until the child has reached the age of 25.

​

9 - Data storage
ARC CR stores medical and personal data in the United Kingdom and on Cliniko database servers in Australia.  Cliniko is currently GDPR compliant with new data protection standards.

​

10 - Your rights as a data subject
At any point whilst ARC CR is in possession of, or processing your personal data, all data subjects have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.

• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.

• Right to be forgotten – in certain circumstances, you can ask for the data we hold about you to be erased from our records.

• Right to restriction of processing – where certain conditions apply you have a right to restrict the processing.

• Right of portability – you have the right to have the data we hold about you transferred to another organisation.

• Right to object – you have the right to object to certain types of processing such as direct marketing.

• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.

In the event that ARC CR refuses your request under rights of access, we will provide you with a reason as to why, which you have the right to legally challenge. At your request ARC CR can confirm what information it holds about you and how it is processed.

​

11 - You can request the following information:

• Identity and the contact details of the person or organisation that has determined how and why to process your data.

• Contact details of the data protection officer, where applicable.

• The purpose of the processing as well as the legal basis for processing.

• If the processing is based on the legitimate interests of Osteopaths and information about these interests.

• The categories of personal data collected, stored and processed.

• Recipient(s) or categories of recipients that the data is/will be disclosed to.

• How long the data will be stored.

• Details of your rights to correct, erasure, restrict or object to such processing.

• Information about your right to withdraw consent at any time.

• How to lodge a complaint with the supervisory authority (ICO).

• Whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and the possible consequences of failing to provide such data.

• The source of personal data if it wasn’t collected directly from you.

• Any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing. 

12- To access what personal data is held, identification will be required
ARCCR will accept the following forms of identification (ID) when information on your personal data is requested: a copy of your driving licence, passport, birth certificate and a utility bill not older than three months. A minimum of one piece of photographic ID listed above and a supporting document is required. If ARC CR is dissatisfied with the quality, further information may be sought before personal data can be released. All requests should be made to [email protected] or by phoning +44 (0) 20 3764 2913 or writing to us at the address further below.

​

13 Complaints regarding your personal data.
In the event that you wish to make a complaint about how your personal data is being processed by ARC CR, you have the right to complain to us. If you do not get a response within 30 days, you can complain to the ICO.

Data Protection Complaints Procedure (DUAA – Effective 19 June 2026)

Purpose This procedure explains how individuals can raise concerns about how their personal information is collected, used, stored, or shared. It meets the requirements of the Data Use and Access Act 2025 (DUAA) and associated ICO guidance (February 2026).

14.1. How individuals can make a complaint

Individuals may raise a data protection complaint in the following formats. We will accept complaints made:

• Using a data protection complaint form
• By email
• In writing
• Through our website or online portal
• In person (where applicable)

We will never refuse a complaint because it was not submitted through the “official” route.

14.2. Information we may need

To help us investigate, we may ask for:

• The nature of the concern
• Relevant dates, interactions, or evidence
• What outcome the individual is seeking
• Proof of identity (if needed to confirm who we are communicating with)
• A letter of authority or power of attorney if someone is acting on another person’s behalf

We will request this information as early as possible.

14.3. Acknowledging the complaint

We will:

• Acknowledge all data protection complaints within 30 days
• Confirm who is handling the complaint
• Explain the next steps and expected timescales

If the complaint is from a child or young person, we will assess their competence to exercise their rights and adapt our communication accordingly.

14.4. Investigating the complaint

We will:

• Review the issues raised and any relevant records
• Speak with staff involved (if applicable)
• Assess whether our data handling complied with DUAA and ICO guidance
• Identify any risks, errors, or areas for improvement
• Keep the individual updated if the investigation takes longer than expected

14.5. Responding to the complaint

We will provide a written response that includes:

• The outcome of our investigation
• Any actions we have taken or will take
• Any learning or improvements identified
• Information on the individual’s right to escalate the matter

14.6. If the individual is not satisfied

If the individual remains unhappy with our response, they may:

• Ask us to review the decision
• Raise their concern with the Information Commissioner’s Office (ICO)

We will provide the ICO’s contact details in our response.

