Privacy Notice

IP PHYSIO LTD ("IP PHYSIO", "we", "us" or "our") is committed to protecting your privacy and handling your personal information fairly, lawfully and transparently. This Privacy Notice explains what personal information we collect, how and why we use it, who we may share it with, how we protect it, how long we keep it, and your rights in relation to your personal information. IP PHYSIO processes personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

1. Who we are

IP PHYSIO LTD
Registered office: 21A Chippenham Mews, London, W9 2AN, United Kingdom
Company registration number: 15798516
Email: info@ipphysio.co.uk
Telephone: +44 078 7886 5728

For the purposes of data protection legislation, IP PHYSIO LTD is the organisation responsible for determining how and why your personal information is processed. If you have any questions about how we use your information, please contact us using the details above.

2. What information we collect

Depending on the services you receive from us, we may collect and process the following information:

Personal and contact information

This may include:

• Full name
• Date of birth
• Address and postcode
• Telephone number
• Email address
• Emergency contact details, where provided
• Parent or guardian details where the patient is under 18

Healthcare information

In order to assess and treat you safely and appropriately, we may collect information relating to your health, including:

• Your current symptoms and injury
• Relevant medical history
• Previous injuries and operations
• Previous or current treatment
• Diagnoses
• Medication
• Allergies
• Relevant medical conditions
• Information relating to your physical function and activity
• Clinical assessment findings
• Treatment and rehabilitation provided
• Progress and outcomes
• Relevant reports, referrals, imaging and correspondence from other healthcare professionals

Health information is considered special category data under UK data protection legislation and is subject to additional legal protections.

Insurance and payment information

Where applicable, we may collect:

• Insurance company/provider
• Membership or policy number
• Authorisation/referral number
• Number of sessions authorised
• Information required to process insurance claims
• Payment and transaction information
• Invoices and receipts

We do not normally need to collect or retain your full payment card details.

Information relating to communications

We may retain correspondence between you and IP PHYSIO, including emails, messages, appointment communications and other relevant communications relating to your care or administration.

Images, photographs and video

Where clinically appropriate, photographs or videos may be taken as part of assessment, treatment, rehabilitation or progress monitoring. Where photographs or videos are intended to be used for purposes outside your direct clinical care, such as marketing, education or social media, we will obtain the appropriate consent separately.

3. How we collect your information

We may collect personal information:

• Directly from you when you complete our registration or pre-assessment forms
• During your physiotherapy assessment and treatment
• When you contact us by telephone, email or other communication methods
• When you make or manage an appointment
• From your parent or guardian, where applicable
• From your GP, consultant, physiotherapist, other healthcare professional or referring organisation, where appropriate
• From your health insurer where relevant
• From documents or reports that you provide to us
• From payment or booking systems used to provide our services

Where we receive information about you from another organisation, we will only use that information for appropriate and lawful purposes.

4. Why we use your information

We use your personal information for purposes including:

Providing physiotherapy and healthcare services

We use your information to:

• Assess your condition
• Determine an appropriate clinical management plan
• Provide physiotherapy and rehabilitation
• Monitor your progress
• Maintain accurate clinical records
• Communicate with you regarding your treatment
• Coordinate care with other healthcare professionals where appropriate
• Support continuity and safety of care

Appointment and administrative management

We may use your information to:

• Arrange and manage appointments
• Contact you regarding appointments
• Process cancellations and missed appointments
• Provide invoices and receipts
• Manage payments
• Communicate administrative information relating to your care

Insurance and third-party funding

Where your treatment is funded by an insurer or other third party, we may process and share relevant information required to:

• Confirm eligibility or authorisation
• Submit claims
• Provide information required by the insurer
• Manage payment for services

Legal and regulatory requirements

We may process information where necessary to:

• Comply with legal or regulatory obligations
• Maintain appropriate clinical and financial records
• Respond to lawful requests from regulators, courts, law enforcement or other competent authorities
• Establish, exercise or defend legal claims

Improving our services

We may use appropriately anonymised or aggregated information to understand service use, monitor outcomes and improve the quality of our services. Where information can reasonably identify you, we will not use it for these purposes unless there is an appropriate lawful basis to do so.

5. Our lawful bases for processing your information

Under UK data protection law, we must have a lawful basis for collecting and using personal information. Depending on the circumstances, IP PHYSIO may rely on one or more of the following lawful bases:

Performance of a contract

We may process personal information where this is necessary to provide the services you have requested, manage your appointments and administer our relationship with you.

Legitimate interests

We may process information where this is necessary for our legitimate interests, provided that those interests are not overridden by your rights and interests. Examples may include managing our business, maintaining appropriate records, communicating with patients, managing payments and protecting our business.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Health and social care

Where we process health information as part of providing physiotherapy and healthcare services, we rely on Article 9(2)(h) of the UK GDPR, processing necessary for the provision of health or social care and the management of health or social care systems. Health information is special category data and therefore requires both an appropriate Article 6 lawful basis and this additional Article 9 condition.

Consent

Where consent is the appropriate legal basis, we will ask for it separately and clearly. For example, we may request consent for certain optional uses of photographs, videos, marketing communications or other activities that are not necessary for providing your healthcare. Where we rely on consent, you may withdraw that consent at any time.

6. Who we may share your information with

We treat your information as confidential. Where appropriate and lawful, we may share relevant information with:

• Your GP, consultant, physiotherapist or other healthcare professional involved in your care
• Your health insurer or other organisation funding your treatment
• Your parent or legal guardian, where appropriate
• Professional advisers, such as accountants, solicitors or insurers, where necessary
• Service providers who support our business, such as appointment booking, clinical record, payment, email or IT service providers
• Courts, regulators, law enforcement agencies or other authorities where we are legally required or permitted to do so

We only share information that is relevant and necessary for the particular purpose. We do not sell your personal information.

7. Third-party service providers

IP PHYSIO may use external service providers to support the operation of the business. These may include providers of:

• Clinical record and practice-management systems
• Appointment booking systems
• Email and communication services
• Payment processing
• Accounting and financial services
• Secure data storage and IT services
• Website and hosting services

Where a third party processes personal information on our behalf, we take reasonable steps to ensure that appropriate contractual, organisational and technical safeguards are in place.

Some of our service providers, including certain website, email and IT service providers, are based, or process data, outside the United Kingdom, including in the United States. Where this occurs, we ensure the transfer is carried out in accordance with UK data protection law, relying on one or more of the following safeguards as appropriate: a UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs), or the receiving provider's certification under the UK Extension to the EU-US Data Privacy Framework. Further information about the specific safeguard relied on for a particular provider is available on request.

8. Confidentiality

Information relating to your health and treatment is treated as confidential.

We will only disclose information outside IP PHYSIO where there is an appropriate lawful basis to do so. This may include circumstances where:

• You have requested or authorised the disclosure
• It is necessary for your direct care
• We are legally required to disclose the information
• Disclosure is necessary to protect someone's vital interests
• Disclosure is necessary to establish, exercise or defend legal claims
• Another lawful basis applies under data protection legislation

9. How we protect your information

We take reasonable and appropriate technical and organisational measures to protect personal information against:

• Unauthorised access
• Accidental loss
• Destruction
• Damage
• Unauthorised disclosure
• Unlawful processing

These measures may include appropriate access controls, password protection, secure systems, restricted access to clinical information and secure methods of communication and storage. However, no method of electronic transmission or storage can be guaranteed to be completely secure.

10. How long we keep your information

We retain personal and clinical information only for as long as it is necessary for the purposes for which it was collected and in accordance with applicable legal, regulatory, professional and insurance requirements. As a general guide, and in line with Chartered Society of Physiotherapy (CSP) recommendations:

• Adult clinical records are retained for a minimum of 8 years from the date of your last treatment
• Records for patients who were under 18 during treatment are retained until their 25th birthday, or their 26th birthday if they were 17 at the conclusion of treatment
• Insurance, invoicing and financial records are retained in line with applicable statutory and insurer requirements

Clinical records form part of the legal record of your care and therefore may need to be retained for a significant period after your treatment has ended. IP PHYSIO will securely delete or destroy personal information when it is no longer required. Where information is subject to a longer legal, regulatory or insurance retention requirement, we will retain it for the required period.

11. Your rights

Under UK data protection law, you may have rights including:

• The right to be informed about how your personal information is used
• The right of access to your personal information
• The right to rectification of inaccurate or incomplete information
• The right to erasure in certain circumstances
• The right to restrict processing in certain circumstances
• The right to object to certain types of processing
• The right to data portability in certain circumstances
• Rights relating to automated decision-making and profiling, where applicable

These rights are subject to certain legal exemptions and may not apply in every circumstance. For example, healthcare records may need to be retained where there is a legal, professional or other legitimate requirement to do so.

If you would like to exercise any of your rights, please contact us using the details provided in Section 1. We may need to verify your identity before responding to a request.

12. Access to your health records

You have rights in relation to accessing information held about you.

If you would like to request a copy of your clinical records or other personal information held by IP PHYSIO, please contact us using the details above. We will respond to requests in accordance with applicable data protection legislation.

13. Children and young people

Where we provide services to children or young people, we may collect and process information relating to both the patient and their parent or legal guardian.

We take particular care to ensure that information relating to children is processed appropriately and securely. Where appropriate, information may be shared with a parent or legal guardian in accordance with applicable law, professional requirements and the child's level of understanding and capacity.

14. Marketing communications

We may occasionally wish to send information about IP PHYSIO services, educational content or other marketing communications. Where applicable, we will obtain the appropriate consent or rely on another lawful basis permitted by applicable direct marketing legislation.

Your health and clinical information will never be used for marketing purposes without your separate, explicit consent. You can opt out of marketing communications at any time. Marketing preferences will not affect your ability to receive physiotherapy or other healthcare services from IP PHYSIO.

15. Cookies and website information

When you visit the IP PHYSIO website, certain information may be collected automatically through cookies or similar technologies. The type of information collected and how it is used depends on the cookies and technologies implemented on the website. Where required by law, appropriate consent will be requested before non-essential cookies are used. Further information is available in our Cookie Notice.

16. Data breaches

If we become aware of a personal data breach, we will assess the breach and take appropriate action in accordance with our legal and regulatory obligations. Where required by law, we will notify the Information Commissioner's Office (ICO) and/or affected individuals.

17. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in:

• Our services
• The way we process personal information
• Our systems or service providers
• Legal or regulatory requirements

The most recent version will be made available through the IP PHYSIO website or by contacting us.

Last updated: 29 August 2026

18. Complaints

If you have concerns about the way IP PHYSIO handles your personal information, please contact us first so that we can investigate and try to resolve your concern.

Email: info@ipphysio.co.uk
Telephone: +44 078 7886 5728

You also have the right to complain directly to the Information Commissioner's Office (ICO) if you believe that your personal information has been handled unlawfully. Information about making a complaint is available from the ICO website.

19. Contact us

If you have any questions about this Privacy Notice, how we use your personal information, or your data protection rights, please contact:

IP PHYSIO LTD
21A Chippenham Mews, London, W9 2AN, United Kingdom
Email: info@ipphysio.co.uk
Telephone: +44 078 7886 5728