Privacy Policy

At Lollesworth Physio, we are committed to protecting and respecting your privacy. This policy explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others, and how we keep it secure.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For the purpose of data protection laws, Lollesworth Physio is the "Data Controller".

2. What Personal Data Do We Collect?

To provide you with safe, effective physiotherapy and clinical care, we need to collect and process personal data. This may include:

  • Personal details: Full name, date of birth, age, postal address, email address, and telephone number.

  • Special Category (Sensitive) Health Data: History of your presenting condition, physical examination findings, treatment notes, past medical history, medication history, notes of conversations, and treatment consent forms.

  • Lifestyle & Administrative details: Occupation, hobbies, emergency contact details, and payment/transaction records.

  • General Practitioner (GP) details: Name and address of your GP so we can share relevant updates with your consent.

3. Lawful Basis for Processing Your Data

Under UK GDPR, we must have a valid lawful basis to process your information:

  • Explicit Consent: For processing your special category health data to deliver medical treatment and physiotherapy care, we rely on your explicit consent.

  • Contractual Obligation: To fulfill our service agreement when you book and pay for an appointment.

  • Legal Obligation: To comply with mandatory healthcare record-keeping and regulatory standards (such as guidelines from the Health and Care Professions Council / Chartered Society of Physiotherapy).

  • Legitimate Interests: To manage clinic operations, appointment reminders, and administrative safety.

4. How We Use Your Information

We use your information to:

  • Diagnose your physical conditions and deliver safe physiotherapy treatment.

  • Communicate with you regarding appointments, rescheduling, and treatment follow-ups.

  • Coordinate care or share reports with your GP, consultant, or private medical insurance provider (only with your explicit permission).

  • Process payments and maintain internal financial and clinical records.

5. Who We Share Your Data With

We never sell, rent, or trade your personal data to third parties. We may share your data strictly on a "need-to-know" basis with:

  • Your General Practitioner (GP) or secondary healthcare specialists involved in your care.

  • Your private medical insurance company, if you are claiming through them.

  • Trusted administrative or IT/booking software providers who assist in running our practice (bound by strict data processing agreements).

  • Regulatory or legal authorities if required by a court order or law.

6. How Long We Keep Your Data

We retain your patient and treatment records in line with professional and legal guidelines:

  • Adult patient records: Retained for a minimum of 8 to 11 years after your last treatment session.

  • Children and young people records: Retained until the child reaches their 25th birthday (or 8 years after death, if applicable).

  • General enquiry/website data: Kept for up to 6 months.

After these retention periods expire, your records are securely deleted or permanently anonymised.

7. How We Protect Your Data

We keep your data secure through:

  • Encrypted digital practice management and clinical notes software.

  • Password-protected computers and secure physical storage (locked filing cabinets for any paper records).

  • Restricted staff access where only authorized personnel involved in your care or practice administration can view your files.

8. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right of access: You can request a copy of the personal and clinical data we hold about you (Subject Access Request).

  • Right to rectification: You can ask us to correct inaccurate or incomplete personal information.

  • Right to erasure: You can request the deletion of your data where it is no longer necessary to hold it (subject to legal retention rules for medical records).

  • Right to restrict or object: You can object to our processing of your data.

  • Right to withdraw consent: Where we rely on consent, you can withdraw it at any time. (Note: withdrawing consent for core clinical data may affect our ability to safely continue physiotherapy treatment).

To exercise any of these rights, please contact us at lollesworthphysio@gmail.com

9. How to Complain

If you have any concerns about how we handle your data, please contact us directly at lollesworthphysio@gmail.com so we can resolve the issue.

If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: