Privacy Policy

2. Types of Data We Collect

We collect and process the following information to provide safely managed clinical care:

• Personal Identification: Name, date of birth, contact numbers, email address, and home address.
• Clinical / Special Category Data: Medical history, physical health assessments, symptoms, clinical notes, treatment plans, and exercise outcomes.
• Administrative Data: Appointment schedules, payment histories, and direct booking communications. Payments are processed securely via WriteUpp Pay.

3. How We Collect and Use Your Data

Your information is gathered via our website forms, the integrated WriteUpp booking engine, intake documentation, and during clinical consultations. We process this data strictly under the following lawful bases:

• Contractual Obligation: To manage bookings, process transactions, and provide requested treatments.
• Legitimate Interests: To optimise our business operations, communicate schedules, and send relevant updates.
• Special Category Processing (Article 9 UK GDPR): Necessary for the provision of health or social care treatment by a regulated healthcare professional.

Where we rely on your consent — for example, for marketing communications or optional analytical cookies — you may withdraw that consent at any time by contacting us at info@physiorajvi.co.uk. Withdrawing consent will not affect the lawfulness of processing already carried out.

4. Children's Data

Where treatment is provided to a child under 16, personal and clinical data will usually be collected from, and may be discussed with, a parent or guardian acting on the child's behalf. We retain minors' records until their 26th birthday in line with professional CSP and UK legal requirements.

5. Data Storage & Security

• Clinical Records & Booking: Hosted within WriteUpp, which provides ISO 27001 certified cloud environments with end-to-end data encryption. Some processing may take place outside the UK/EEA; where it does, WriteUpp uses appropriate contractual safeguards such as UK/EEA-approved standard contractual clauses.
• Exercise Prescription: Rendered via Wibbi. Only essential identifiers (name/email) and specific exercise tracking parameters are processed within this system.
• Corporate Communications: Handled securely through Microsoft 365 Business Standard, utilising Multi-Factor Authentication (MFA) and secure TLS email encryption.
• Payments: Card payments are processed securely via WriteUpp Pay. Your full card details are processed by the payment provider and are not stored on our devices or in our records.

6. Data Retention

In accordance with professional standards set by the Chartered Society of Physiotherapy (CSP) and UK legal mandates, your clinical and medical records will be retained for a minimum of 8 years from the date of your last treatment. For minors, records are securely retained until their 26th birthday.

7. Clinical Confidentiality & Sharing

Your clinical information is strictly confidential. It will never be shared with third parties for marketing purposes. Data sharing occurs exclusively with your explicit consent or under clear legal exceptions, such as sharing clinical progress reports with your GP or referring consultant, or compulsory legal requests, public safety emergencies, or direct safeguarding concerns.

8. Insurance & Referrer Data Sharing

Where treatment is funded or authorised by a third party — for example a health insurer such as AXA, Aviva, Vitality, WPA or Allianz, a GP referral service, or an employer — we may share relevant clinical and administrative information needed to authorise and invoice care. This may include membership or authorisation numbers, progress reports, and discharge summaries. We will only share what is necessary and will usually confirm this with you at the time of booking or assessment.

9. Your Legal Data Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you (Subject Access Request).
• Right to Rectification: Ask us to correct inaccurate or incomplete information.
• Right to Erasure ("right to be forgotten"): Ask us to delete your personal data. This right does not apply where we must keep records to comply with legal or professional obligations, such as the 8-year clinical retention period required by the CSP.
• Right to Restrict Processing: Ask us to limit how we use your data in certain circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used format, and request transfer to another provider where technically feasible.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Withdraw any consent you have given at any time.

To exercise any of these rights, contact us at info@physiorajvi.co.uk. We will respond within one calendar month.

10. Data Breach Commitment

We take data security seriously. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and to you without undue delay.

11. How to Complain to the ICO

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Clinical Complaints

Concerns about the quality of care or clinical service are handled separately from data-protection queries. For clinical complaints, please contact us directly in the first instance. If you remain dissatisfied, you may also raise the matter with the Health and Care Professions Council (HCPC) at hcpc-uk.org.