Last updated: 20 July 2026

​

1. About this notice

The Care Studio is committed to protecting your privacy and handling your personal information lawfully, fairly and securely.

​

This notice explains how we collect, use, store and share information when you:

• enquire about our services;

• book or attend an appointment;

• complete a registration, health-screening or consent form;

• receive an ear examination or treatment;

• contact us by telephone, email, WhatsApp, social media or through our website;

• make a payment; or

• otherwise interact with The Care Studio.

 

It applies to patients, prospective patients, parents, guardians, carers, representatives and website visitors.

This privacy notice explains how we use your information. It does not replace the clinical consent process undertaken before examination or treatment.

​

2. Who we are

The Care Studio is operated by Nicola Jackson as a sole trader.

​

For data-protection purposes, Nicola Jackson trading as The Care Studio is the data controller. This means that she decides why and how your personal information is used.

​

The Care Studio
Unit 6
12 High Street
Tutbury
Burton-on-Trent
Staffordshire
DE13 9LP

​

Email: nicola.thecarestudio@gmail.com

Telephone: 07708 518511

Website: www.thecarestudio.info

ICO registration reference: ZB812972

​

Nicola Jackson is the privacy contact for The Care Studio.

​

3. Information we collect

The information collected depends on how you interact with The Care Studio and the services you receive.

 

Personal and contact information

 

This may include:

• your name;

• title;

• date of birth;

• address;

• telephone number;

• email address;

• preferred method of contact;

• emergency contact details;

• GP details, where relevant;

• accessibility and communication requirements; and

• details of a parent, guardian, carer or representative.

 

Appointment and administrative information

 

This may include:

• appointment dates and times;

• booking history;

• cancellations, rescheduling and non-attendance;

• appointment confirmations and reminders;

• correspondence and enquiries;

• invoices, receipts and payment status;

• complaints, concerns and feedback; and

• records of communications with you.

 

Health and clinical information

 

To provide safe and appropriate care, The Care Studio collects information about your health. Health information is classed as special-category personal data and receives additional protection under UK data-protection law.

​

This may include:

• your current symptoms;

• relevant medical history;

• medications;

• allergies and sensitivities;

• previous ear conditions, operations, injuries and treatments;

• hearing-aid use;

• previous eardrum perforation or grommets;

• factors that may affect the safety or suitability of treatment;

• consultation and examination findings;

• the condition of your ear canal and eardrum;

• the presence, location and nature of ear wax;

• clinical decisions and treatment recommendations;

• the treatment method used;

• consent records;

• treatment notes and outcomes;

• complications or unexpected symptoms;

• aftercare advice;

• referrals or recommendations to seek further medical advice;

• follow-up information; and

• photographs or video-otoscope images forming part of your clinical record.

 

Payment information

 

Payments are processed using Clover.

​

The Care Studio may retain information confirming:

• the amount paid;

• the date and method of payment;

• whether payment was successful;

• refunds; and

• transaction references.

• ​

The Care Studio does not normally receive or store your complete debit or credit card details.

​

Website and technical information

 

When you use the website, information may be collected automatically, including:

• your IP address;

• device and browser type;

• operating system;

• pages visited;

• dates and times of visits;

• referring websites; and

• information collected through cookies and similar technologies.

 

4. How we collect information

 

Information may be collected:

• directly from you;

• from a parent, guardian, carer or representative;

• through Cliniko, our patient-management and booking system;

• through registration, pre-screening and consent forms;

• during consultations, examinations and treatments;

• through our website;

• by telephone, email, WhatsApp or social media;

• when you make a payment;

• when you provide feedback or make a complaint;

• from another healthcare professional, where appropriate and lawful;

• from an emergency service, safeguarding organisation or public authority; and

• automatically when you use the website.

Where someone provides information or acts on your behalf, we may need to confirm that they are authorised to do so.

​

5. Why we use your information

 

We use personal information to:

• respond to enquiries;

• register you as a patient;

• arrange and manage appointments;

• send confirmations, reminders and form requests;

• assess whether examination or treatment is safe and appropriate;

• provide ear examinations and ear wax removal;

• obtain and record consent;

• maintain accurate clinical records;

• provide aftercare and follow-up information;

• contact you about your care;

• recommend or make an appropriate onward referral;

• communicate with your GP or another healthcare professional where necessary and lawful;

• process payments, invoices and refunds;

• respond to complaints, concerns and incidents;

• meet legal, professional, insurance and safeguarding responsibilities;

• establish, exercise or defend legal claims;

• maintain the security of our systems;

• manage and improve The Care Studio;

• maintain financial and business records;

• understand how the website is used; and

• send optional marketing communications where you have chosen to receive them.

Clinical information will not be used for unrelated marketing.

