Last updated: 13.07.2026
This notice explains what personal information Abigail Strachan, trading as The Endo OT, collects about you, why, and what rights you have over it. I've tried to write this in plain English so it's easy to understand, rather than in dense legal language.
Given the sensitive nature of health information, particularly information relating to endometriosis, I apply the highest standards of data protection and confidentiality throughout my practice.
1. Who I am
Registered name: Abigail Strachan, trading as The Endo OT
Email: [email protected]
Address: The Endo OT, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA
Website: theendoot.co.uk
ICO registration reference: ZC197344
HCPC registration number: OT79822 — you can verify this at hcpc-uk.org/check-the-register
I am the controller of your personal data, which means I decide why and how it's used. As an HCPC-registered Occupational Therapist, I also follow HCPC and RCOT guidance on confidentiality and record keeping.
This notice is not aimed at children, and I do not knowingly collect personal data from children under 13.
2. What information I collect and why
To provide care, services, and support to clients, I collect or use:
Name, address, and contact details
Gender and pronoun preferences
Date of birth
Emergency contact details
GP or other healthcare professional details, where you choose to provide this
Health information, including medical conditions, allergies, medical requirements, and medical history
Information about care needs, including disabilities, home conditions, medication, dietary requirements, and general care provision
Payment details, including card or bank information for transfers and direct debits
Records of meetings and decisions
Some of this is special category information, meaning it's especially sensitive and subject to extra protection under data protection law:
Health information
Sex life information
Sexual orientation information
I only collect information about sex life or sexual orientation if a client chooses to raise or discuss this themselves, for example where it's relevant to how endometriosis is affecting them. This is entirely client-led and you're never required to share it unless you would like to.
For information updates, marketing, or market research, such as my email newsletter, I collect or use:
Name and contact details
Marketing preferences
Records of consent, where appropriate
3. Your data protection rights
Under UK data protection law, you have several rights over your personal information. Which of these apply to you can depend on the legal basis I'm relying on to use your data (explained in the next section), but broadly, you have the right to:
Access: ask for a copy of the personal information I hold about you
Rectification: ask me to correct or delete information that's inaccurate or incomplete
Erasure: ask me to delete your personal information
Restriction: ask me to limit how I use your personal information
Object: object to how I'm using your personal data
Portability: ask me to transfer your information to another organisation, or to you
Withdraw consent: where I'm relying on consent, withdraw it at any time
If you make a request, I'll respond without undue delay and within one month at the latest. To exercise any of these rights, contact me using the details above.
4. The legal basis for using your information
Data protection law requires me to have a lawful basis for everything I do with your personal information. Here's what applies to The Endo OT.
For providing care and services
Consent: you've given me permission after I've explained what this involves. You can withdraw this at any time.
Contract: I need the information to enter into or carry out an agreement with you, such as your client agreement.
Legal obligation: I need the information to comply with the law.
Legitimate interests: I have a legitimate interest in processing personal information to deliver safe, well-documented occupational therapy care, including maintaining records for continuity of care, communicating with clients, and meeting HCPC and RCOT professional standards. This is necessary and proportionate, reflects what clients would reasonably expect, and does not override their rights and interests.
If you'd like more detail on how I've applied legitimate interests, just get in touch.
For marketing and information updates
Consent: I only send marketing communications, such as my newsletter, with your permission, which you can withdraw at any time using the unsubscribe link in any email or by contacting me directly.
5. Where I get your information from
Directly from you, whether that's through my website, a discovery call, a lead magnet download, or as part of your care.
6. Cookies
My website may use cookies to help it work properly and to understand how visitors use it. Cookies are small text files stored on your device. I use:
Essential cookies: necessary for the website to function correctly
Analytics cookies: to understand how visitors use my site
Preference cookies: to remember your settings and preferences
You can manage cookie preferences through your browser settings or the cookie banner on my site. Please note that disabling certain cookies may affect how the website functions.
7. How long I keep your information
Client records: kept in line with HCPC and RCOT record-keeping guidance, generally for a minimum of 8 years after the end of your care. For records relating to a client who was under 18 at the time of care, records are kept until the client's 25th birthday (or 26th if the client was 17 at the conclusion of care), in line with standard UK health record-keeping practice
Website and lead magnet contact details: kept while you remain subscribed, and for a reasonable period after you unsubscribe, after which inactive contacts are removed after 24 months from unsubscribing
Discovery call notes: if you become a client, key points are transferred into your Zanda record and the original notes deleted; if you don’t become a client, your notes are deleted from Google Drive and are not transferred anywhere
Payment records: kept as required for tax and accounting purposes, generally 7 years
For more information on how long I store personal information, or the criteria I use to decide this, please contact me using the details above.
8. Who I share your information with
I do not sell or rent your personal data.
Data processors
These are organisations that handle personal information on my behalf, as part of a service they provide to me:
Funnel Sketchers: email marketing platform used to manage my website landing pages, opt-in forms, automated emails, and marketing communications
Zanda: practice management system used to store client records, session notes, and manage bookings
Zoom: video conferencing platform used to deliver discovery calls and 1:1 sessions
Otter AI: transcription tool used for discovery calls
BizzyAI: transcription and notetaking tool integrated with Zanda, used for client session notes
Google Drive: used for temporary storage of discovery call notes. If you go on to become a client, key points are transferred to Zanda and the original notes deleted. If you don't become a client, your discovery call notes are deleted from Google Drive and are not transferred anywhere
Tide: business banking provider used to process session fees and deposits
I choose these providers carefully and only share what's necessary for them to provide their service. I am not responsible for how third-party platforms use data beyond my instructions; their own use of data is governed by their respective privacy policies.
Others I share personal information with
Organisations I need to share information with for safeguarding reasons
Organisations I'm legally obliged to share personal information with
International transfers
Some of my service providers are based outside the UK, including in the United States. Where this happens, I ensure appropriate safeguards are in place, such as Standard Contractual Clauses or the UK extension to the EU-US Data Privacy Framework, which are recognised under UK GDPR as providing an adequate level of protection for personal information.
9. Duty of confidentiality
I'm subject to a common law duty of confidentiality. However, there are circumstances where I will share relevant health and care information. These are where:
You've provided your consent, whether that's implied because I'm providing you with care, or given explicitly for other uses
I have a legal requirement, including court orders, to collect, share, or use the data
On a case-by-case basis, the public interest in sharing the data outweighs the public interest in protecting confidentiality, for example sharing information with the police to support the detection or prevention of serious crime
In England or Wales, the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied
10. Data security
I take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction. These include:
Secure, password-protected systems
Use of appropriate platforms for online sessions and record keeping
Limiting access to client records to myself
Deleting transcripts and temporary notes once they are no longer needed
In the event of a data breach that poses a risk to your rights and freedoms, I will notify the ICO within 72 hours and inform affected individuals without undue delay.
11. How to complain
If you have any concerns about how I've used your personal information, please contact me directly in the first instance:
Email: [email protected]
By post: The Endo OT, Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA
For details on how I'll handle your complaint, including timeframes, see my Data Protection Complaints Procedure here.
If you remain unhappy after raising a complaint with me, you also have the right to complain to the ICO:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
© 2026 Abigail Strachan, trading as The Endo OT. All rights reserved. Contact: [email protected] | Privacy Policy