Privacy Notice

HOME PHYSIO AND REHAB LTD trading as Home Physio & Rehab is the controller for personal information where it determines the purposes and means of processing.

Depending on the circumstances and the clinician's legal/professional responsibilities, an independently practising healthcare professional may have separate data-protection responsibilities in relation to particular processing. Home Physio & Rehab and its clinicians are required to handle patient information in accordance with applicable confidentiality and data-protection obligations.

Depending on how you interact with us, we may collect and use:

• Identity information — name, title, date of birth, and the name of a representative who books for you.
• Contact information — address, email address, telephone number and preferred contact method.
• Appointment information — requested and confirmed appointments, the assigned clinician, location of treatment and appointment reference.
• Health information — the condition or reason for referral, relevant medical history, medication where clinically relevant, mobility and falls history, surgery, treatment provided and clinical notes made by your clinician.
• Home-visit arrangements — access instructions, whether a carer will be present, and any additional safety or verification arrangements you ask us to make.
• Communications — emails, messages, telephone notes and website enquiries.
• Billing information — fees, invoices and payment status. We do not store card details on our website.
• Complaint information — the content of any complaint and how it was handled.
• Consent and preferences — your treatment consent, acceptance of our Terms, privacy acknowledgement, marketing choice and cookie preferences, with the date and version recorded.
• Technical website data — IP address, browser type, pages visited and analytics cookies (only where you accept them).

We only use personal information where the law allows. The bases we rely on are:

Health information is special-category personal data. Our routine healthcare processing relies on UK GDPR Article 9(2)(h) — processing necessary for the provision of health care or treatment and the management of health care services — together with the relevant conditions of the Data Protection Act 2018 and professional confidentiality safeguards. Clinical information is handled by, or under the responsibility of, professionals who owe a duty of confidentiality.

Article 9(2)(f) may be relevant where processing is necessary for legal claims. Vital-interest provisions may apply in exceptional circumstances.

We do not ask for your explicit consent as the lawful basis for every clinical note or record. Your consent to treatment is a separate clinical matter and is always sought before assessment or treatment.

Separately from data-protection law, our clinicians and staff owe you a duty of confidentiality. Information about your care is shared only with those who need it to provide or support your care, where you agree, or where the law requires or permits it (for example a safeguarding disclosure). See our Safeguarding Statement.

We share information only where necessary and lawful. Recipients may include:

• the clinician(s) assigned to your care;
• other healthcare providers involved in your care where appropriate;
• your GP or hospital team where lawful and appropriate, or at your request;
• emergency services or safeguarding authorities where necessary;
• banks and payment providers where you pay us;
• our IT, database, email and hosting providers acting under contract (currently Supabase for our database, authentication and file storage; Vercel for hosting and file storage; Resend for sending emails);
• analytics and error-monitoring providers only where you accept optional cookies or where enabled (Google Analytics / Google Tag Manager, and Microsoft Clarity or Sentry where configured);
• professional advisers such as accountants, solicitors and insurers;
• regulators, courts or law enforcement where legally required or appropriate.

We do not sell personal information and we do not share your information with third parties for their own marketing.

Some of our service providers may store or process information outside the United Kingdom. Where that happens we rely on lawful transfer safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, and we take reasonable steps to ensure your information remains protected.

We use appropriate technical and organisational measures, including encrypted connections, access controls limiting records to authorised staff and clinicians, server-side access checks for sensitive data, and audit records for key actions. No system can be guaranteed to be completely secure, but we work to protect your information and to respond appropriately if something goes wrong.

We keep information only for as long as necessary for the purposes described here and to meet legal, professional and insurance requirements.

Adult physiotherapy clinical records are normally retained for at least eight years following the end of treatment, subject to longer retention where required or justified by the patient's age, safeguarding considerations, litigation, insurance requirements, professional guidance or another lawful reason.

For children and young people, longer retention applies and is determined by the applicable record-management schedule (for England this ordinarily extends to at least the patient's 25th birthday).

Records that are subject to a complaint, legal claim, safeguarding matter or insurance investigation are placed on hold and are not deleted merely because an ordinary retention date passes.

Subject to legal conditions and exemptions, you have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• erasure of information where applicable;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time;
• portability of information you provided to us, where applicable;
• withdraw consent where consent is the basis we rely on, without affecting processing already carried out;
• complain to the Information Commissioner's Office.

To exercise any right, contact info@homephysioandrehab.uk or +44 7846 346246. We may need to verify your identity, and the authority of anyone acting on your behalf, before responding. We normally respond within one month.

Marketing is optional and separate from your treatment, our Terms and this notice. We only send promotional communications where you have chosen to receive them, and you can opt out at any time using the link in any marketing email or by contacting us. Opting out does not affect service communications about your appointments, invoices or safety.

Our Cookie Policy lists the cookies and local storage our website actually uses, and explains how to change your preferences.

We would like the chance to resolve any concern first — please contact us. You also have the right to complain to the Information Commissioner's Office (ICO): https://ico.org.uk, telephone 0303 123 1113.

We review this notice regularly. The version, effective date and last-reviewed date are shown at the top of the page.