Privacy Policy

Last updated: June 2026 • Version 1.0

This privacy policy explains how myBackPain.co.uk collects, uses, stores, and protects your personal data. We are committed to handling your data lawfully, transparently, and with appropriate security. This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

myBackPain.co.uk is operated by Osteospinal. We are the data controller for personal data collected through this website.

Contact: hello@mybackpain.co.uk

2. What data we collect

Assessment data

When you complete the myBackPain assessment, we collect your responses to the assessment questions. These responses include information about your symptoms, medical history, lifestyle, and other health-related information. This constitutes special category data under UK GDPR and is handled with additional care.

Assessment responses are used to generate your personalised report. They are not linked to your identity unless you voluntarily provide contact details.

Contact and payment data

If you choose to receive your report by email, we collect your name and email address. Payment processing is handled by a third-party payment processor (Stripe). We do not store your card details. We receive confirmation of payment and a transaction reference.

Referral data

If you arrive at the assessment via a referral link from a clinic or practitioner, we record the referral code associated with your completion. This is used to attribute the assessment to the referring clinic for payment purposes. No additional personal data is collected as part of the referral process.

Technical data

Like most websites, we automatically collect certain technical data when you visit, including your IP address, browser type, device type, and pages visited. This is used for site security, performance monitoring, and aggregate analytics. It is not used to identify you personally.

Cookies

We use cookies for the following purposes:

Session management — to maintain your assessment progress
Referral tracking — to record the referral code associated with your visit
Analytics — to understand how the site is used (aggregated, non-personal)

You can control cookies through your browser settings. Disabling cookies may affect the functioning of the assessment.

3. How we use your data

Purpose	Data used	Legal basis
Generating your assessment report	Assessment responses	Contract performance / Legitimate interests
Sending your report by email	Name, email address	Consent
Processing payment	Payment data (via Stripe)	Contract performance
Referral attribution and clinic payments	Referral code, completion record	Legitimate interests
Site security and performance	Technical data	Legitimate interests
Improving the assessment	Aggregated, anonymised assessment data	Legitimate interests

We do not use your data for marketing without your explicit consent. We do not sell your data to third parties.

4. Special category data

Health information is classified as special category data under UK GDPR, requiring additional protection. Your assessment responses constitute health data. We process this data on the basis of explicit consent, which you provide by completing the assessment. This data is used solely to generate your report and is not shared with third parties except as described in section 5.

5. Who we share data with

Stripe — payment processing. Stripe's privacy policy applies to data processed by them.
Supabase — database infrastructure for referral tracking. Data is stored securely within their platform.
Hostinger — website hosting. Your data is stored on servers operated by Hostinger.
Referring clinics — if you arrived via a clinic referral link, the clinic receives confirmation that an assessment was completed via their link. They do not receive your personal health data or assessment responses.

We do not share your health data or assessment responses with referring clinics, third-party advertisers, or any other parties not listed above.

6. How long we keep your data

Assessment responses — retained for up to 12 months to allow report retrieval, then deleted or anonymised
Email address (if provided) — retained until you request deletion
Payment records — retained for 7 years as required by HMRC
Referral completion records — retained for 3 years for payout auditing purposes
Technical/analytics data — retained for 12 months in aggregated form

7. Your rights

Under UK GDPR you have the following rights:

Right of access — to request a copy of the data we hold about you
Right to rectification — to request correction of inaccurate data
Right to erasure — to request deletion of your data
Right to restrict processing — to request that we limit how we use your data
Right to data portability — to receive your data in a portable format
Right to object — to object to processing based on legitimate interests
Right to withdraw consent — where processing is based on consent, to withdraw it at any time

To exercise any of these rights, contact us at hello@mybackpain.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk • 0303 123 1113

8. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), access controls on our database, and regular security reviews. No system is completely secure — if you have concerns about a specific interaction, please contact us.

9. Children's data

The myBackPain assessment is not designed for children under 16. We do not knowingly collect data from children under 16. If you believe a child has used the service, please contact us and we will delete the relevant data.

10. Changes to this policy

We may update this privacy policy from time to time. The date at the top of this page indicates when it was last updated. Continued use of the service following any changes constitutes acceptance of the revised policy.

11. Contact

For any privacy-related questions or to exercise your rights: hello@mybackpain.co.uk

Note for internal reference This privacy policy has been drafted without formal legal review. Key outstanding items before commercial launch: (1) ICO registration — required if processing personal data commercially; register at ico.org.uk/registration (fee approximately £40-£60/year for small organisations). (2) Cookie consent banner — a proper cookie consent mechanism is required under PECR. (3) Data Processing Agreements — formal DPAs should be in place with Stripe, Supabase, and Hostinger. (4) Legal review recommended before processing significant volumes of health data commercially.