1. Who we are

This Privacy Policy explains how Studio C Health Limited, trading as Alumme Chiropractic, collects, uses, stores and protects your personal information.

Studio C Health Limited is the data controller responsible for your personal information.

Alumme Chiropractic is a trading name of Studio C Health Limited.

Our website is:

https://alumme.health

Our clinic address is:

56–58 St John’s Road
Corstorphine
Edinburgh
EH12 8AT

Telephone: 0131 287 3302

Email: info@alumme.health

Company registration number: SC825621

2. What information we collect

Depending on how you interact with us, we may collect and process the following types of personal information:

Information you provide to us

This may include:

• Your name
• Date of birth
• Address
• Email address
• Telephone/mobile number
• Emergency contact details
• Appointment and booking information
• Payment and billing information
• Information you provide when contacting us
• Information provided when completing forms or requesting an appointment
• Marketing preferences and communication preferences

Health information

If you become a patient, we may collect information relating to your health and wellbeing, including:

• Your symptoms and presenting concerns
• Relevant medical history
• Previous treatment and healthcare information
• Information about medications where relevant
• Clinical examination findings
• Diagnostic imaging and reports
• Treatment and care records
• Information about your progress and response to care
• Information about lifestyle, exercise and other factors relevant to your care

Health information is considered special category data under UK data protection law and is subject to additional protections.

Information collected automatically

When you use our website, we may collect technical information such as:

• IP address
• Browser type and version
• Device type
• Operating system
• Pages visited
• How you interact with our website
• Approximate location derived from IP address
• Website referral information
• Cookies and similar technologies

The exact information collected will depend on the cookies, analytics and other technologies operating on our website.

3. How we use your information

We use personal information for the following purposes:

Providing chiropractic care

We use your information to:

• Assess your health and presenting concerns
• Carry out examinations and assessments
• Provide chiropractic care
• Develop and manage your care plan
• Monitor your progress
• Maintain accurate clinical records
• Communicate with you about your care
• Arrange appointments and reminders
• Provide information and recommendations relevant to your care
• Coordinate with other healthcare professionals where appropriate and lawful

Managing your appointments

We may use your personal information to:

• Arrange appointments
• Confirm and remind you about appointments
• Reschedule or cancel appointments
• Contact you about changes to clinic arrangements
• Manage your patient account

Payments and administration

We use your information to:

• Process payments
• Manage invoices and accounts
• Process refunds where applicable
• Maintain financial and business records
• Comply with legal and accounting requirements

Improving our services

We may use information to understand how patients interact with our services and website and to improve our clinic, website, patient experience and communications.

Marketing and communications

Where permitted by law, we may contact you about:

• Clinic news and updates
• Educational information
• Events and workshops
• Services and offers
• Relevant health and wellbeing information
• Referral opportunities

You can unsubscribe from marketing communications at any time.

4. Our lawful bases for processing your information

Data protection law requires us to have a lawful basis for processing personal information. The appropriate basis depends on what we are doing with your information. The ICO requires organisations to identify and document their lawful basis for each processing purpose.

Depending on the circumstances, we may rely on:

Contract

We may process your information where it is necessary to provide services to you or take steps at your request before entering into a contract.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Legitimate interests

We may process personal information where this is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

For example, this may include certain administrative activities, service improvement and appropriate business communications.

Where we rely on legitimate interests, we consider the impact on your privacy and whether the processing is necessary and proportionate.

Consent

In some circumstances we may ask for your consent to process personal information.

Where we rely on consent, you can withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

5. Health information

Because we provide chiropractic and healthcare-related services, we may need to process information concerning your health.

Health information is special category data under the UK GDPR and requires an additional legal condition alongside the normal lawful basis for processing.

Where appropriate, we process health information for the purposes of providing and managing healthcare and maintaining your clinical records, using the applicable UK GDPR Article 9 condition and relevant UK data protection legislation.

We only collect and use health information that is relevant and necessary for the purposes for which it is processed.

We take additional care with health information because of its sensitive nature.

6. Who we share your information with

We do not sell your personal information.

We may share information with organisations and individuals where this is necessary to provide our services, operate our business, comply with the law or otherwise where permitted by law.

