Privacy Policy

Last updated: April 2026

 

1. Who We Are

This Privacy Policy explains how Jo Penny Foot Health collects, uses, and protects your personal information when you visit our website or use our services.

Jo Penny Foot Health is a sole trader business providing mobile foot health services in and around Aldershot, Farnham, Fleet, Camberley, Farnborough, Frimley, and surrounding areas of Surrey and Hampshire.

 

Business name:  Jo Penny Foot Health

Business owner:  Jo Gill MCFHP MAFHP

Address:  127 Holly Road, Aldershot, Hampshire, GU12 4SE

Telephone:  07928 287527

Email:  info@jopennyfoothealth.com

Website:  www.jopennyfoothealth.com

 

2. What Personal Data We Collect

We may collect and process the following personal data about you:

a) Data you provide to us directly

• Your name, telephone number, and email address when you contact us to make an enquiry or book an appointment
• Your home address when you book a home visit appointment
• Relevant medical history, including current medications, health conditions, and any other information necessary to carry out your treatment safely
• Photographs of your feet or nails, where you send these to us via WhatsApp or email to assist with assessment and pricing prior to an appointment
• Payment information, such as confirmation of bank transfer or cheque details, where relevant

 

b) Data collected automatically when you visit our website

• Your IP address and browser type
• Pages you visit on our website and how long you spend on them
• How you arrived at our website, for example via a search engine or social media
• Cookie data, which is covered in our separate Cookie Policy available on our website

 

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To respond to your enquiries and provide you with information about our services
• To book and manage your appointments
• To carry out your foot health treatment safely, including assessing any medical considerations
• To send you appointment reminders where you have agreed to receive these
• To maintain records of your treatment history for continuity of care
• To comply with our legal and professional obligations as a registered foot health practitioner
• To improve our website and understand how visitors use it

 

Our lawful basis for processing your data

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following lawful bases for processing your personal data:

• Contract: where processing is necessary to provide the services you have requested
• Legitimate interests: where we have a legitimate business interest in processing your data, such as responding to enquiries or improving our website, and this interest is not overridden by your rights
• Legal obligation: where we are required to process your data to comply with a legal requirement
• Vital interests: in exceptional circumstances, where processing is necessary to protect your health or safety

 

Where we process special category data, such as information about your health conditions, we rely on the following additional conditions:

• Health or social care: processing is necessary for the provision of health care or treatment
• Explicit consent: where you have given us your explicit consent to process sensitive health information for a specific purpose

 

4. Health & Medical Information

As a foot health practitioner, Jo collects and processes information about your health and medical history as a necessary part of providing safe and appropriate treatment. This is classed as ‘special category’ data under UK GDPR and is treated with the highest level of care and confidentiality.

Your health information will only ever be used to:

• Inform and tailor your treatment
• Ensure your safety during appointments
• Maintain accurate treatment records

Your health information will never be sold, shared with third parties for marketing purposes, or used for any purpose other than your direct care, except where we are legally required to do so.

 

5. How Long We Keep Your Data

We will only retain your personal data for as long as is necessary for the purposes for which it was collected.

• Patient treatment records are retained for a minimum of eight years from the date of your last appointment, in line with NHS and professional body guidance for health records
• Enquiry and contact data, where no appointment takes place, will be deleted after 12 months
• Financial records are retained for six years in line with HMRC requirements

After these periods your data will be securely deleted or anonymised.

 

6. Who We Share Your Data With

We do not sell your personal data to third parties. We may share your data in the following limited circumstances:

• With a trusted local Podiatrist, where we refer you for treatment that falls outside the scope of our practice, and only with your knowledge and agreement
• With your GP or another healthcare professional, where this is necessary for your safety or continuity of care, and only with your knowledge and agreement
• With our website hosting provider and any third-party tools used to run our website, such as contact form software, where these tools process data on our behalf under a data processing agreement
• Where we are legally required to do so, such as in response to a court order or regulatory requirement

 

7. Your Rights Under UK GDPR

Under UK data protection law you have the following rights in relation to your personal data:

Right of access

You have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request. We will respond within one calendar month.

Right to rectification

You have the right to ask us to correct any personal data we hold about you that is inaccurate or incomplete.

Right to erasure

In certain circumstances you have the right to ask us to delete your personal data. Please note that we may be unable to delete treatment records before the end of the required retention period due to our professional and legal obligations.

Right to restriction of processing

You have the right to ask us to restrict the way we process your data in certain circumstances, for example if you contest the accuracy of the data we hold.

Right to data portability

Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format.

Right to object

You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis.

Right to withdraw consent

Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before you withdrew it.

 

To exercise any of these rights, please contact us using the details in Section 1. We will respond to all requests within one calendar month. If you are unhappy with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

 

8. Data Security

We take the security of your personal data seriously and have put in place appropriate technical and organisational measures to protect it against unauthorised access, loss, or destruction.

Patient records and personal data are stored securely and access is restricted to Jo Penny only. Any physical records are kept securely when not in use. Electronic records are protected by password access.

Where we use third-party tools or services to process data on our behalf, we ensure that appropriate data processing agreements are in place.

In the unlikely event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will inform you directly where required.

 

9. Links to Other Websites

Our website may contain links to other websites, including our social media profiles on Facebook and Instagram. These websites have their own privacy policies and we are not responsible for their content or practices. We encourage you to read the privacy policy of any website you visit via a link from our site.

 

10. Children’s Privacy

Our website is not directed at children under the age of 13 and we do not knowingly collect personal data from children. Where we treat patients who are minors, we obtain consent from a parent or guardian before collecting or processing any personal data. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

 

11. Cookies

Our website uses cookies. Full details of the cookies we use, how we use them, and how you can control your preferences are set out in our separate Cookie Policy, which is available at:

www.jopennyfoothealth.com/cookie-policy-uk/

 

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we do, we will update the ‘Last updated’ date at the top of this page. We encourage you to review this policy periodically to stay informed about how we protect your data.

Where changes are significant, we will take reasonable steps to bring them to your attention.

 

13. Contact Us & Making a Complaint

If you have any questions about this Privacy Policy, wish to exercise any of your data protection rights, or have a concern about how we handle your personal data, please contact us:

 

Jo Penny Foot Health

127 Holly Road, Aldershot, Hampshire, GU12 4SE

Telephone:  07928 287527

Email:  info@jopennyfoothealth.com

Website:  www.jopennyfoothealth.com

 

If you are not satisfied with our response, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

 

Information Commissioner’s Office

Website:  ico.org.uk

Telephone:  0303 123 1113

Post:  Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF