Privacy Policy

PhysiWork LTD, trading as Shala Physiotherapy ("we", "us"), a company registered in England and Wales (Company Number 16832298), provides physiotherapy services at 29 Elston Road, Aldershot, Hampshire, GU12 4HX and online. We are the data controller for the personal information we hold about you, and we are registered with the Information Commissioner's Office (ICO) under registration number [ICO number].

This policy explains what information we collect, why we collect it, how we keep it safe and what your rights are. It applies to patients, people who enquire about our services, visitors to our website and anyone who contacts us.

Our data protection lead is Leor Shala, who you can contact at leorshala@gmail.com or 07397860726.

We collect only what we need to assess, treat and support you.

• Identity and contact details: name, date of birth, address, phone number, email address and emergency contact.
• Health information: medical history, symptoms, injuries, assessment findings, treatment notes, exercise programmes, outcome measures, test results and correspondence with other clinicians.
• Lifestyle information relevant to your treatment, such as occupation, sport and activity levels.
• GP and referrer details, and insurer details and policy or authorisation numbers if your treatment is funded by insurance.
• Payment information: invoices and payment records. Card payments are processed by Stripe ; we do not store full card numbers.
• Appointment records: bookings, cancellations and attendance.
• Communications: emails, messages, call notes and feedback.
• Website and online data: IP address, browser type and cookie data (see section 9), and video consultation data if you have online appointments.

We usually collect this information directly from you. We may also receive it from your GP, consultant, insurer, employer (for occupational health referrals), solicitor (for medico-legal cases) or, for children, a parent or guardian.

UK data protection law (the UK GDPR and the Data Protection Act 2018) requires us to have a lawful basis for each use of your information. Health information is "special category" data and needs an additional condition.

Purpose

Lawful basis

Condition for health data

Assessing, diagnosing and treating you; keeping clinical records

Contract with you, or legitimate interests where a third party pays

Provision of health care or treatment by a health professional (Art. 9(2)(h); DPA 2018 Sch. 1 para 2)

Communicating with your GP or other clinicians about your care

Legitimate interests in safe, coordinated care

Provision of health care (Art. 9(2)(h))

Booking, reminders and running our clinic

Contract

Not applicable

Billing you or your insurer, and recovering debts

Contract; legitimate interests

Legal claims (Art. 9(2)(f)) where health detail is needed

Meeting professional, regulatory, tax and safeguarding duties

Legal obligation

Health care; safeguarding (DPA 2018 Sch. 1 para 18)

Handling complaints and defending legal claims

Legitimate interests

Legal claims (Art. 9(2)(f))

Clinical audit and improving our service

Legitimate interests

Health care (Art. 9(2)(h))

Newsletters and marketing

Consent, which you can withdraw at any time

Not applicable — we never use health data for marketing

We will not use your information for automated decision-making that has legal or similarly significant effects on you.

We never sell your information. We share it only where needed, and only the minimum required:

• Your GP, consultant or other health professionals involved in your care. Tell us if you prefer us not to contact your GP.
• Your insurer or case manager, if they are funding your treatment, to obtain authorisation and payment.
• Your employer, solicitor or referrer, only with your agreement and only what is relevant to the referral.
• Service providers who process data for us under contract, including our practice management and clinical notes system [name], online booking [name], video consultation [name], email and IT support, and payment processing [name].
• Our professional advisers, insurers and regulators, such as the Health and Care Professions Council (HCPC), where required.
• Authorities, where the law requires it, such as safeguarding concerns, a court order or to prevent serious harm.

If we are sold or merge with another practice, your records may transfer to the new provider, who will continue to protect them.

Our records are stored in the UK [or EEA]. If a service provider processes data outside the UK, we make sure it is protected by UK adequacy regulations or the ICO's International Data Transfer Agreement or Addendum.

We use encrypted, password-protected clinical systems with access limited to staff who need it. Staff are bound by confidentiality and receive data protection training. Paper records [if any] are kept in locked storage. If a breach occurs that is likely to put you at risk, we will tell you and the ICO as the law requires.

We follow the record-keeping guidance of the Chartered Society of Physiotherapy:

Record

How long we keep it

Adult clinical records

8 years after your last treatment

Children's clinical records

Until the patient's 25th birthday (26th if they were 17 when treatment ended), or 8 years after death if sooner

Records involving a legal claim

Until the claim is concluded, plus any period required by law or our insurers

Financial records

6 years after the end of the tax year they relate to

Enquiries from people who don't become patients

[12 months]

Marketing list

Until you unsubscribe

After these periods, records are securely destroyed or deleted.

You have the right to:

• Access a copy of the information we hold about you, including your clinical notes.
• Rectification of information that is inaccurate or incomplete.
• Erasure, in some circumstances. We may need to keep clinical records for the periods above to meet legal and professional duties.
• Restrict or object to how we use your information, including objecting to marketing at any time.
• Data portability, where we process information by contract or consent.
• Withdraw consent where we rely on it, without affecting earlier use.

To make a request, contact [email]. We will respond within one month, free of charge in most cases, and may ask you to confirm your identity.

Our website uses essential cookies to work and, with your consent, analytics cookies to understand how it is used. You can change your choices at any time through our cookie banner or your browser settings.

If you are unhappy with how we have handled your information, please contact us first at leorshala@gmail.com so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

PhysiWork LTD, trading as Shala Physiotherapy, 29 Elston Road, Aldershot, Hampshire, GU12 4HX. leorshala@gmail.com · 07397860726

We review this policy regularly. Any changes will be posted on this page with an updated date. Where changes significantly affect you, we will tell you directly.