Privacy Policy

1. Who we are

These pages are operated by Andrew Hewitt, a sole trader practising as Andrew Hewitt Chiropractic ("we", "us", "our"). Andrew Hewitt is the data controller for the personal data described in this policy, meaning he decides how and why it is used.


We are not Spiro Clinic and Wellness Centre. Andrew Hewitt practises from Spiro's premises, and Spiro has its own separate privacy policy covering the data it holds as a clinic.


Practice address: Spiro Clinic and Wellness Centre, Smithfield, Lower Galdeford, Ludlow, Shropshire, SY8 1RT



Contact email: [email protected] (marked for the attention of Andrew Hewitt)


Contact phone: 01584 874200


2. What personal data we collect

When you complete the form on either of these pages, whether to claim the new patient voucher or to book a slot at the spine and posture check event, we collect:


  • Your first and last name

  • Your email address

  • Your phone number

  • Attribution data submitted via hidden fields alongside your form entry: marketing campaign parameters (UTM Source, Medium, Campaign, Platform), the page URL you submitted from, and ad click identifiers (Meta's fbclid and Google's click ID) used to match your enquiry to the ad that brought you here

  • Technical data such as your IP address, browser type, and how you interact with these pages, collected automatically via cookies and similar technologies (see Section 6)


We also collect anything you tell us when our booking team follows up by phone, email, or text to arrange your appointment or confirm your event slot, including a recording of that call.


If you go on to book an appointment, your appointment is entered into the booking diary at Spiro Clinic and Wellness Centre, where Andrew Hewitt practises, so Spiro will hold your name and appointment time as part of running that diary. See Section 7.


We do not knowingly collect any personal data beyond what is listed above, or what you choose to tell us directly.


3. How we collect your data

We collect data when you:


  • Complete a form on either of these pages, to claim the new patient offer or to book an event slot

  • Contact us directly by phone, email, or messaging

  • Speak to our booking team when they call or text you about your enquiry

  • Browse these pages, via cookies and tracking technologies

4. How we use your data and our legal basis

We use your personal data to:


Purpose

Legal basis

Respond to your enquiry and send you the voucher or event slot you requested

Legitimate interests, taking steps at your request before entering into a service arrangement with you

Contact you by phone, email, or text to arrange your appointment or confirm your event slot

Legitimate interests / performance of a contract

Record calls with our booking team to confirm what was agreed and to check the quality of the service

Legitimate interests

Send you marketing communications, where you have opted in

Consent

Improve these pages and our services

Legitimate interests

Comply with legal or regulatory obligations

Legal obligation


Where we rely on legitimate interests, we have considered that this processing is necessary and proportionate, and does not override your rights. You can ask us for details of this assessment at any time using the contact details above.


Confirm: Call recording is listed because the Virtual Reception team handles follow-up on these funnels. Sections 2 and 4 both state calls are recorded, which means the call opening has to say so. Check the VR script does. If calls on this account are not recorded, remove the recording line from Sections 2 and 4 and the retention line in Section 9.

5. Special category data (health information)

Check this section carefully: Andrew Hewitt delivers chiropractic care, so health data is in play the moment someone attends. What matters for this policy is whether it is collected on the funnel itself. The paragraphs below assume it is not.


These forms only ask for your first name, last name, email, and phone number, plus hidden attribution fields (see Section 2). They do not ask you to describe any injury, condition, or symptom, so we do not collect health information through them.


If you tell us about an injury, condition, or symptom when our booking team follows up, or when you attend the spine and posture check, we record it only so that we can assess you and book you the right appointment. This counts as special category (health) data under Article 9 UK GDPR, and we rely on Article 9(2)(h), processing necessary for medical diagnosis and the provision of health care and treatment, met in UK law by paragraph 2 of Schedule 1 to the Data Protection Act 2018. This data is subject to the additional safeguards described in Section 13.

6. Cookies and tracking technologies


These pages use the following cookies and similar technologies:


Tool

Cookie ID

Domain

Category

Duration

Purpose

GA4

_ga

Funnel domain

Analytics

400 days

Distinguishes unique visitors for Google Analytics

GA4

ga<container ID>

Funnel domain

Analytics

Session

Maintains the current GA4 session state

GA4

_gid

Funnel domain

Analytics

24 hours

Identifies the visitor for session tracking

Google Ads (Conversion Linker)

gclaw

Funnel domain

Advertising

90 days

Detects the ad click ID (gclid) in the URL and attributes a conversion back to the ad that drove it, the core conversion tracking cookie

