Privacy Policy

Who we are

This website is operated by Ed Cossart, a registered osteopath practising privately in Somerset and London. References to "we", "us" or "Ed Cossart" in this policy refer to Ed Cossart as a sole practitioner.

Ed Cossart is the data controller for the personal information collected through this website and through the enquiry process.

What information we collect

We collect personal information only when you actively provide it to us, for example by completing the enquiry form on this website or by contacting us directly by email or telephone.

Information you provide through the enquiry form

• Your name
• Your email address
• Your telephone number (optional)
• A description of what you are currently experiencing
• Details of approaches you have previously tried
• How long the issue has been affecting you
• Your preferred way of working (in person or remotely)

Information collected automatically

When you visit this website, standard technical data may be collected automatically by our hosting provider (Netlify). This may include your IP address, browser type, and the pages you visit. This data is used for security and performance purposes and is not used to identify you personally. Please refer to Netlify's privacy policy for details.

Health information

The enquiry form invites you to describe what you are experiencing. This may include information about your physical or mental health. This is treated as special category data under UK GDPR and handled with an additional level of care and discretion.

How we use your information

We use the information you provide solely to:

• Respond to your enquiry and assess whether this approach may be appropriate for your situation
• Communicate with you about your initial conversation or ongoing work
• Maintain records necessary for the provision of professional care
• Comply with our legal and professional obligations as a registered osteopath

We do not use your information for marketing purposes, and we do not send newsletters or promotional communications.

Legal basis for processing

We process your personal information on the following legal bases under UK GDPR:

• Legitimate interests, to respond to your enquiry and assess suitability
• Contract, to provide professional services where an agreement exists
• Legal obligation, to comply with our obligations as a registered osteopath, including record-keeping requirements set by the General Osteopathic Council
• Explicit consent, for the processing of health information, where required

Who we share your information with

We do not sell, rent, or share your personal information with third parties for their own purposes.

Your information may be shared in the following limited circumstances:

• Netlify, our website hosting and form submission provider. Enquiry form submissions are processed by Netlify. Please see their privacy policy for details.
• Professional obligation, in rare circumstances where we have a legal or professional obligation to disclose information, for example to safeguard your safety or the safety of others.

We do not transfer your data outside the United Kingdom or European Economic Area, unless the services we use (such as Netlify) operate internationally. Where data is transferred, appropriate safeguards are in place.

How long we keep your information

We retain personal information only for as long as necessary for the purposes described in this policy, or as required by our professional and legal obligations.

• Enquiry records, retained for up to 12 months if no professional relationship follows
• Client records, retained for a minimum of 8 years following the last treatment, in accordance with General Osteopathic Council guidance
• Financial records, retained for 6 years as required by HMRC

After the applicable retention period, your information is securely deleted or anonymised.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access, to request a copy of the personal information we hold about you
• Right to rectification, to request that inaccurate information is corrected
• Right to erasure, to request that your information is deleted, where there is no overriding reason to retain it
• Right to restriction, to request that we limit the way we process your information
• Right to data portability, to receive your information in a structured, commonly used format
• Right to object, to object to processing based on legitimate interests
• Right to withdraw consent, where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us using the details below. We will respond within one month.

Security

We take appropriate technical and organisational measures to protect your personal information against accidental loss, unauthorised access, disclosure or destruction. Enquiry submissions are transmitted securely via HTTPS.

Where we communicate with you by email, please be aware that email is not a completely secure method of communication. If you have concerns about the sensitivity of information you wish to share, please contact us by telephone in the first instance.

Contact & complaints

If you have any questions about this privacy policy, or wish to exercise any of your rights, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):