​

6. Our lawful bases

 

UK data-protection law requires us to identify a lawful basis for each purpose for which personal information is used.

​

Depending on the circumstances, The Care Studio relies on the following lawful bases.

​

Contract

 

Information may be used where necessary to:

• arrange or manage an appointment;

• provide a service you have requested;

• administer the agreement between you and The Care Studio; or

• process payment.

 

Legal obligation

 

Information may be used where necessary to comply with legal or regulatory responsibilities, including obligations relating to:

• tax and financial records;

• safeguarding;

• data protection;

• responding to lawful requests; and

• reporting or managing certain incidents.

 

Legitimate interests

 

Information may be used where necessary for the legitimate interests of The Care Studio or another person, provided those interests are not overridden by your rights.

​

These interests may include:

• operating and administering the business;

• maintaining appropriate clinical and business records;

• protecting patients and the public;

• maintaining system and premises security;

• preventing fraud or misuse;

• responding to complaints;

• obtaining professional advice;

• handling insurance matters; and

• establishing, exercising or defending legal claims.

 

Consent

 

Consent may be used for optional activities such as:

• email marketing;

• identifiable testimonials;

• promotional photographs;

• case studies; or

• another optional use that has been clearly explained.

 

You can withdraw your consent at any time. Withdrawing consent does not affect processing that took place before consent was withdrawn.

​

Clinical consent to treatment is separate from consent relied upon as a data-protection lawful basis.

​

Vital interests

 

Information may be used or shared where necessary to protect your life or the life of another person.

​

7. How we use health information

 

As health information is special-category data, The Care Studio must have both an ordinary lawful basis and an additional condition for processing it.

​

Health information is primarily processed because it is necessary for:

• assessing your health and suitability for examination or treatment;

• providing and managing healthcare or treatment; and

• maintaining an appropriate clinical record.

 

This processing is undertaken by a registered healthcare professional who is subject to professional confidentiality obligations.

​

Health information may also be processed where:

• it is necessary to establish, exercise or defend a legal claim;

• it is necessary to protect someone’s vital interests and they cannot consent;

• it is necessary for a substantial public-interest purpose recognised by law, such as safeguarding; or

• you have provided explicit consent for a specific optional use.

 

The Care Studio does not use automated systems to make clinical decisions about patients.

​

8. Information we need from you

 

Some information is needed so that Nicola can assess whether examination or treatment is safe and appropriate.

​

You are not legally required to provide every item of information requested. However, if you do not provide information needed for a safe clinical assessment, Nicola may be unable to examine or treat you.

Please provide information that is accurate and complete and tell Nicola if anything relevant changes.

​

9. Cliniko

 

The Care Studio uses Cliniko to manage:

• patient registration;

• personal and contact details;

• appointments;

• health-screening and consent forms;

• treatment notes;

• clinical records and images;

• appointment confirmations and reminders;

• invoices and payment records; and

• related practice administration.

 

The Care Studio remains the data controller. Cliniko processes patient information on behalf of The Care Studio as a service provider.

​

Cliniko may use service providers or process information outside the United Kingdom. Where an international transfer is made, appropriate legal and contractual safeguards are used. Cliniko provides UK GDPR information and a data-processing framework for customers using its service.

​

10. Appointment communications

 

Appointment confirmations, reminders, form requests and other service-related messages will usually be sent by email through Cliniko.

​

We may also contact you by telephone, email, text message or another method where necessary to:

• manage an appointment;

• request required information;

• provide preparation or aftercare instructions;

• discuss your care; or

• respond to an enquiry.

 

These are service communications and are not marketing messages.

​

You are responsible for providing accurate contact details and ensuring that the contact method you provide is suitable for receiving appointment-related communications.

​

11. WhatsApp

 

If you contact The Care Studio through WhatsApp, we may use WhatsApp to respond to your enquiry or communicate about your appointment.

​

Please avoid sending highly sensitive information through WhatsApp unless Nicola has asked you to do so.

Where information received through WhatsApp is relevant to your care or the administration of your appointment, it may be added to your Cliniko record.

​

WhatsApp is operated by a separate organisation and processes information under its own privacy terms.

​

12. Clinical photographs and images

 

Where clinically appropriate, photographs or video-otoscope images may be taken and stored within your Cliniko patient record.

​

These images form part of the clinical record and will normally be retained for the same period as the associated treatment record.

​

Clinical images will not be used for marketing, social media, training, publicity or another unrelated purpose without separate, specific permission.

​

13. Who we share information with

 

The Care Studio does not sell or rent personal information.

