The Physio Den

Privacy Policy

Last updated: October 2026

The Physio Den respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, why we use it, how we protect it, who we may share it with and your rights under UK data protection law.

The Physio Den is the data controller for the personal information we process in connection with our services.

1. Who we are

The Physio Den
22 Long Street
Wotton-under-Edge
Gloucestershire
GL12 7BT

Telephone: 07455 321153
Email: info.thephysioden@gmail.com

If you have questions about this Privacy Policy or how your information is used, please contact us using the details above.

2. Personal information we may collect

Depending on the services you use and your relationship with the Practice, we may collect information such as:

• your name;

• contact details, such as telephone number, email address and address;

• date of birth;

• emergency contact information;

• relevant health information;

• medical history and relevant medication information;

• information about symptoms, assessment, diagnosis, treatment and rehabilitation;

• appointment and booking information;

• information about payments, invoices and outstanding balances;

• communications between you and the Practice;

• information relating to complaints or concerns;

• information about accessibility or communication requirements;

• marketing preferences;

• information provided through our website or online forms; and

• technical information generated when you use our website, such as information collected through cookies or similar technologies where applicable.

We aim to collect information that is relevant and reasonably necessary for the purposes for which we use it.

3. Health information

Health information is special-category personal data under UK data protection law and receives additional protection.

We may process health information because it is necessary for the provision of healthcare or treatment and because applicable data protection law provides a lawful basis for this type of processing.

For clinical healthcare processing, we may rely on an Article 6 lawful basis together with the applicable Article 9 condition for health or social care and the corresponding provisions of the Data Protection Act 2018.

We do not generally rely on consent as the sole legal basis for processing health information required to provide healthcare.

4. Why we use your information

We may use your information to:

• assess and provide physiotherapy or other appropriate services;

• provide treatment, rehabilitation, exercise or wellbeing services;

• manage appointments and bookings;

• maintain clinical records;

• communicate with you about your appointments or care;

• communicate with other healthcare professionals involved in your care where appropriate and lawful;

• provide referrals or respond to requests from healthcare professionals;

• process payments and manage accounts;

• maintain business and financial records;

• deal with complaints and concerns;

• meet legal, professional, regulatory and insurance requirements;

• protect the safety and welfare of clients, staff and others;

• manage our business and systems;

• improve our services;

• maintain the security of our systems and premises;

• comply with lawful requests from regulators, authorities or other organisations; and

• send lawful marketing communications where the applicable requirements have been met.

5. Lawful bases for processing

We use different lawful bases depending on the information and the purpose for which it is being processed.

These may include:

Contract

We may process information where it is necessary to provide a service you have booked or to take steps at your request before entering into a contract.

Legal obligation

We may process information where necessary to comply with a legal obligation.

Legitimate interests

We may process information where this is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

Examples may include appropriate business administration, maintaining service security, responding to enquiries and managing certain business records.

Consent

Where we rely on consent, we will ask for it in an appropriate way and you can withdraw consent where consent is the lawful basis for that particular processing.

Withdrawing consent does not affect processing that took place lawfully before withdrawal.

Health and special-category data

For health information, we will also identify and rely on an appropriate Article 9 condition and, where required, a corresponding condition under the Data Protection Act 2018.

6. Who we may share information with

We may share relevant information with other organisations or professionals where this is lawful and appropriate.

Depending on the circumstances, these may include:

• your GP;

• consultants or other healthcare professionals;

• other healthcare organisations;

• insurers or healthcare funders;

• professional advisers;

• accountants;

• legal advisers;

• regulators;

• public authorities where required or permitted by law;

• booking and practice-management providers;

• clinical or exercise software providers;

• payment service providers;

• IT, cloud-storage or communications providers; and

• other service providers acting on our behalf.

We only share information where there is an appropriate lawful basis and only the information reasonably required for the relevant purpose.

7. Third-party providers

The Practice uses third-party systems and service providers to operate parts of the business.

These currently include Rehab Guru for relevant clinical, exercise and practice-management functions and SumUp for payment processing.

These organisations may process personal information on our behalf or in accordance with their own applicable responsibilities.

We take reasonable steps to use appropriate providers and to ensure that relevant data-protection requirements are addressed.

Information about the precise processing arrangements, locations and international transfers associated with each provider should be checked against the provider's current contractual and privacy documentation.

8. International transfers

Some third-party technology or service providers may process information outside the UK.

Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place where required.

