Privacy Policy

Last updated: September 2026

1. Who I am

I am Bradley Ingram. I provide online rehabilitation and strength coaching to serving and ex-military personnel and other clients under my own name at bradleyingram.com. I am the data controller for the personal data described in this policy.

Website: bradleyingram.com
Contact: [email protected]
Correspondence address: available on request by email

Regulation

United Kingdom: I am a chiropractor registered with the General Chiropractic Council (GCC registration number 06088) and a member of the British Chiropractic Association. UK GDPR and the Data Protection Act 2018 apply to how I handle your data.
Australia: I am in the process of registering with the Chiropractic Board of Australia through the Australian Health Practitioner Regulation Agency (AHPRA). I do not hold Australian registration at the date of this policy and do not provide services as a registered Australian practitioner until I do. Once registered, the Privacy Act 1988 and the Australian Privacy Principles will also apply, and this policy will be updated to reflect that.

Whichever country I am working from, records are kept and your data is handled to the higher of the two standards.

2. What personal data I collect

Identity data: name, date of birth, service status (serving, ex-military or other).
Contact data: email address, phone number, postal address where needed for invoicing.
Health data: injury history, symptoms, what treatment has been tried, medical history relevant to training, assessment findings, movement videos you send me, programme and check-in records, and outcome measures. This is special category data under UK GDPR and is handled with additional safeguards set out below.
Training data: programmes, logged sessions, check-in responses and messages exchanged through the coaching platform.
Payment data: invoices and payment records. Card details are processed by the payment provider and are not stored by me.
Usage data: basic website analytics where enabled, such as pages visited and device type.
Filming and photography data: images or video in which you appear, taken only with your consent.

3. How I collect it

Directly from you, when you submit the application form, book a call, complete an intake or check-in form, send a message or video, or speak with me on a call.
Through the platforms I use to run the service, listed in section 8.
Through basic website analytics, where enabled.

4. Why I collect it, and the legal basis

To review your application and decide whether I can help: legitimate interest, and your explicit consent for the health information you choose to share on the form.
To deliver assessment, programming and coaching: performance of a contract, and for health data, the provision of health care by a registered health professional (UK GDPR Article 9(2)(h)) together with your explicit consent.
To keep clinical and coaching records: legal and professional obligation as a GCC registrant.
To communicate with you about your programme, calls and payments: performance of a contract.
To take payment and keep accounts: performance of a contract and legal obligation.
To improve the service and the website: legitimate interest.
To send you marketing or educational emails: consent, which you can withdraw at any time.
To use your image, video or story in content or case studies: explicit consent, agreed separately in writing.

5. Health information and the application form

The application form asks about your injury, how long you have had it and what has been tried. That is health information. It is used only to review your case and decide whether a call is worthwhile. It is received through the form provider in section 8, is seen only by me, and is not used for marketing.

If I cannot help, or you do not proceed after the call, I delete the application and any notes within 12 months unless you ask me to keep them or a shorter period is requested.

6. Use of artificial intelligence tools

I use AI-powered tools to support administration and content. I use them in line with UK GDPR, GCC standards and BCA guidance, with the following safeguards:

What I use: Claude (Anthropic), a general-purpose AI assistant, for drafting communications, managing workflows, structuring programmes and creating content. It is accessed on a plan where data is not used to train the model.
Pseudonymisation: where a client's case is discussed with an AI tool, the information is limited to a first name or case reference, the injury and the training context. No full names, dates of birth, contact details or identifying documents are shared.
No identifiable health data is entered into general-purpose AI tools.
Clinical judgement stays with me. AI tools are used for administrative and drafting support. They do not make decisions about your assessment, diagnosis or programme. Every AI-assisted output is reviewed by me before it is used.
Call transcription: if I use an AI note-taking or transcription tool on a call, I will tell you before the call starts and you can decline. Transcripts are stored as part of your coaching record.

If the tools I use change, this section is updated.