These may include:

• Appointment and patient management software providers
• Payment providers
• IT and website providers
• Email and communication providers
• Cloud storage and technology providers
• Professional advisers such as accountants or solicitors
• Healthcare professionals where appropriate and lawful
• Insurance companies where necessary and authorised
• Regulators, authorities or law enforcement agencies where we are legally required to do so

Where third-party organisations process information on our behalf, we take appropriate steps to ensure that they process your information securely and in accordance with applicable data protection requirements.

Service providers we use include: PracticeHub, GoHighLevel, TakePayments, Synergy Wholesale , Gmail, Practice Development, AutoChiro, SumUp, GoCardless, Stripe

7. Sharing information with other healthcare professionals

Where appropriate and lawful, we may share relevant information with another healthcare professional involved in your care.

We will generally seek your consent before doing this unless we have another lawful basis for sharing the information or are required or permitted to do so by law.

8. How we protect your information

We take appropriate technical and organisational measures to protect personal information against:

• Unauthorised access
• Accidental loss
• Destruction
• Misuse
• Unauthorised alteration
• Unauthorised disclosure

Access to patient and health information is restricted to people who need it for legitimate purposes.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

9. How long we keep your information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting and clinical record-keeping requirements.

Different types of information may therefore be retained for different periods.

For example, clinical and patient records may need to be retained for an appropriate period after your care has ended.

Adults will have their records kept for 8 years from the patient’s last visit/treatment. Children will have their records kept until their 25th birthday, or 26th if they were 17 when treatment ended

When information is no longer required, we will securely delete it or anonymise it where appropriate.

The ICO requires privacy notices to explain how long personal information is retained, or the criteria used to determine the retention period.

10. Cookies

Our website may use cookies and similar technologies.

Cookies are small files placed on your device which can help a website function, remember preferences, understand how visitors use the website and, where applicable, support marketing.

Some cookies are strictly necessary for the website to operate.

Other cookies, such as analytics or advertising cookies, may require your consent depending on how they are used.

Where required, we will ask for your consent before placing non-essential cookies on your device.

You can control or delete cookies through your browser settings.

We may use Google Analytics, Meta Pixel, and Google Ads.

The ICO notes that website visitors should be informed about cookies and that non-essential cookies generally require user agreement.

11. Marketing communications

We may send you marketing communications where we are permitted to do so under applicable data protection and electronic marketing laws.

You can stop receiving marketing communications at any time by:

• Clicking the unsubscribe link in an email;
• Following the instructions provided in a message; or
• Contacting us directly.

Stopping marketing communications will not affect communications that are necessary for your appointments, care or other services you have requested.

12. Your rights

Under UK data protection law, you may have rights including:

• The right to be informed about how we use your information
• The right to access your personal information
• The right to request correction of inaccurate information
• The right to request deletion of your information in certain circumstances
• The right to request restriction of processing in certain circumstances
• The right to object to certain processing
• The right to data portability in certain circumstances
• The right to withdraw consent where we rely on consent

These rights are not absolute and may be subject to legal exceptions or conditions.

For example, the right to erasure does not necessarily mean that we can delete clinical records where we have a legal or professional reason to retain them.

The ICO confirms that individuals have rights including access, rectification, erasure, restriction and objection, although which rights apply depends on the circumstances and lawful basis.

13. How to exercise your rights

If you would like to exercise any of your data protection rights, please contact:

Studio C Health Limited
Trading as Alumme Chiropractic
56–58 St John’s Road
Corstorphine
Edinburgh
EH12 8AT

Email: info@alumme.health

We may need to verify your identity before responding to a request.

14. Complaints

We hope that we can resolve any concerns you may have about how we use your personal information.

If you have concerns, please contact us using the details above.

You also have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office (ICO)

You can find information about making a complaint on the ICO’s website:

Information Commissioner’s Office

15. International transfers

Some of our service providers may process personal information outside the UK.

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place as required by applicable data protection law.

Where relevant, these may include an adequacy decision, appropriate contractual safeguards or another lawful transfer mechanism.

16. Children’s information

Our services may be provided to children and young people where appropriate.

Where we process information relating to children, we take additional care to ensure that information is handled appropriately and in accordance with applicable data protection requirements.

Where appropriate, we may communicate with a parent or legal guardian regarding a child’s care.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or the way we process personal information.

The latest version will always be published on our website.

Last updated: 22 September 2026