Google Ads

gclau

Funnel domain

Advertising

90 days

Browser identifier supporting conversion measurement alongside gclaw

Meta Pixel

_fbp

Funnel domain

Advertising

90 days

Tracks visits across sites to deliver Meta advertising

Meta Pixel

_fbc

Funnel domain

Advertising

90 days

Stores the ad click ID to attribute a conversion to the ad that drove it

Cloudflare

__cf_bm, __cf_logged_in, cf_clearance, CF_VERIFIED_DEVICE_*

Funnel domain

Essential

30 min to 1 year

Bot management and security checks, confirms the visitor has passed Cloudflare's checks

GHL (native)

msgsndr_id

Funnel domain

Essential

14 days

GoHighLevel's own visitor identifier for the funnel

GHL (native)

cookie-config, current_url

Funnel domain

Essential

1 year

GHL's own site configuration and current-page tracking, required for the funnel to function


Essential cookies are necessary for the pages to function and do not require consent. All other categories above (Analytics, Advertising) are not essential and will only be set with your consent, which you can give or withdraw at any time via the cookie consent banner on these pages.


7. Who we share your data with

We may share your data with:


  • GoHighLevel (GHL), who hosts these pages and processes your data on our behalf to manage enquiries and communications

  • Civet Media Ltd, our marketing agency, who processes your data on our behalf to run and measure our advertising campaigns, and whose Virtual Reception team contacts you to arrange your appointment

  • Cloudflare, who provides security and bot-management services for these pages

  • Meta and Google, where you have consented to advertising cookies, so that we can measure and improve our advertising

  • Spiro Clinic and Wellness Centre, where Andrew Hewitt practises, who hold your name and appointment time in the clinic booking diary so that your appointment can be scheduled and managed


We do not sell your personal data to anyone.

8. International transfers

Some of the providers listed in Section 7 may store or process data outside the UK, for example in the United States. Where this happens, we ensure appropriate safeguards are in place, such as the UK Extension to the EU-US Data Privacy Framework, the ICO's International Data Transfer Agreement, or the ICO's International Data Transfer Addendum to the European Commission's standard contractual clauses, so your data continues to be protected to UK standards.

9. How long we keep your data

We keep your personal data for 26 months from your last contact with us, after which it is securely deleted, unless we are required to keep it for longer to meet a legal, accounting, or regulatory requirement.


Call recordings are kept for 12 months.


If you go on to become a patient, your clinical records are kept for longer. The General Chiropractic Council requires chiropractors to keep patient records for eight years from the last visit, and for a child, until their 25th birthday, or their 26th birthday if they were 17 when treatment ended. We will explain this separately when you attend.


Confirm: 26 months matches the figure used on Lyfe Health's and The Medical's funnel policies. Check it against the actual GHL CRM settings on this account, and get the VR call recording retention period. The eight year GCC figure is fixed and does not need checking, but confirm who physically holds those records if any part of the record-keeping runs through Spiro.

10. Your rights

Under UK data protection law, you have the right to:


  • Access the personal data we hold about you

  • Ask us to correct inaccurate data

  • Ask us to delete your data

  • Ask us to restrict how we use your data

  • Object to our use of your data, including an absolute right to object to direct marketing

  • Receive your data in a portable format

  • Withdraw consent at any time, where we rely on consent


To exercise any of these rights, contact us using the details in Section 1. There is no charge. We will respond within one month, and we will tell you within that month if a complex or repeated request means we need longer.


If you are unhappy with how we have handled your data, tell us first using the details in Section 1. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

11. Marketing communications

We will only send you marketing messages by email, text, or phone where you have given consent, or where the law otherwise permits it. You can opt out at any time by contacting us or using the unsubscribe link in any marketing message.


Messages about the voucher or event slot you asked for, and about arranging your appointment, are not marketing. We will send those whether or not you opt into marketing.


Confirm: Both pages carry the line "100% Secure. We Never Share Your Email." That becomes a binding promise once this policy publishes. It holds only if no email address is ever uploaded to Meta or Google for custom audiences. If custom audiences are running on this account, either that line comes off both pages or this section needs a paragraph describing the sharing and the consent behind it.

12. Children

These pages and the appointments they lead to are intended for adults. We do not knowingly collect personal data through these forms from children.


Confirm: Most chiropractors treat children, and a parent could claim the voucher or book an event slot for one. If Andrew Hewitt treats children, this section should say the booking is made by an adult on the child's behalf, and consent to treatment is taken from a person with parental responsibility. Check before publishing. This matters more on the event page than the voucher page, since a free posture check is exactly the sort of thing a parent brings a child to.

13. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. Where we hold health information under Section 5, we apply additional access controls so that this data is only visible to those involved in delivering your appointment or assessment.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised.

15. Contact us

If you have any questions about this policy or how we handle your data, contact Andrew Hewitt at [email protected], marking your message for his attention, on 01584 874200, or by post to Andrew Hewitt Chiropractic, Spiro Clinic and Wellness Centre, Smithfield, Lower Galdeford, Ludlow, Shropshire, SY8 1RT.

Last updated

1/9/26