1. Who is responsible for your information
The data controller is David Scrivener, practising as Huddersfield Physiotherapy Clinic. You can contact me about this notice or your information by calling 07864 390 767 or emailing contact@huddersfieldphysiotherapy.co.uk. The clinic is based in Marsh, Huddersfield, West Yorkshire. Appointments are by arrangement.
2. Information I collect
Depending on how you contact or use the clinic, I may collect:
- Your name, date of birth, address, telephone number and email address.
- Appointment, booking, payment and invoice details.
- Health information you give me or that is needed to assess and treat you, such as symptoms, medical history, medication, examination findings, treatment notes, referrals and progress.
- Images or video, including running-gait footage, where this is useful for assessment or feedback. I will explain the purpose before recording.
- Information you provide when asking a question, requesting a callback, making a complaint or giving feedback.
- Limited technical information about your visit to the website, such as device or browser information, where collected by the website or its service providers.
3. How I receive information
I usually receive information directly from you through an appointment, telephone call, email, website form or online booking. I may also receive relevant information from a referring clinician or another health professional, or from a parent, guardian or representative where appropriate. I will explain when information is needed to provide care or manage a booking. If you choose not to provide information needed for safe assessment or treatment, I may not be able to provide the service.
4. Why I use your information
I use personal information to respond to enquiries, arrange appointments, assess and treat you, provide exercise or aftercare advice, manage payments, keep appropriate clinical records, follow up on your care, respond to complaints, protect the clinic and meet relevant professional, legal and insurance responsibilities. I may share relevant information with another health professional when you ask me to, agree to it, or when sharing is otherwise permitted or required by law.
Health information is special category personal data. I process it where necessary to provide health care or treatment under Article 9(2)(h) of the UK GDPR and the health or social care condition in Schedule 1 of the Data Protection Act 2018, subject to professional confidentiality. For ordinary personal data, I generally rely on taking steps at your request before entering into or performing a contract (Article 6(1)(b) UK GDPR) for enquiries, bookings and care; compliance with a legal obligation (Article 6(1)(c)) where one applies; and my legitimate interests (Article 6(1)(f)) for secure administration, responding to complaints and protecting or defending the clinic, where those interests do not override your rights.
I will only send promotional emails or texts where I have a valid permission or another lawful route under the rules for electronic marketing. You can opt out at any time. Messages about appointments, your treatment or necessary service information are not promotional messages.
5. Who may receive your information
I keep your information confidential. Where needed to run the clinic or provide your care, I may share the minimum relevant information with:
- The booking, clinical-record, exercise, website, email, payment and secure cloud-service providers I use.
- A GP, referrer or other health professional involved in your care, where appropriate and permitted.
- My professional indemnity insurer, legal or professional advisers, or an accountant where needed for advice, a claim or business administration.
- A regulator, law-enforcement body or other organisation where I am legally required or permitted to disclose information.
Service providers may process information on my behalf under appropriate arrangements. Some providers may store or access information outside the United Kingdom. Where that happens, I will use an applicable legal safeguard for the transfer. You can contact me for further information about the safeguards relevant to your information.
6. Keeping information secure
I take reasonable steps to protect personal information from loss, misuse, unauthorised access or disclosure. Access is limited to people and service providers who need the information for the purposes described in this notice. If a personal data breach occurs, I will assess it and take any action required by data protection law.
7. How long I keep information
I keep information only for as long as needed for the purpose for which it was collected, taking account of clinical, professional, insurance, legal and accounting requirements. I then securely delete or destroy it, or remove identifying details where appropriate.
Clinical records: [insert the clinic’s approved retention period and the event from which it runs, including the approach for children and young people].
Enquiry, booking, payment, video and marketing records: [insert the applicable retention periods or clear criteria for each category].
I review the retention schedule periodically. Some information may need to be kept longer if it is relevant to a complaint, claim or legal obligation.
8. Website cookies and analytics
The website may use cookies or similar technologies to make it work, remember choices, protect it or understand how it is used. The cookies actually in use and any choices available to you should be described in the website cookie information and preference controls. Non-essential cookies or analytics will only be used where the applicable rules allow them.
9. Your rights
Depending on the circumstances and the lawful basis I rely on, you may have the right to ask for a copy of your personal information, correct inaccurate information, request erasure or restriction, object to some uses, or ask for certain information to be provided to you or another organisation. These rights are not absolute in every situation; for example, I may need to keep some clinical records to meet professional, legal or insurance responsibilities.
If I rely on your consent for a particular use, you can withdraw that consent at any time. This does not affect processing already carried out before you withdrew it. To exercise a right, contact me using the details in section 1. I may need to confirm your identity before responding.
10. Questions or complaints
Please contact me first if you have a question or concern about how I use your information, and I will try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.