Privacy & cookies
Last updated 24 October 2026
This notice explains what personal data Restore & Move Chiropractic collects through this website, why we collect it, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers the website and the enquiries you make through it. If you go on to become a patient, we will also explain how your clinical records are handled when you attend.
Who is responsible for your data
The data controller is Restore & Move Chiropractic (Dr Elliot Ward), 2, The Studio, Bryanstone Walk, Talbot Woods, Bournemouth BH9 2GA. You can contact us about anything in this notice by email at elliot@restoreandmove.co.uk or by phone on 07786 386370.
ICO registration number: to be confirmed.
What we collect
When you send an enquiry we collect your name, your phone number and/or email address, and anything you choose to write in the message box. We also record the page you were on when you submitted the form and, if you arrived from an advert or a link with campaign details in it, those campaign details (for example the campaign and advert identifiers and any Meta click identifier). Unless you have accepted marketing cookies this is read from the page address at the moment you submit the form and nothing is stored in your browser beforehand.
When you book online through the booking widget on our Book page, you enter your name, contact details, the appointment you want and, where a deposit is taken, your card details. The booking details go to Zoneee, the booking system we use to run the diary. Card details go directly to Stripe, our payment provider, and never reach us or Zoneee: we see only that a deposit was paid, the amount and the last four digits of the card.
When we text you. If you enquire through our website or a Meta lead form and give a UK mobile number, we may follow up by text message. Those first texts are written by an automated assistant working from a script that Dr Elliot Ward has approved, using the information on this website to answer simple questions and to help you book. It does not diagnose or give medical advice. Elliot reads the conversation and takes over personally whenever you ask for a person, whenever the assistant cannot help, or whenever anything urgent is mentioned. Reply STOP at any time and we will not text you again. The messages you send and receive are stored with your enquiry.
When you use the chat on our website. The chat bubble on our main pages is an automated assistant that writes as Elliot, working from a script he has approved and the information on this website. It can answer simple questions and point you to the booking page; it does not diagnose or give medical advice, and if you ask whether you are talking to a person it will tell you. Nothing is stored until you send a message; after that, a reference for the conversation is kept in your browser for the rest of your visit (session storage, which is cleared when you close the tab) so that the chat can continue across pages. The messages you send are stored with the time and the page you were on. If you give your name and mobile number in the chat, we create an enquiry record as described above and may continue the conversation by text message. Chats that do not lead to an enquiry are deleted after 30 days. Elliot can read any chat and reply himself, and does so whenever you ask for a person, whenever the assistant cannot help, or whenever anything urgent is mentioned.
Health information. People often describe their pain, injury or medical history in the message box so that we can advise them. That is special category data under UK GDPR. We only use it to understand your enquiry, to decide whether chiropractic care is suitable and to prepare for your first visit, and it is seen only by Dr Elliot Ward and anyone helping run the clinic. Please include only what you are comfortable sharing; you can tell us the rest in person.
Technical information. Our hosting provider records the IP address and browser type of each request in short-lived logs so that the site can be served and protected. We use your IP address at the time you submit the form to limit repeated submissions, and if you have consented to advertising measurement it is included in the data sent to Meta (see below). We do not use IP addresses to identify individual visitors otherwise.
Your cookie choice is stored in a cookie so that we do not ask you again (see Cookies below).
Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry, calling you to arrange and confirm an appointment and preparing for it | Taking steps at your request before entering into a contract for care (Article 6(1)(b)). For health information in your message, the provision of health care by a regulated health professional under a duty of confidentiality (Article 9(2)(h)). |
| Taking your online booking and any deposit, and reminding you of the appointment | Taking steps at your request before entering into a contract for care, and performing it (Article 6(1)(b)) |
| Keeping a record of the enquiry and of our contact with you | Our legitimate interest in running the clinic and keeping accurate records (Article 6(1)(f)) |
| Understanding which pages and adverts lead to enquiries, using the campaign details in the link you arrived from | Our legitimate interest in measuring our own marketing (Article 6(1)(f)); no cookies are set for this without consent |
| Advertising measurement with Meta (pixel and Conversions API) | Your consent (Article 6(1)(a) and the Privacy and Electronic Communications Regulations), which you can withdraw at any time |
| Protecting the website from abuse and automated submissions | Our legitimate interest in keeping the site secure (Article 6(1)(f)) |
We do not sell your data, use it for automated decision-making or send you marketing emails.
Advertising measurement (only with your consent)
If you accept marketing cookies in the banner, two things happen. (The tick box on the enquiry form is separate: it confirms we may use your details to respond, and does not switch on any advertising measurement.) The Meta Pixel is loaded in your browser, which sets the cookies listed below and tells Meta Platforms Ireland Limited which pages you visited and that you sent an enquiry. Separately, when your enquiry is saved we send Meta a matching record through the Meta Conversions API containing a hashed (scrambled, one-way) version of your email address, phone number and name, your IP address and browser type, the Meta identifiers from the pixel or the link you arrived from, and a shared event identifier so that the two records are counted once. Meta uses this to tell us whether an advert led to an enquiry; it cannot read the hashed values and does not receive your message. Meta's own use of this data is described in its privacy policy at facebook.com/privacy. If you decline, none of this happens and your enquiry is handled exactly the same way.
Who we share it with
We use a small number of service providers who process data on our instructions under written contracts:
- Supabase hosts the database where enquiries and the clinic's lead records are stored. The database is located in London, United Kingdom.
