CCTV & Video Surveillance Privacy Notice

The Physio Den
Wotton-under-Edge, Gloucestershire, UK

Full business address:  22 Long Street, Wotton under Edge, GL12 7BT
Email: info.thephysioden@gmail.com
Telephone: 07455321153
Last updated: 04/10/2026

1. About this notice

The Physio Den uses a small CCTV/video-surveillance system at the clinic.

The primary purpose of the system is to support lone-worker safety and to help protect patients, visitors, staff and the premises.

This notice explains how CCTV is used, what information may be collected, why it is collected, how it is protected and the rights individuals have under UK data-protection law.

The Physio Den is the data controller for the personal information processed through its CCTV system.

CCTV is only one part of our wider approach to lone-working and premises safety.

2. Why we use CCTV

Our CCTV system is primarily used to:

• Support lone-worker safety.

• Allow the person working alone to identify when someone is approaching or entering the premises.

• Support an appropriate response to unexpected or potentially unsafe situations.

• Protect patients, visitors and staff.

• Support premises security.

• Protect clinic property and equipment.

• Provide information when necessary following a safety or security incident.

The system is not operated primarily for crime prevention or general surveillance of the public.

Where footage incidentally becomes relevant to a crime, unlawful activity or other security incident, it may be retained or disclosed where there is an appropriate lawful basis.

3. Our cameras

We currently operate two cameras.

Camera 1 — Front entrance

A Ring video doorbell is positioned at the front entrance.

It is used primarily to support lone-worker safety by allowing the person working at the clinic to identify when somebody is approaching or entering the premises.

It also supports premises security and the safety of patients, visitors and staff.

The camera may incidentally capture people approaching or passing the entrance.

The camera is configured and positioned to minimise unnecessary capture of:

• Neighbouring properties.

• Private areas.

• Windows or gardens belonging to neighbouring premises.

• Excessive areas of the public highway.

Where available and appropriate, privacy zones or masking are used.

Camera 2 — Gym/rehabilitation area

A second security camera is positioned inside the gym/rehabilitation area and faces towards the entrance.

Its primary purposes are lone-worker safety and premises security.

The gym camera is normally switched off during daytime clinical and rehabilitation activities.

It is primarily used outside clinical hours, including overnight, when the premises are not being used for routine clinical treatment.

This arrangement is intended to minimise unnecessary recording of patients while they are attending physiotherapy, rehabilitation or exercise sessions.

The camera is not intended to monitor:

• Physiotherapy treatment.

• Clinical assessments.

• Rehabilitation progress.

• Exercise technique.

• Patient behaviour.

• Staff performance.

4. What information we collect

Depending on the camera and its configuration, CCTV may collect:

• Images of identifiable individuals.

• Video footage.

• Date and time information associated with recordings.

• Information about activity visible within the camera's field of view.

Audio recording is disabled.

We do not use CCTV to routinely record conversations.

CCTV is not used to create or supplement clinical records.

However, images may incidentally reveal information about a person's health, disability, mobility or attendance at the clinic.

We take particular care to minimise and protect such information.

5. Lawful basis

We rely primarily on legitimate interests under Article 6(1)(f) UK GDPR for the operation of our CCTV system.

Our legitimate interests are:

• Protecting the safety of a person working alone.

• Supporting our lone-working arrangements.

• Protecting patients, visitors and staff.

• Monitoring access to the premises.

• Protecting the premises and equipment.

• Investigating relevant safety or security incidents.

We have considered whether CCTV is necessary and proportionate to these purposes.

We use safeguards to reduce its impact on privacy, including:

• Restricted fields of view.

• Appropriate camera positioning.

• No audio recording.

• The gym camera being normally switched off during daytime clinical activity.

• Privacy masking where appropriate.

• Limited retention.

• Restricted access.

• Clear signage.

• Privacy information.

• Privacy mode where appropriate.

We do not rely on consent as the lawful basis for ordinary security/lone-worker CCTV.

6. Patient confidentiality and health information

The Physio Den is a physiotherapy and rehabilitation clinic and recognises that patients have a particularly strong expectation of privacy.

CCTV is not used to:

• Monitor treatment.

• Assess rehabilitation progress.

• Assess exercise technique.

• Evaluate a patient's physical condition.

• Monitor clinical performance.

• Monitor staff performance.

• Create clinical records.

The gym camera is normally switched off during daytime clinical and rehabilitation activity.

This is an additional safeguard intended to minimise routine recording of patients.

CCTV images are personal data where an individual can be identified.

CCTV footage is not automatically special category data simply because it shows an identifiable person.

However, footage may incidentally reveal information concerning a person's health or disability.

Where this occurs, we will handle the information appropriately and will not use it for unrelated purposes.

Where processing of special category information occurs, we will consider the additional requirements of UK data-protection law.

7. Audio

Our CCTV system is configured not to record audio.

We do not use CCTV to record conversations between patients, clinicians, staff or visitors.

Audio recording is not necessary for our current lone-worker safety purposes.

Any future proposal to introduce audio recording would require a separate assessment of necessity, proportionality, lawful basis and privacy impact before being implemented.

8. Camera positioning and privacy

We use data minimisation and privacy-by-design principles.

Cameras are intended to capture only the areas reasonably necessary for the purposes described in this notice.

We aim to avoid unnecessary capture of:

• Neighbouring properties.

• Private areas.

• Excessive areas of the public highway.

• Treatment areas.

• Clinical consultations.

• Rehabilitation and exercise activity during daytime clinical hours.

Privacy masking or privacy zones will be used where technically available and appropriate.

The gym camera is normally switched off during daytime clinical and rehabilitation activity.

