Privacy & data protection
How Feet First looks after the personal information of our patients and of anyone who contacts us. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
Feet First (B'Ham) Ltd is the data controller for your information. That means we decide how it is used and we are responsible for keeping it safe.
Feet First (B'Ham) Ltd
Registered in England & Wales, company no. 07387713
297 Haslucks Green Road
Shirley, Solihull B90 2LW
0121 693 3339 · [email protected]
2. The information we hold
- Your details: name, date of birth, address, phone number and email address.
- Your health information: medical history, medication, the condition of your feet, assessment and treatment notes, and any letters to or from other healthcare professionals. This is "special category" data and we give it extra protection.
- Photos and videos: on occasion your podiatrist may take photos or videos of your feet to support your treatment plan. We only do this with your agreement, and they are kept with your clinical record.
- Appointments and contact: your appointment history and the messages, calls and emails we exchange with you.
- Payments: what you have been charged and paid. We don't keep your full card details.
- Website enquiries: the name, phone number, email address and message you send through our contact form.
3. Where it comes from
Almost everything comes directly from you: when you contact us, at your appointments, or on the forms you fill in. Sometimes it comes from another healthcare professional, such as your GP, a consultant or another clinic, when they refer you to us or send us information about your care.
4. Why we use it and our legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Assess, treat and care for you, and keep clinical records | Providing you with a service you have asked for (Article 6(1)(b)). Health information is used for the provision of health care (Article 9(2)(h)). |
| Reply to your enquiry and arrange appointments | Steps you have asked us to take before treatment (Article 6(1)(b)) |
| Keep financial and clinical records for as long as the law and our professional body require | Legal obligation (Article 6(1)(c)) |
| Run the clinic safely and well, for example handling queries and complaints | Our legitimate interests (Article 6(1)(f)) |
| Taking photos or videos as part of your care | With your agreement, recorded on your consent form |
5. Who we share it with
We only share your information when it's needed for your care, and then only the minimum necessary. For example, we may write to your GP or refer you to another healthcare professional.
We may also share information where the law requires it, for example with regulators, our insurers or the courts.
We never sell your information or share it with others for marketing. It is for our clinic's use only.
6. The software and services we use
These companies process information for us under contract. They act only on our instructions and must keep it secure.
- Cliniko: our patient record and appointment system, where your details, clinical notes, photos and appointment history are kept. We don't offer online booking: appointments are arranged with us directly by phone.
- Microsoft 365: our email. Messages you send through the website's contact form arrive here as an email.
- Cloudflare: hosts this website, passes contact-form messages on to our inbox (they aren't stored on the website), and runs the spam check on the form.
- Google: provides the map and our opening hours on the website, and the fonts the website uses. Your browser connects to Google to load these.
Some of these providers may process information outside the UK. Where they do, we make sure UK-approved safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, or the UK–US Data Bridge.
7. How long we keep it
- Patient records: we keep them for as long as we need to meet our business and legal requirements as a member of the Royal College of Podiatry. That is normally no longer than 8 years after your last treatment.
- Financial records: kept for 6 years, as HM Revenue & Customs requires.
- Website enquiries: if you become a patient, the details become part of your record. If not, we delete the enquiry once we've dealt with it.
When information is no longer needed, it is securely deleted or destroyed.
8. Keeping your information accurate and safe
Please tell us as soon as you can if anything changes, such as a new address or phone number, so your record stays up to date.
Your record is kept in password-protected systems that only clinic staff who need it can access. Information sent through this website travels over an encrypted connection.
9. Marketing
We don't send marketing messages. We will only contact you about your enquiry, your appointments and your care.
10. Our website
The website doesn't use analytics or advertising tracking.
When you visit, Cloudflare (which hosts the site) processes technical information such as your IP address, to deliver the pages and protect the site from attacks.
The map and the fonts are loaded from Google. See our cookie policy for details.
Please don't include detailed medical history in the contact form. We'll go through that with you in person.
11. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that's wrong or incomplete;
- ask us to delete your information. We may need to keep clinical and financial records for the periods above, and we'll explain if so;
- ask us to restrict how we use your information, or object to it;
- ask for your information in a format you can take to another provider;
- withdraw your consent at any time, where we rely on it (for example, for photos).
To use any of these rights, contact us using the details above. There's normally no charge, and we'll respond within one month.
12. Complaints
If you're unhappy with how we've handled your information, please talk to us first and we'll do our best to put it right. You can also complain to the Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint · 0303 123 1113
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
13. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page.
Last updated: 07 November 2026