- Vercel Inc. hosts the website and runs the code that receives your form. Vercel is based in the United States; transfers are covered by Vercel's data processing agreement, which incorporates the UK International Data Transfer Addendum to the EU standard contractual clauses.
- Zoneee provides the online booking system. When you book through the widget on our Book page, your name, contact details and appointment details are stored in Zoneee so that we can manage the diary, confirm the booking and send appointment reminders. Zoneee's own privacy policy is at zoneee.software.
- Stripe Payments UK Limited handles deposit payments taken when you book online. Your card details are entered into a form served by Stripe and are sent straight to Stripe; we never see or store them. Stripe processes the payment, screens it for fraud and tells us whether it succeeded. Stripe's privacy policy is at stripe.com/gb/privacy. Stripe may transfer data to the United States under its own safeguards.
- Twilio Ireland Limited sends and receives our text messages, including the automated assistant's messages, payment links and the alerts we send ourselves when an enquiry arrives. Twilio holds message content and phone numbers to deliver them and may transfer data to the United States under its own safeguards. Twilio's privacy notice is at twilio.com/en-us/legal/privacy.
- Anthropic, PBC provides the language model behind the automated text and website chat assistant. The conversation (your messages and ours, your first name and what you have told us about your enquiry) is sent to Anthropic's API so it can draft the next reply. Anthropic acts as our processor, does not use the data to train its models and retains API inputs and outputs only for a limited period for abuse monitoring. Anthropic is based in the United States; transfers are covered by its data processing addendum, which incorporates the UK International Data Transfer Addendum. Anthropic's privacy policy is at anthropic.com/privacy.
- Meta Platforms Ireland Limited, only if you consent, for advertising measurement as described above. Meta may transfer data to the United States under its own safeguards.
- Google. The reviews shown on this site are reviews that patients have posted publicly on our Google Business Profile, and we retrieve our current rating and review count from Google's Places service. Those requests are made from our server, not from your browser, so Google receives nothing about your visit from this website. Links to Google Maps and to leave a review take you to Google, whose privacy policy then applies.
- Cloudflare, if we enable its Turnstile anti-bot check on the form, which may process your IP address and browser details to tell people from bots.
We will also disclose personal data where the law requires it, for example to a regulator or court, or where it is necessary to protect someone's vital interests. The clinic's staff portal, where enquiries are managed, is restricted to authorised staff with individual logins.
How long we keep it
Enquiry records are kept for two years from our last contact with you, after which they are deleted. If you become a patient, your enquiry becomes part of your clinical record, which we are required to keep for at least eight years after your last appointment (longer for children) in line with General Chiropractic Council guidance. Bookings are kept in Zoneee as part of the diary and your patient record. Stripe keeps payment records for as long as financial regulations require. Text message conversations are kept with the enquiry record; our opt-out list is kept indefinitely so that a STOP request is honoured. Hosting logs are kept by our provider for a short period, normally no more than 30 days. Data sent to Meta is retained under Meta's own policies.
Cookies
We set only the cookies below. Nothing except the essential consent cookie is set until you make a choice, and the marketing cookies are set only if you accept. The payment form on our Book page is provided by Stripe and may set its own cookies, which are strictly necessary to take the payment and protect it from fraud; they are not used for advertising and do not need your consent.
| Cookie | Purpose | Lasts |
|---|---|---|
| rm_consent | Remembers your cookie choice. Essential. | 6 months |
| rm_ft, rm_lt | First-party record of how you arrived at the site (campaign details in the link, landing page), used only to attribute your enquiry if you make one. Set by us, not shared. Only set if you accept marketing cookies; removed if you reject. | 90 days |
| __stripe_mid, __stripe_sid | Set by Stripe inside the payment step of the booking widget on the Book page, to process the payment and detect fraud. Strictly necessary for the payment; not used for advertising. | 1 year, 30 minutes |
| _fbp, _fbc | Meta Pixel. Marketing: measures whether our adverts lead to enquiries. Only set if you accept. | 90 days |
The booking widget itself (Zoneee) sets no cookies on this site. The staff portal sets authentication cookies for signed-in staff only. If Cloudflare Turnstile is enabled on the form it may set a cookie on cloudflare.com for the duration of the check. Our fonts are served from our own site, so no font provider sees your visit.
Your choice
You can change or withdraw your cookie consent at any time here. Withdrawing consent does not affect what we did while it was in place.
Checking your choice…
If you accept and later reject, the Meta pixel stops loading on your next page view. Cookies Meta has already set in your browser can be removed through your browser settings.
Your rights
Under UK GDPR you have the right to:
- be told how your data is used (this notice);
- access a copy of the personal data we hold about you;
- have inaccurate data corrected and incomplete data completed;
- have your data erased where there is no good reason for us to keep it;
- restrict how we use your data in certain circumstances;
- receive the data you gave us in a portable, machine-readable format;
- object to processing based on our legitimate interests, including marketing measurement;
- withdraw consent at any time where consent is our lawful basis.
To exercise any of these rights, email elliot@restoreandmove.co.uk. We will respond within one month and will not charge a fee unless a request is clearly unfounded or excessive. We may need to confirm your identity first.
If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or online at ico.org.uk/make-a-complaint.
Changes to this notice
We will update this page if the way we handle your data changes, and the date at the top shows when it was last revised. Significant changes will be highlighted on the site.