9. Privacy mode

The Physio Den recognises that patients and visitors may have particular privacy concerns when attending the clinic.

The gym camera is normally switched off during daytime clinical and rehabilitation activities.

In addition, patients and visitors can ask for the relevant camera to be temporarily switched off where appropriate.

We will consider reasonable requests and normally accommodate them where doing so does not create a significant and unnecessary safety or lone-working risk.

Privacy mode may apply to one camera or, where appropriate, both cameras.

For example, it may be possible to switch off the gym camera while retaining the entrance camera where this provides an appropriate safety measure.

Where a camera genuinely needs to remain operational because of a lone-working or safety concern, we will explain this where appropriate and consider alternative privacy measures.

Privacy mode is an additional safeguard. It does not replace appropriate camera positioning, privacy masking, data minimisation, lawful basis, signage or other data-protection requirements.

10. Retention

Our intended standard CCTV retention period is 14 days.

Footage will not be retained longer than necessary for its intended purpose.

Where specific footage is relevant to:

• A safety incident.

• A security incident.

• An insurance matter.

• A legal claim.

• An investigation.

• A lawful request.

it may be securely preserved for longer.

Retained footage will be reviewed and deleted when it is no longer required.

The retention period will be reviewed periodically.

11. Access to footage

Access to CCTV footage is restricted.

The clinic owner and specifically authorised individuals may access footage where there is a legitimate reason.

Examples include:

• A safety incident.

• A lone-working concern.

• A security incident.

• Responding to a lawful request.

• Dealing with a data-protection request.

• System administration.

• An insurance or legal matter.

CCTV is not routinely reviewed to monitor patients, treatment or staff performance.

12. Cloud storage and CCTV providers

The front entrance camera is a Ring video doorbell.

Where Ring cloud services are used, footage may be processed and stored using Ring's services.

The Physio Den remains responsible for how CCTV is configured and used.

We will maintain appropriate records of our CCTV supplier, applicable service arrangements, storage arrangements, security settings and relevant data-protection responsibilities.

We will review relevant supplier arrangements when the device, service, subscription or processing arrangements change.

13. Sharing CCTV footage

We do not routinely share CCTV footage with third parties.

Where there is a lawful and appropriate reason, footage may be disclosed to:

• The police.

• Courts or other lawful authorities.

• Insurers.

• Solicitors or legal advisers.

• Other organisations where disclosure is legally required or otherwise lawful.

• Individuals exercising their applicable data-protection rights.

Each request will be assessed individually.

Only footage reasonably necessary for the relevant purpose will be disclosed.

CCTV will not be used or shared for marketing, publicity or unrelated commercial purposes.

14. Requests from the police

Requests for footage from the police will normally be referred to the clinic owner.

We will consider the request and verify the identity and authority of the requester where appropriate.

Only footage reasonably necessary for the relevant purpose will be disclosed.

Significant disclosures will be recorded.

15. Subject Access Requests

You may have a right to request access to CCTV footage containing your personal information.

Requests should be made using the contact details at the beginning of this notice.

To help us locate footage, please provide:

• Your name.

• Approximate date.

• Approximate time.

• Location.

• Any other relevant information.

We may need to verify your identity.

Where footage contains other identifiable individuals, we will consider their rights and freedoms before providing it.

Footage may need to be:

• Blurred.

• Redacted.

• Edited.

• Withheld where a lawful exemption applies.

The presence of another person does not automatically mean that footage cannot be disclosed.

If footage has already been deleted in accordance with our retention policy, we may no longer be able to provide it.

16. Other data-protection rights

Depending on the circumstances, you may have rights including:

• The right to be informed.

• The right of access.

• The right to rectification.

• The right to erasure in certain circumstances.

• The right to restriction in certain circumstances.

• The right to object to processing based on legitimate interests.

These rights are subject to applicable legal conditions and exemptions.

17. Security

We use appropriate technical and organisational measures to protect CCTV footage against:

• Unauthorised access.

• Unauthorised disclosure.

• Accidental loss.

• Unauthorised alteration.

• Unauthorised use.

Measures include, where applicable:

• Restricted user access.

• Strong passwords.

• Two-factor authentication.

• Secure storage.

• Restricted sharing.

• Privacy settings.

• Limited retention.

CCTV footage should not be copied, downloaded or shared unless there is a legitimate reason.

18. Data breaches

If CCTV footage is accidentally lost, disclosed, accessed without authorisation or otherwise compromised, we will assess the incident under our data-breach procedure.

Where required by UK data-protection law, we will notify the ICO and/or affected individuals.

Personal-data breaches will be documented and investigated appropriately.

19. Children and vulnerable people

Children and vulnerable people may attend The Physio Den.

Our CCTV arrangements are designed to minimise unnecessary monitoring of all individuals, including children and vulnerable patients.

The gym camera is normally switched off during daytime clinical and rehabilitation activities.

We do not use CCTV to assess, profile or monitor children or vulnerable people.

20. Complaints

If you have a concern about our CCTV arrangements, please contact:

The Physio Den
[INSERT FULL ADDRESS]
[INSERT EMAIL]
[INSERT TELEPHONE]

We will investigate your concern appropriately.

You may also complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

ICO: https://ico.org.uk/
Telephone: 0303 123 1113

21. Review

We will review our CCTV arrangements and this notice at least annually and whenever there is a significant change to:

• The cameras.

• Camera positioning.

• The purposes of CCTV.

• Operating arrangements.

• Audio settings.

• Retention.

• Cloud/provider arrangements.

• Relevant UK data-protection requirements.

Last reviewed: 4/10/2026
Next scheduled review: October 2027