Privacy Policy
Last updated: August 2026
Who we are
Scarchange is a specialist scar rehabilitation service run by Dr RuthAnn Fanstone. Scarchange is the data controller for the personal information described in this policy.
I take your privacy seriously and aim to collect and use only the information I need to respond to enquiries, provide and manage clinical care, and run Scarchange safely and effectively.
If you have any questions about how your information is used, please contact me at connect@scarchange.org.uk.
Information you provide when you contact me
If you complete the contact form, email, telephone, text or otherwise contact Scarchange, I may receive information including:
your name and contact details
your location
information about your scar, injury, surgery, symptoms or health
how your scar is affecting you and what you would like help with
information about previous treatment
your preferred way of being contacted
photographs or videos that you subsequently choose to send
any other information you provide as part of your enquiry.
If you are referring a patient or contacting me on someone else’s behalf, I may also receive information about that person from you.
You do not need to send photographs with your initial enquiry. Sometimes I may need to see a photograph before I can decide whether I am likely to be able to help or whether an appointment would be appropriate. If so, I will let you know and explain how to send it.
How I use information from enquiries
I use the information you provide to:
respond to your enquiry
understand what you are asking for and whether I may be able to help
decide whether I need any further information
suggest appropriate next steps
arrange an appointment where appropriate
communicate with you about your enquiry
manage and administer Scarchange.
If I am not the right person to help, I may use the information you have provided to consider whether I can suggest another appropriate professional or service.
I do not use health information provided through an enquiry for marketing.
Health information
Information about your health is classed as special category data and receives additional protection under UK data protection law.
Where you are seeking healthcare from Scarchange, health information is processed where necessary for the provision or management of healthcare by a health professional.
Scarchange may also process personal information where necessary to provide and administer the service you have asked for, meet legal and professional obligations, and for legitimate interests in running a safe and effective clinical service.
Where a particular optional use requires your consent, I will ask you separately.
Photographs and videos
Photographs and videos can sometimes be helpful in understanding and assessing a scar. If I ask you to send an image before an appointment, I will explain how to send it. This may include sending images to me using WhatsApp.
If you become a patient, photographs or videos that are relevant to your assessment or treatment may form part of your confidential clinical record.
I may also take clinical photographs or videos during assessment or treatment, with your agreement, to document clinical findings and monitor changes over time.
Clinical images used as part of your care will not be used for other purposes, such as education, teaching, presentations, publications, research, the Scarchange website, social media or promotional material, without a separate discussion and your specific written consent.
If you become a Scarchange patient
If you book an appointment, I will ask you to provide the additional information needed to register you as a patient and provide your care.
Your clinical record may include:
your contact and registration details
relevant health and medical information
information about your scar, symptoms and treatment
assessment and treatment notes
questionnaires and outcome measures
clinical correspondence and reports
photographs or videos where appropriate
appointment and payment information
relevant information received from other people involved in your care.
You will also be provided with the Scarchange patient Privacy Notice, which gives more detailed information about how your clinical information is used and protected.
Information from your initial enquiry may become part of your clinical record where it is relevant to your care.
Information received from other people
Most information will come directly from you.
If you are referred to Scarchange, or other people are involved in your care, I may also receive relevant information from healthcare professionals, clinics, case managers, insurers, solicitors, funding organisations, parents, carers or others involved in your care.
Sharing your information
Your information is treated confidentially.
Where appropriate for your care or its administration, relevant information may be shared with people or organisations involved in your care, such as your GP, consultant or another healthcare professional, a clinic where you are being treated, a case manager, insurer, solicitor or funding organisation.
I will only share information that is relevant to the purpose for which it is being shared.
Information may also be disclosed where required by law, a court or regulator, or where necessary because of a safeguarding concern or serious risk.
Scarchange does not sell your personal information.
How your information is stored and protected
I use appropriate electronic systems and, where necessary, paper records to store and manage information. Measures are taken to protect information from loss, misuse and unauthorised access, and access is limited to people who have a legitimate need for it.
Scarchange uses Cliniko, a practice management system, to store and manage patient records, appointments and related clinical information.
Other systems and service providers may also be used where necessary for the website, communication, administration, accounts and the operation of Scarchange.
How long your information is kept
If you make an enquiry but do not become a patient, I will keep your information only for as long as it is reasonably needed to deal with your enquiry and any appropriate follow-up, subject to any legal, professional or business requirements that require information to be retained.
If you become a patient, relevant information from your enquiry may become part of your clinical record.
Clinical and related records are kept for the period required by professional, legal and insurance requirements. For adult physiotherapy records, this will normally be for at least eight years after treatment ends. Different or longer periods may apply in some circumstances, including for children and medico-legal work.
Records are securely disposed of when they are no longer required.
Website, cookies and analytics
The Scarchange website is hosted by Squarespace. Squarespace uses cookies and similar technologies that are necessary for the website to work and may also collect information about how visitors use the website for analytics purposes.
Non-essential cookies, including analytics cookies, are restricted unless you choose to accept them.
When you visit the website, you can accept all cookies, decline non-essential cookies, or manage your cookie preferences. You can change your choices through the website's cookie settings.
Information collected for website analytics may include information about your browser, device and network, your IP address, the pages you visit, how you arrived at the website and how you interact with it. This information is used to help understand how the website is being used and to improve it.
Scarchange does not use Squarespace's Activity Log feature to collect visitor activity data for Scarchange Analytics.
Children and young people
Scarchange may provide healthcare to children and young people. Their personal and health information is handled with the same care and confidentiality as other clinical information, with appropriate involvement of a parent or guardian, or of the young person themselves, depending on their age, understanding and the circumstances.
If you are a child or young person and are unsure about providing information through the website, please ask a parent, guardian or another trusted adult to help you.
Your rights
Under data protection law, you have rights in relation to your personal information.
You have the right to ask for a copy of the personal information and clinical records Scarchange holds about you and to ask for inaccurate information to be corrected.
You may also have rights to ask for information to be deleted, to restrict how it is used or to object to certain uses. These rights are not absolute. For example, Scarchange may have professional or legal responsibilities to retain clinical records even if you ask for them to be deleted.
If a particular use of your information is based on consent, you can withdraw that consent. This does not affect information that Scarchange is required or otherwise lawfully permitted to retain or process.
To ask about your information or exercise any of these rights, please contact connect@scarchange.org.uk.
Questions or concerns
If you have a question about your information, want to exercise a data protection right, or have a concern about how your information has been used, please contact:
Scarchange
connect@scarchange.org.uk
07444 875356
Scarchange is registered with the Information Commissioner’s Office (ICO).
You also have the right to raise a concern with the ICO if you are unhappy with how your personal information has been handled.
Changes to this policy
This Privacy Policy may be updated from time to time to reflect changes in the way Scarchange works or uses information, or changes in legal or professional requirements.
The current version will be published on this page with the date it was last updated.
And underneath the contact form, I would use exactly this:
By submitting this form, you are providing Scarchange with the information needed to respond to your enquiry. Your information will be handled in accordance with the Scarchange Privacy Policy.
One thing I would not include from the old policy is “If you are under 16, please obtain a parent or guardian’s consent before submitting personal information.” Your work can legitimately involve children and young people, and capacity/consent around healthcare and data isn't accurately represented by a blanket under-16 rule. The new wording is better suited to clinical practice.