top of page
Pentland-Podiatry-logo
Request Appointment

Privacy Policy

Pentland Podiatry is committed to protecting your personal information and handling it securely, fairly and transparently in accordance with UK data protection law.

This Privacy Policy explains what information is collected, why it is used, who it may be shared with, how long it is retained and your rights in relation to your personal information.

  • Privacy Policy
  • Who We Are
  • Information We Collect
  • Why We Collect Your Information
  • AI-Assisted Clinical Documentation
  • Who We May Share Your Information With
  • Storage and Security
  • Your Rights
  • Contact Information

Who We Are

Pentland Podiatry is operated by Alan Findlay, sole trader and HCPC-registered podiatrist.

For data protection purposes, Alan Findlay trading as Pentland Podiatry is the data controller responsible for your personal information.

Pentland Podiatry provides pre-booked podiatry assessment and treatment from a private clinical room in Penicuik and through selected home visits.

Information We Collect

Depending on your interaction with Pentland Podiatry, information collected may include:

  • name, date of birth and contact details;

  • address and emergency contact details;

  • GP and other healthcare-provider details;

  • medical history, health conditions, medication and allergies;

  • clinical examination and assessment findings;

  • diagnosis, treatment and care plans;

  • clinical notes and correspondence;

  • clinical photographs where appropriate;

  • appointment and communication records;

  • payment and transaction information;

  • information you provide through the website, email, telephone or booking system.

Health information is classed as special category personal data and receives additional protection under UK data protection law

Why We Collect Your Information

Personal information may be used to:

  • arrange and manage appointments;

  • assess your healthcare needs;

  • provide podiatry assessment, treatment and follow-up care;

  • maintain accurate clinical records;

  • communicate with you regarding your care;

  • communicate with other healthcare professionals where appropriate;

  • process payments and maintain business records;

  • meet professional, regulatory, legal and insurance requirements;

  • respond to complaints, concerns or legal claims;

  • maintain the safety, security and administration of the practice.

AI-Assisted Clinical Documentation

Pentland Podiatry may use secure clinical documentation software, including Heidi Health, to assist with producing clinical notes during or following consultations.

Where used, the technology assists with creating draft documentation. It does not replace clinical judgement or make treatment decisions.

Clinical records produced with this assistance are reviewed and approved by the podiatrist before becoming part of the patient record.

Pentland Podiatry does not use AI to make solely automated clinical decisions about patients.

Who We May Share Your Information With

Where necessary and appropriate, information may be shared with:

  • your GP;

  • other healthcare professionals involved in your care;

  • healthcare or referral services;

  • service providers acting on behalf of Pentland Podiatry;

  • professional indemnity insurers or professional advisers;

  • regulatory or professional bodies where required;

  • law-enforcement agencies, courts or other authorities where there is a lawful requirement to disclose information.

Only information that is necessary and relevant to the particular purpose will be shared.

Pentland Podiatry does not sell patient personal information.

​

International processing

​

Some technology providers may process or store personal information outside the United Kingdom.

Where this occurs, Pentland Podiatry will use service providers that have appropriate safeguards in place for international transfers in accordance with UK data protection requirements.

Storage and Security

Pentland Podiatry uses appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, loss or misuse.

Electronic records and business information may be processed using professional service providers, including services used for:

  • clinical records and appointment management;

  • clinical documentation;

  • secure email and communication;

  • website hosting and enquiries;

  • banking and payment processing;

  • IT and data storage.

These providers are only permitted to process information for the services they provide and are required to handle personal information appropriately.

​

How long information is kept

​

Personal information is not kept for longer than necessary.

Clinical records are retained for a period appropriate to the provision of healthcare and in accordance with applicable professional, legal, regulatory and insurance requirements.

Other records, including appointment, correspondence, financial and administrative information, are retained for as long as reasonably necessary for the purpose for which they were collected and to meet applicable legal, tax and business requirements.

Retention periods are reviewed and information is securely deleted or destroyed when it is no longer required.

The ICO allows a privacy notice to describe the criteria used to determine retention where there is not a single fixed retention period.

Your Rights

Depending on the circumstances and the lawful basis being relied upon, you may have the right to:

  • request access to your personal information;

  • request correction of inaccurate or incomplete information;

  • request deletion of information where the right to erasure applies;

  • request restriction of processing;

  • object to certain uses of your information;

  • request transfer of your information where the right to data portability applies;

  • withdraw consent where processing specifically relies upon consent.

  • ​

Some rights are not absolute. For example, healthcare records may need to be retained where there is an ongoing professional or legal reason for doing so.

Requests regarding personal information can be made using the contact details above.

​

Right to object

​

Where Pentland Podiatry relies upon legitimate interests as the lawful basis for processing your personal information, you have the right to object to that processing in certain circumstances.

Please contact Pentland Podiatry if you wish to exercise this right.

​

Complaints

​

If you have concerns about how your information has been handled, please contact Pentland Podiatry first so that the matter can be considered.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO).

The ICO is the UK’s independent regulator for data protection.

Last Updated: August 2026

If you have any questions about this Privacy Policy or how your information is handled, please contact Pentland Podiatry using the details on our Contact page.

bottom of page