Privacy Policy

Last updated: November 2026

1. Who I am

Feet and Sole is a home visit foot health service run by Samuel Boduah, a Foot Health Practitioner. I provide foot care in clients' own homes within 10 miles of Brighton, East Sussex.

I am responsible for deciding how your personal information is used. In data protection law this makes me the "data controller".

2. What information I collect

When you contact me or use the booking form

• Your name, phone number and, if you give it, your email address
• Your postcode, so I can check you are within the area I cover
• Anything you tell me in your message, which may include health information
• If you are booking for someone else, your details and your relationship to them

When you fill in the new patient questionnaire

• Your name, date of birth, address, phone number and, if you give them, your email address, GP surgery and emergency contact
• Health information: your medical conditions, medicines, allergies and mobility
• If someone fills it in for you, their name, contact details and relationship to you
• Your choices about contacting your GP and appointment reminders

You can fill in the questionnaire online or on paper, or we can go through it together at your first visit. If you fill it in online, your answers are encrypted on your device before they are sent, and can only be unlocked in my Proton Mail inbox. The services that pass them on cannot read them.

When I treat you

• Your full name, date of birth, home address and phone number
• Your GP's name and surgery
• Your medical history, current medication and any allergies
• Findings from checking your feet, including circulation and sensation tests
• Notes on the treatment I give and any advice or referrals
• An emergency contact or next of kin, if you choose to give one
• Records of payments

When you visit this website

• My website host automatically records technical information such as your IP address and browser type, to keep the site running and secure
• This website does not use cookies, advertising or tracking tools

3. My legal basis for using your information

Under UK data protection law (UK GDPR), I use your information on these grounds:

• Contract: to arrange and provide the treatment you ask for
• Legitimate interests: to keep accurate records and run my business
• Legal obligation: where the law requires me to keep or share information, for example tax records or safeguarding
• Vital interests: in an emergency, where there is a serious risk to your health or life

Health information is a "special category" of personal data. I use it under Article 9(2)(h) of UK GDPR, which covers providing health care, and the related condition in Schedule 1 of the Data Protection Act 2018 for health and social care purposes. As required by section 11 of that Act, I use it under a duty of confidentiality: I keep what you tell me confidential and only share it as described in this policy.

4. How I use your information

• To arrange appointments, and to visit you at home if you choose a home visit
• To assess your feet safely and provide treatment
• To keep clinical records, as required by professional standards and my insurer
• To contact you about appointments, including reminders when you are due a visit
• To refer you to, or share information with, your GP, a podiatrist or another health professional if I have concerns. I will ask for your agreement first, unless it is an emergency.
• To meet my legal, insurance and safeguarding obligations

I will never sell your information or use it for marketing.

5. How long I keep your information

• Clinical records (adults): 8 years after your last appointment
• Clinical records (under 18s): until your 25th birthday, or 8 years after your last appointment if that is later
• Payment and financial records: 6 years, as required by HMRC
• Enquiries that do not lead to an appointment: deleted within 6 months

When these periods end, I securely delete digital records and shred paper records.

6. Who I share your information with

I use a small number of trusted services to run Feet and Sole. They only process your information on my behalf and following my instructions:

• Proton Mail: encrypted email service where I receive and store messages and questionnaires, based in Switzerland
• IONOS: provides the hello@feetandsole.co.uk email address, which forwards to my Proton Mail inbox
• Brevo: sends the encrypted questionnaire to my Proton Mail inbox, based in France. It cannot read your answers.
• Netlify: hosts this website, receives messages from the booking form and emails them to me, passes the encrypted questionnaire on to my email, and stores an encrypted copy of my patient records so I can use them on my own devices, based in the United States. Your information is encrypted on my devices before it is sent, so Netlify cannot read it.
• Google Fonts: supplies the fonts on this website (Google may record your IP address)

I may also need to share information with:

• Your GP or another health professional, as described above
• My professional indemnity insurer, if there is a claim or complaint
• Statutory authorities, such as social services or the police, where there is a serious risk of harm. I will tell you about this unless doing so would put someone at risk.

Where information is sent outside the UK, I only use services that protect it to UK standards.

7. Your rights

Under UK GDPR you have the right to:

• Access: ask for a copy of the information I hold about you
• Rectification: ask me to correct anything that is wrong
• Erasure: ask me to delete your information, although I may need to keep clinical and financial records for the periods above
• Restriction: ask me to limit how I use your information
• Portability: ask for your information in a format you can take elsewhere
• Objection: object to me using your information for legitimate interests

To use any of these rights, email hello@feetandsole.co.uk. I will reply within one month. There is no charge.

8. Keeping your information safe

• Paper records are kept in a locked cabinet and are never left unattended
• Digital records are kept on password-protected devices and are encrypted with a passphrase that only I know, including the copy used to keep my devices in step
• The online questionnaire is encrypted on your device and can only be read in my Proton Mail inbox
• My email is stored encrypted with Proton Mail
• This website uses HTTPS, so information you send through it is encrypted

9. Complaints

If you are unhappy with how I have handled your information, please contact me first at hello@feetandsole.co.uk and I will do my best to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to this policy

I may update this policy from time to time. Any changes will be published on this page with a new "last updated" date.