The AIM Clinic
Version 2.0 · 01/08/2026
Supersedes Version 1 (03/09/2018)
About this notice
This notice explains how The AIM Clinic collects, uses and protects personal information about our patients. It applies to current patients, former patients, and people who contact us about treatment but do not go on to become patients.
Please read it alongside anything else we give you about how we handle your information — for example, wording on our patient intake form or on our website.
We may update this notice. The current version is always available at aimclinic.co.uk/privacy and a printed copy is available at the clinic on request.
Who is responsible for your information
Patrick Thomas Ltd, trading as The AIM Clinic, is the data controller. That means we decide how and why your personal information is used, and we are responsible for looking after it.
Patrick Thomas Ltd is registered in England and Wales, company number 07960519. Registered office: 30 Pine Bank, Hindhead, GU26 6SS
Clinic address
Unit 6, The Old Stables, Chocolate Frog Tea Rooms, Oakhanger, Bordon GU35 9BF
Telephone: 01420 479502
Email: patrick@aimclinic.co.uk
Person responsible for data protection: Patrick Thomas DC. Any questions or requests about your information should come to him, using the details above.
We are registered with the Information Commissioner’s Office (ICO), registration number ZA491123.
What information we hold
Basic details
Your name, date of birth, address, telephone numbers, email address, occupation, and how you heard about the clinic.
Health information
Your medical history, current medication, previous investigations and imaging, details of your presenting complaint, our examination findings, our clinical impressions, the treatment you receive, and how you respond to it. Where relevant to your complaint, this may include information about pregnancy, menstrual history, or other sensitive matters.
Correspondence
Letters and reports to and from your GP, other healthcare professionals, imaging providers, or insurers, and messages between you and the clinic.
Appointment and payment records
Appointment history, fees, payments, and — if you claim through health insurance — your policy details.
Enquiries
If you contact us but do not become a patient, we hold your name, contact details, and a record of your enquiry.
Health information is what data protection law calls special category data. It is given extra protection, and we treat it accordingly.
Why we hold it, and our legal grounds
Data protection law requires us to have a legal ground for every use of your information.
To provide your care — taking a history, examining you, forming a clinical impression, treating you, keeping records, and reviewing your progress.
Our ground: performance of our contract with you.
To manage appointments and payment — booking, confirming, reminding, rescheduling, invoicing, and taking payment.
Our ground: performance of our contract with you.
To meet our legal and regulatory duties — keeping the clinical records required by the Chiropractors Act 1994, complying with our General Chiropractic Council obligations, responding to regulators, and meeting tax and accounting requirements.
Our ground: compliance with a legal obligation.
To run the clinic safely and properly — responding to enquiries, dealing with complaints, handling insurance matters, taking advice from our professional indemnity insurer or solicitors, and keeping our systems secure.
Our ground: our legitimate interests in operating the clinic, where these do not override your rights.
To send you marketing — newsletters, health information, and clinic news, if you have asked to receive them.
Our ground: your consent, which you can withdraw at any time.
Our additional ground for health information
Because health information needs a second legal ground, we rely on it being necessary for the provision of health care and treatment, and for the management of health care services, by professionals who are under a duty of confidentiality. This is the ground at Article 9(2)(h) of the UK GDPR.
Where we need to use your health information to establish, exercise or defend a legal claim, our ground is Article 9(2)(f).
We do not rely on your consent as the legal ground for providing your care. You are asked to consent to treatment, which is a separate matter, and you can withdraw that at any time.
How we collect it
Most of it comes from you — on the intake form, in conversation, and during examination and treatment.
Some is generated by us as we care for you: examination findings, treatment notes, and progress records.
Some may come from elsewhere, with your knowledge: your GP, a previous practitioner, an imaging provider, or an insurer.
If you give us someone else’s details — a next of kin, for example — please tell them you have done so and show them this notice.
Who we share it with
We only share your information where we have a reason to, and we share the minimum needed.
Within the clinic — with the practitioner treating you, and with anyone providing administrative support, where they need it to do their job.
Other healthcare professionals — your GP, a specialist, or an imaging provider, where we are making a referral or keeping your GP informed. We will discuss this with you first.
Your insurer — if you are claiming your fees back through health insurance.
Our advisors — our accountant, our professional indemnity insurer, and our solicitors where needed.
Regulators and authorities — the General Chiropractic Council, HMRC, the ICO, the police or courts, where we are required by law or where there is a serious safety concern. The GCC publishes guidance on when patient information may be disclosed, and we follow it.
