Privacy Policy
This policy applies to all personal data collected through:
• Clinical consultations
• Written patient forms
• Digital booking systems
• Electronic communications
• Our website
What is Personal Data?
Personal data is any information relating to an identifiable individual. This includes basic contact details as well as sensitive health information.
As a physiotherapy provider, Total Health Physiotherapy Ltd processes special category data, including information relating to your health, which requires a higher level of protection under UK GDPR.
What Information We Collect
We may collect and process the following information:
• Personal details (name, address, date of birth, contact information)
• Medical history and clinical records
• GP details
• Appointment and attendance records
• Communication records (email, WhatsApp, phone)
• Information submitted via forms or booking systems
We may also collect limited technical data when you visit our website, such as IP address and browsing behaviour.
How We Collect Your Data
Your data may be collected through:
• Written intake and consent forms completed at your first appointment
• Verbal information provided during consultations
• Our digital booking system (Rehab Guru)
• Email or WhatsApp communications
• Website contact forms
Lawful Basis for Processing
We process your personal data under the following lawful bases:
• Provision of healthcare (Article 6(1)(e) and Article 9(2)(h))
• Legitimate interests in managing appointments and communication
• Consent, where required (for example, marketing or certain communications)
We will only process your data where it is lawful and necessary to do so.
How We Use Your Information
We use your data to:
• Provide safe and effective physiotherapy treatment
• Maintain accurate clinical records
• Communicate with you regarding appointments and care
• Send appointment reminders (via email and WhatsApp)
• Liaise with other healthcare professionals (with your consent)
• Comply with legal and regulatory obligations
Storage and Security of Your Data
We take appropriate technical and organisational measures to protect your data.
• Paper records are stored in a locked filing cabinet within a secure room
• Digital records and contact details are stored securely via Rehab Guru
• Devices used to access data are password protected
• Access to your data is restricted to the practitioner only
We ensure that your data is not accessible to unauthorised individuals.
Sharing Your Information
Your personal data will not be shared without your consent, except where necessary:
• With your GP or other healthcare professionals involved in your care
• With insurers where required
• Where disclosure is required by law
• Where there is a safeguarding concern or risk of serious harm
We do not sell or share your data for marketing purposes.
How Long We Keep Your Data
We retain your records in line with UK clinical guidance:
• Adults: 8 years after your last treatment
• Children: until age 25 (or 26 if treated at age 17)
After this period, records are securely destroyed.
Your Rights Under GDPR
You have the right to:
• Access your personal data
• Request correction of inaccurate data
• Request restriction of processing
• Request erasure (where applicable)
• Object to processing
• Withdraw consent at any time
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Confidentiality
All information shared during your treatment is treated as confidential.
Confidentiality may only be breached where:
• There is a safeguarding concern
• There is risk of serious harm
• Disclosure is required by law
Where possible, this will be discussed with you first.
Data Breaches
In the event of a data breach, we will:
• Assess the risk to your rights and freedoms
• Take appropriate corrective action
• Report to the ICO where required
• Inform you if there is a high risk to your data
Cookies and Website Data
Our website may use cookies to improve user experience and analyse website traffic. You can control cookie settings through your browser.
Changes to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website.
Contact
If you have any questions about this Privacy Policy or how your data is handled, please contact:
Total Health Physiotherapy Ltd
12 Mayfield Road
Hersham, Surrey
KT12 5PL
Date of review: 19th April 2026
Reviewed by: Nicola Herringshaw (Director of Total Health Physiotherapy Ltd and Data Officer)
Children
Our services may be directed to children under 16 years of age.
Any relevant information is only collected with the consent of the individual holding parental responsibility for that child.
If you learn that a child under 16 has provided us with personal information without your consent, please contact us.
Booking an Appointment
When you book an appointment with us, you create an account with our online appointment system, Rehab Guru. In addition to your name, DoB, and email address, you will also complete a brief initial assessment form. This information will be stored on Rehab Guru, together with your appointment history. This is the only information stored in this system. (For more information on Rehab Guru’s Privacy Policy, please see https://www.rehabguru.com/privacy-policy)
Marketing Information
We use a third-party provider, MailChimp send information to our clients. As stated above, this is to keep in touch with our current and active clients only, sending occasional news about the practice when appropriate (e.g., Christmas holiday dates).
We gather statistics around email opening and clicks using industry standard technologies. (For more information, please see www.mailchimp.com/legal/privacy).
You can unsubscribe from these general mailings at any time by clicking the unsubscribe link contained in these emails. Alternatively, you can email our Data Controller, Nicky Herringshaw on nicky@totalhealthphysiotherapy.com.
Security
To protect your information from loss, misuse, unauthorised access or disclosure, we have in place appropriate procedures to safeguard and secure the information we collect. This includes:
- Data minimisation
- Password best practice
- Security best practice concerning devices (PCs, laptops, mobile devices), online accounts, website hosting, physical access and storage
For further details of these policies, please contact us.
Right to Access Information
You have the right to view, edit, or delete your personal information. If you wish to do this, please email your request to our Data Controller, Nicky Herringshaw at nicky@totalhealthphysiotherapy.com.
This Privacy Notice was last reviewed on 25th August 2024.