14.7. Recording and learning

We will:

• Log all data protection complaints
• Record outcomes and actions taken
• Identify themes or recurring issues
• Use learning to improve our data protection practices, staff training, and member/patient communications

14.8. Staff responsibilities

All staff must:

• Know how to recognise a data protection complaint
• Forward complaints immediately to the Data Protection Lead
• Support investigations promptly and transparently
• Complete any required training on DUAA and complaint handling

​

The details for each of these contacts are:

Alan Rowe at ARC Osteopathy 

Inside The Wellness Therapy Centre, 3 Overtons Yard, Croydon CR0 1SL Telephone +44 (0) 20 3745 9532 or email [email protected]

​

ICO
Wycliffe House, Water Lane, Wilmslow, SK9 5AFTelephone +44 (0) 303 123 1113 or email: https://ico.org.uk/global/contact-us/contact-us-public/

If you have a complaint with regards to your personal data and how it is being processed or held, please follow the guidance in notes 13 & 14 of our privacy policy above.

ARC Osteopathy aims to provide a high-quality service that meets your needs.  We believe we are achieving this, but if there is something we’re not getting right, please let us know.

To ensure our services to you remain of the highest standard and quality, we have a procedure through which you can let us know if, for any reason, you are unhappy or unsatisfied with our services, or with any staff or Osteopaths.  The full procedure can be found under: How to complain to us.

At ARC Osteopathy you can expect to be treated with courtesy, respect and fairness at all times.  We expect you will also treat our staff (including those dealing with your complaint) in the same way. 

Confidentiality:

We will treat your complaint in confidence in accordance with all current GDPR regulations, subject to the need to disclose information required by authorities and/or as a result of legal obligations.

Complaint details, actions and outcomes will be recorded and used for service improvement.  We may collate anonymous data from complaints (as well as compliments and suggestions) to help us understand the types of issue occurring and how well we are doing to resolve them.  We value your feedback in order to do better in the future, become more customer focused, act fairly, and seek continuous improvement.

All our Osteopaths are registered and regulated by GOsC and as such are bound by GOsC safety and quality in practice and therefore follow GOsC standards of professionalism.

Our promise to you is that we shall:

• Treat your complaint seriously

• Work to resolve your complaint promptly and in confidence

• Learn lessons and use them to review and where appropriate improve our service.

How to complain to us:

If you wish to make a complaint about a service or a staff member you can do so via phone, email or letter or in person.

• If you are unhappy about the service at ARC Osteopathy, please in the first instance speak to a staff member. If you are not comfortable doing that or are unhappy with our response, then please contact our Principal Osteopath Alan. 

• You can do so at the clinic, or by calling 020 8681 4951 in confidence.

• If you wish to write, you can email [email protected], using the subject line complaint.  

If your complaint or concern is regarding the level of care you have received from an Osteopath, please let us know. 

All our Osteopaths are registered and regulated by GOsC and as such are bound by GOsC safety and quality in practice and therefore follow GOsC standards of professionalism.

Our promise to you is that we shall:

• Treat your complaint seriously

• Work to resolve your complaint promptly and in confidence

• Learn lessons and use them to review and where appropriate improve our service.

• If your complaint is specific to Osteopathy you can make your complaint to Alan Rowe our Principal Osteopath via email to [email protected].

• Alternatively, you can phone or speak to someone else in the clinic in person, the complaint will be logged by that person and they will attempt to resolve it for you.  If you are not satisfied with their response, they can let you know when the Principal is likely to be free for you to discuss the matter with him.

How we will respond:

All complaints, via phone, email or post, will be logged and the appropriate people made aware immediately.  In any case, we will aim to respond to your complaint within 5 working days.

Our aim is to fully investigate your complaint and in doing so to give you a full reply and initial remedy within 10 working days.

Due to the nature of individual complaints, if this is not possible, an interim response will be made informing you of the action and investigation being undertaken.

Remedies:

When we get things wrong we will:

• Fully investigate matters to find out what happened or what went wrong

• Ensure you receive an explanation of what went wrong, how and why

• If appropriate accept responsibility and apologise

• Reach an amicable solution

• Then put things right, by making appropriate changes that may include:

• Providing the service required in the first instance (as soon as appropriate)

1. Updating procedures and/or policies

2. Training/retraining and/or supervising staff

3. Provide compensation

4. Learn lessons from mistakes and if required make amendments to policy and practices to make sure this doesn’t happen again

If you are still unsatisfied:

If your concern is regarding Osteopathy and is not resolved by speaking with your Osteopath or the Principal Osteopath, or following the complaints procedure this far, you can contact an independent source at the Institute of Osteopathy Complaints Resolution Service by calling  0800 110 5857 or by emailing [email protected]

Further still, if you are still concerned about safety and wish to investigate a formal complaint with the regulatory body you can contact the General Osteopathic Council on 020 7357 6655 (Please note The GOSC cannot award compensation).