Relevant information may be shared with trusted organisations or individuals where this is necessary and lawful. These may include:

​

• Cliniko and its authorised service providers;

• Clover and other payment-processing providers;

• website hosting and technical service providers;

• email and communication providers;

• IT support and data-security providers;

• accountants and bookkeepers;

• solicitors and professional advisers;

• insurers and insurance advisers;

• professional bodies and regulators;

• healthcare professionals involved in your care;

• your GP, where appropriate;

• emergency services;

• safeguarding authorities;

• law-enforcement bodies;

• courts and tribunals;

• HM Revenue & Customs; and

• other public authorities where disclosure is required or permitted by law.

 

Service providers acting on behalf of The Care Studio must only use information for the agreed purpose and must protect it appropriately.

​

Only information that is relevant and reasonably necessary will be shared.

​

14. Temporary contractor access

 

Patient information is normally accessed only by Nicola Jackson.

​

Where necessary, limited access may be provided to an authorised contractor assisting with system setup, data cleansing, migration or technical administration.

​

Any contractor must:

• act only on The Care Studio’s instructions;

• maintain confidentiality;

• access only the information necessary for the assigned work;

• use appropriate security measures; and

• cease access and remove retained working copies when the work is complete.

 

15. Sharing with healthcare professionals

 

Nicola may recommend that you contact your GP, NHS 111, an audiologist, an ear, nose and throat specialist or another healthcare provider.

​

Relevant information may be shared with another healthcare professional where:

• you have asked Nicola to do so;

• it is necessary for continuity of care;

• there is a serious concern about your health or safety;

• there is a safeguarding concern;

• an emergency arises; or

• disclosure is otherwise required or permitted by law.

 

Where appropriate, Nicola will discuss this with you before sharing information.

​

16. Safeguarding and serious risks

 

Patient confidentiality is important, but it is not absolute.

​

Relevant information may be disclosed without consent where Nicola reasonably believes this is necessary to:

• protect a child or adult at risk;

• prevent serious harm;

• respond to an emergency;

• comply with a court order or legal requirement; or

• assist an appropriate authority with a lawful investigation.

 

Only information that is necessary and proportionate will be disclosed.

​

17. Children and young people

 

The Care Studio treats patients aged four and over.

​

A parent or person with parental responsibility must attend appointments for patients under the age of 18.

Information may be collected about both the patient and their parent, guardian or carer.

​

Decisions concerning treatment consent, confidentiality and access to records will take account of:

• the child or young person’s age;

• their understanding and ability to make the relevant decision;

• their best interests;

• professional obligations; and

• applicable law.

 

A parent or guardian does not necessarily have an automatic right to every item of information in a competent young person’s clinical record.

​

18. Payments

 

Card payments are processed using Clover.

​

Clover may process payment information under its own terms and privacy notice. The Care Studio does not normally receive or retain complete card details.

​

Transaction details, invoices and receipts may be retained where required for accounting, tax, contractual or legal purposes.

​

19. How long information is kept

 

Personal information is kept only for as long as reasonably necessary for the purpose for which it was collected, taking account of clinical, professional, insurance, safeguarding, tax and legal requirements.

​

The Care Studio normally retains:

• adult clinical records: for eight years after the patient’s last appointment;

• records relating to children and young people: until the patient’s 25th birthday;

• records where treatment ended when the patient was aged 17: until the patient’s 26th birthday;

• clinical images: for the same period as the associated clinical record;

• financial and tax records: normally for at least six years after the end of the relevant accounting period;

• enquiries that do not lead to treatment: only for as long as reasonably needed to respond and administer the enquiry;

• complaints and incident records: for as long as necessary to investigate the matter and meet legal, professional and insurance requirements; and

• marketing preferences: until you withdraw your consent or the information is no longer required.

 

Information may be retained for longer where:

• a complaint, incident or legal claim is ongoing or reasonably anticipated;

• there is a safeguarding concern;

• an insurer, regulator or court requires it;

• retention is required by law; or

• deletion would compromise the integrity of a clinical record.

 

When information is no longer required, it will be securely deleted, destroyed or anonymised.

​

20. International transfers

 

Some technology providers used by The Care Studio may store or access information outside the United Kingdom.

​

Where personal information is transferred internationally, The Care Studio will ensure that an appropriate legal transfer mechanism is in place. This may include:

• UK adequacy regulations;

• approved contractual clauses;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses; or

• another lawful safeguard.

 

You may contact Nicola for more information about safeguards applying to a particular transfer.

​

21. How information is protected

 

The Care Studio takes reasonable technical and organisational measures to protect personal information against:

• unauthorised access;

• accidental loss;

• misuse;

• alteration;

• disclosure; and

• destruction.

 

Measures may include:

• secure hosted systems;

• encrypted transmission;

• individual user accounts;

• strong passwords;

• multifactor authentication;

• device security;

• access restrictions;

• audit trails;

• secure backups;

• confidentiality requirements;

• secure disposal arrangements; and

• procedures for responding to data incidents.

 

No electronic system is entirely risk-free, but reasonable and proportionate steps are taken to protect the information held.