If the clinic is sold or restructured — with any prospective purchaser, under confidentiality.
We do not sell your information, and we do not share it for anyone else’s marketing.
Our service providers
We use outside companies to run parts of the clinic. They handle your information on our instructions only, under written contracts requiring them to keep it secure and use it for nothing else.
| Provider | What they do | Information involved |
|---|---|---|
| Cliniko (Red Guava Pty Ltd) | Practice management and online booking | Name, contact details, appointment history, clinical records, payment records |
| Aeva AI | AI-assisted telephone answering for our main number | Your name, contact details, and whatever you say during the call — which may include health information |
| bOnline | Telephone service | Call routing and connection data |
| Krystal Hosting | Website hosting and clinic email | Website enquiries, email correspondence |
| Clover | Card payments | Payment details and transaction records |
| PJE Accountants | Bookkeeping and accounts | Invoices and payment records |
| EmailOctopus | Sending our newsletter | Your name and email address, if you have subscribed |
| Termly | Cookie consent on our website | Your cookie preferences |
Our telephone service. Calls to 01420 479502 may be answered by an AI assistant, which takes your details and the reason for your call so we can respond. You will be told this at the start of the call. A human at the clinic reviews the outcome — no decision about your care is made by the system alone. If you would rather not use it, you can email us instead or ask to speak to a person.
Sending information outside the UK
Your clinical records are held by Cliniko on servers in the United Kingdom.
Cliniko uses its own service providers to run parts of its platform, and some of these are based outside the UK, mainly in the United States. Cliniko is responsible for making sure appropriate safeguards are in place for those transfers. Its current list is published at help.cliniko.com.
Some of our other providers, including our website and consent tools, also process limited information outside the UK under approved safeguards — either a country the UK government recognises as providing adequate protection, or an International Data Transfer Agreement.
You can ask us for more detail at any time.
How we keep it safe
Paper records are kept in a locked cabinet at the clinic. Electronic records are held in Cliniko, protected by individual accounts, strong passwords and two-factor authentication. Access is limited to people who need it. Our devices are password-protected and encrypted.
We have a procedure for dealing with any breach of personal data, and we will tell you and the ICO where the law requires it.
How long we keep it
Adult patients: eight years from the date of your last appointment.
Patients who were under 18: until your 25th birthday, or until your 26th birthday if you were 17 when treatment ended.
These periods follow General Chiropractic Council guidance.
Enquiries that don’t become appointments: [12] months.
Newsletter subscribers: until you unsubscribe, plus a record of your unsubscribe so we don’t contact you again.
Accounting records: six years, as required by HMRC.
We may keep records longer if there is a complaint, a claim, or an ongoing legal matter. We may also keep a minimal record of your name and appointment dates after deletion, so that we can respond if a complaint is made about historic treatment.
When we no longer need your information, we destroy it securely.
Automated decisions
No decision about your care is made by a computer without a person involved. Our AI telephone assistant collects information and passes it to us; it does not decide anything about your treatment.
If you don’t give us information
We need certain information to treat you safely. If you don’t provide it, we may not be able to examine or treat you, and we will explain why at the time.
Some information is optional. We will tell you which is which.
Your rights
You have the right to:
- Be told how we use your information — that is what this notice is for.
- See a copy of the information we hold about you (a subject access request).
- Have mistakes corrected.
- Ask us to delete information, where there is no good reason for us to keep it. Note that we are legally required to retain clinical records for the periods above, so this right is limited for patient notes.
- Ask us to restrict how we use your information while a query is resolved.
- Object to us using your information for our legitimate interests.
- Receive a copy of information you gave us in a portable electronic format.
- Withdraw consent at any time, where consent is our legal ground — for example, unsubscribing from our newsletter.
To exercise any of these, contact Patrick Thomas using the details at the top of this notice. We will respond within one month. We may ask you to confirm your identity first — this protects you.
There is no charge, unless a request is clearly unfounded or excessive, or you ask for additional copies.
Marketing
We will only send you newsletters or clinic news if you have specifically asked us to. Appointment reminders and messages about your care are not marketing, and are part of providing your treatment.
Every marketing email has an unsubscribe link. You can also just tell us, and we will stop.
Complaints
If you are unhappy with how we have handled your information, please tell Patrick Thomas first — most things can be sorted out quickly.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk
Keeping your details up to date
Please let us know if your contact details or your health circumstances change, so our records stay accurate.
The AIM Clinic · Patrick Thomas DC · GCC registration number 03486· Version 2.0, 01/08/2026