7. Filming, photography, social media and case studies

Part of building this service is showing real outcomes. That is done only with consent.

Content that requires your explicit consent

Any photo, video, screenshot, message, metric or written account in which you are identifiable, or could reasonably be recognised, is used only with your prior written consent.
Case studies, testimonials and before-and-after data are agreed separately in writing before they are used, including where and for how long.
Where you agree to a case study as part of a specific arrangement, the terms of that arrangement are set out in your offer document.
You can decline without it affecting your coaching, and you can withdraw consent at any time by emailing [email protected]. I will remove the content from channels I control as soon as reasonably possible. Content already shared or republished by others may be outside my control.

Content that does not require individual consent

General training, education and demonstration content in which no client is identifiable.
Anonymised, aggregated descriptions of cases (for example, "a serving soldier with a two-year Achilles problem") where you cannot reasonably be identified. Where there is any doubt, I ask first.

Serving personnel

If you are serving, you may be subject to rules about appearing in public content. It is your responsibility to check those before consenting. I will not reference your unit, role or location in any content without your specific agreement.

8. Who processes your data on my behalf

I use the following services to run the coaching. Each is a data processor operating under its own terms and data processing agreement.

Application form and client records: GoHighLevel (HighLevel Inc., United States), which receives the application form and holds your contact details and correspondence. Data is transferred under the UK International Data Transfer Agreement.
Clinical records and call booking: Cliniko, a practice management system used by registered practitioners in the UK and Australia. Your assessment notes, intake questionnaire, consent records and call bookings are held here. My account is hosted in the UK.
Coaching platform: Relay, for programming, check-ins, messaging and video exchange.
Email and documents: Google Workspace.
Video calls: Google Meet, or Cliniko's built-in telehealth.
Payments: Stripe. Card details are handled by Stripe and are not visible to me.
AI tools: as set out in section 6.

Some of these providers store data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. If you are in Australia, your clinical record is stored in the UK, which is a cross-border disclosure under the Australian Privacy Principles; by starting coaching you consent to that.

9. Sharing your data

I do not sell your data. I share it only:

with the processors listed above, to run the service;
with another health professional, with your consent, where a referral is appropriate;
where required by law, a court order or my professional regulator;
where necessary to protect your vital interests or someone else's safety.

I will not contact your unit, chain of command or medical centre without your explicit agreement, unless required by law.

10. How long I keep it

Coaching and clinical records: 8 years from your last contact. This meets UK guidance for GCC registrants and exceeds the 7-year minimum applied in Australia. If you were under 18 at the time, records are kept until you are 25, or for 8 years, whichever is longer.
Applications that do not proceed: up to 12 months.
Financial records: 6 years, as required by HMRC.
Marketing consent and email lists: until you unsubscribe.
Consented content: for the period agreed in writing, or until you withdraw consent.

11. How I keep it secure

Data is stored on encrypted, access-controlled cloud services with two-factor authentication. I do not keep client records on unencrypted devices or in unsecured messaging apps. Access is limited to me and, where I engage one, a contracted assistant bound by confidentiality.

12. Your rights

Under UK GDPR you have the right to:

access the personal data I hold about you;
have inaccurate data corrected;
ask for your data to be deleted, subject to my record-keeping obligations;
restrict or object to processing;
receive your data in a portable format;
withdraw consent at any time where consent is the legal basis;
complain to the Information Commissioner's Office at ico.org.uk. If you are in Australia, you may also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

To exercise any of these, email [email protected]. I respond within one month.

13. Cookies and analytics

This site uses no advertising or tracking cookies. If basic analytics are enabled, they collect anonymised usage data only. Fonts are loaded from Google Fonts, which may log your IP address as part of serving the request.

14. Changes to this policy

I review this policy when the tools or the service change. The current version is always at bradleyingram.com with the date shown above.

15. Contact

Email: [email protected]
Correspondence address: available on request by email
Data controller: Bradley Ingram, GCC registration number 06088