We do not state that all information is necessarily stored exclusively within the UK.

9. Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include appropriate access controls, passwords, secure systems, staff confidentiality obligations, device security and secure handling of information.

No method of electronic storage or transmission can be guaranteed to be completely secure. However, we take appropriate steps to reduce risks and respond appropriately to suspected data breaches.

10. Retention of information

We do not keep personal information indefinitely.

We retain information for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, professional, regulatory, insurance and business requirements.

Clinical records

As a general policy, adult clinical records will normally be retained for eight years from the date of last treatment.

For children and young people, records will normally be retained for eight years after the person's 18th birthday, or until they reach 25, whichever is later, subject to any circumstances requiring a longer period.

These periods reflect current CSP record-keeping guidance and may be adjusted where there is a specific legal, professional, insurance or clinical reason for a different retention period.

Financial records

Financial and accounting records will be retained for the period required by applicable tax and accounting requirements.

For a self-employed business, HMRC currently requires relevant records to be retained for at least five years after the relevant 31 January submission deadline, subject to circumstances requiring longer retention.

Complaints

Information relating to complaints may be retained for an appropriate period after the complaint has been resolved, taking account of the nature of the complaint, clinical and professional requirements, legal claims and applicable retention requirements.

Marketing information

Marketing information will be retained only for as long as reasonably necessary and will be updated when you withdraw or change your marketing preferences.

We periodically review our retention periods to ensure that personal information is not retained for longer than necessary.

11. Your data protection rights

Depending on the circumstances, you may have rights including:

• the right to be informed about how your information is used;

• the right to access your personal information;

• the right to request correction of inaccurate or incomplete information;

• the right to request restriction of processing in certain circumstances;

• the right to object to certain processing;

• the right to object to direct marketing;

• the right to request deletion of information where the legal requirements for erasure are met;

• the right to data portability where the applicable requirements are met; and

• the right to withdraw consent where we are relying on consent as the lawful basis.

These rights are subject to legal exceptions and limitations.

For example, we may need to retain clinical records where there is a lawful reason to do so, even where you ask us to delete them.

12. Subject Access Requests

You can ask for a copy of the personal information we hold about you.

This is known as a Subject Access Request.

Requests should be made using the contact details in this Privacy Policy.

We may need to verify your identity before releasing information.

Where appropriate, information relating to other individuals may need to be removed or withheld.

We will normally respond within the applicable legal timeframe.

13. Data protection complaints

If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and resolve the issue.

You can contact:

The Physio Den
22 Long Street
Wotton-under-Edge
Gloucestershire
GL12 7BT

Telephone: 07455 321153
Email: info.thephysioden@gmail.com

You also have the right to raise a concern with the Information Commissioner's Office (ICO).

14. Marketing

We may send information about our services, classes or other relevant offerings where we have a lawful basis to do so.

Where consent is required for electronic direct marketing, we will obtain appropriate consent.

In some circumstances, the law allows an organisation to send marketing to existing customers about similar services where the applicable "soft opt-in" requirements have been met, including providing an opportunity to opt out when contact details are collected and in subsequent communications.

You can opt out of marketing communications at any time.

Treatment or clinical consent does not automatically mean that you have consented to marketing.

15. Cookies and website technologies

Our website may use cookies and other technologies that store or access information on your device.

Some technologies are necessary for the website to function. Other technologies, such as analytics or advertising technologies, may be subject to additional requirements under the Privacy and Electronic Communications Regulations and UK data protection law.

The precise cookies and technologies used by the website may change.

Where applicable, we will provide appropriate information and choices through our website's cookie controls.

16. Children and young people's information

Children and young people have data protection rights.

Where we provide healthcare to a child or young person, we will process their information in accordance with applicable data protection, confidentiality, consent and safeguarding requirements.

Parental responsibility does not automatically give a parent an unrestricted right to access a child's confidential healthcare information. The child's age, maturity, understanding, consent, best interests and applicable legal requirements will be considered.

17. CCTV

CCTV is operated at The Physio Den for safety and security purposes.

Further information is provided in our separate CCTV Privacy Notice.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or data-protection guidance.

The current version will be published on our website.

Last updated: October 2026

19. Contact us

If you have any questions about this Privacy Policy or how we process your personal information, please contact:

The Physio Den
22 Long Street
Wotton-under-Edge
Gloucestershire
GL12 7BT

Telephone: 07455 321153
Email: info.thephysioden@gmail.com