​

22. Personal-data breaches

 

A personal-data breach includes accidental or unlawful loss, alteration, disclosure of or access to personal information.

​

Suspected breaches will be investigated promptly and reasonable steps will be taken to reduce any harm.

 

Where required by law, The Care Studio will notify the Information Commissioner’s Office and affected individuals.

​

23. Marketing

 

The Care Studio will only send optional marketing emails or messages where there is an appropriate lawful basis, normally your consent.

​

Marketing communications may include occasional:

• service news;

• practice updates;

• reminders about available services; and

• special offers.

 

Marketing is separate from appointment and care-related communications.

 

You can opt out at any time by:

• using the unsubscribe option in a marketing email;

• emailing nicola.thecarestudio@gmail.com; or

• telephoning 07708 518511.

 

Withdrawing marketing consent will not affect your care or your ability to use The Care Studio’s services.

 

A limited suppression record may be retained after you opt out to ensure that your preference continues to be respected.

​

24. Testimonials and promotional material

 

The Care Studio will not publish an identifiable patient testimonial, photograph, clinical image or case study for promotional purposes without separate, specific permission.

​

Refusing permission will not affect your care.

​

Where consent is relied upon, it can be withdrawn. Withdrawal will apply to future use, although it may not always be possible to recall printed material or content already shared by others.

​

25. Cookies and website technologies

 

The website may use cookies and similar technologies.

​

Cookies may be used to:

• make the website work;

• maintain security;

• remember settings;

• support embedded functions; and

• understand how visitors use the website.

 

Essential cookies may be used where they are necessary for the website to function.

 

Optional analytics, advertising or similar cookies should only be used after the visitor has been given clear information and, where required, has provided consent. ICO guidance states that analytics cookies are not normally treated as strictly necessary.

​

The cookies currently used should be shown through the website’s cookie banner or cookie-settings panel.

You may also manage cookies through your browser, although blocking some cookies may affect how the website works.

​

26. Links to other websites

 

The website may contain links to external websites, including booking, payment, social-media and healthcare-information services.

​

This notice does not apply to external websites. The Care Studio is not responsible for their content, security or privacy practices.

​

You should review the privacy information provided by any external website you visit.

​

27. Your data-protection rights

 

Depending on the circumstances, you may have the following rights:

​

Access

You may ask whether The Care Studio processes your information and request a copy of it.

Rectification

You may ask for inaccurate information to be corrected or incomplete information to be completed.

Clinical opinions or contemporaneous records will not normally be rewritten simply because you disagree with them. However, an appropriate correction, clarification or note may be added.

Erasure

You may ask for your information to be deleted in certain circumstances.

This right is not absolute. Clinical or other records may need to be retained because of:

• legal obligations;

• professional or insurance requirements;

• patient-safety considerations;

• safeguarding;

• public-interest considerations; or

• the establishment, exercise or defence of legal claims.

Where information cannot be deleted, the reason will be explained where appropriate.

Restriction

You may ask The Care Studio to limit how your information is used in certain circumstances.

Objection

You may object to processing based on legitimate interests.

You have an absolute right to object to direct marketing.

Data portability

In certain circumstances, you may ask to receive information you provided in a structured, commonly used and machine-readable format.

Withdrawal of consent

Where processing relies on consent, you may withdraw that consent at any time.

Withdrawal will not affect processing that took place before consent was withdrawn.

Automated decision-making

You have rights concerning decisions made solely by automated systems that have legal or similarly significant effects.

​

The Care Studio does not currently make clinical decisions solely by automated means.

​

28. Making a request

To exercise a data-protection right, contact:

Nicola Jackson
The Care Studio
Unit 6
12 High Street
Tutbury
Burton-on-Trent
Staffordshire
DE13 9LP

 

Email: nicola.thecarestudio@gmail.com

Telephone: 07708 518511

​

Please provide enough information for Nicola to understand your request.

​

Proof of identity may be requested before information is released. This is to protect confidentiality and prevent information being disclosed to the wrong person.

​

The Care Studio will normally respond within one month. Additional time may be permitted for particularly complex or multiple requests, in which case you will be informed.

​

There is normally no fee. However, a reasonable fee may be charged, or a request may be refused, where permitted by law - for example, where a request is manifestly unfounded or excessive.

​

29. Complaints

 

Please contact Nicola first if you have concerns about how your information has been handled.

You also have the right to complain to:

​

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk

​

30. Changes to this notice

 

This notice may be updated when:

​

• The Care Studio’s services change;

• a new system or supplier is introduced;

• legal or professional obligations change; or

• the way personal information is used changes.

 

The current version will be published on the website with its effective date.

 

Where a significant change affects existing patient information, reasonable steps will be taken to bring it to the attention of affected patients.