Privacy Policy

Effective date: 10th August 2025
Who we are: UP Physiotherapy (“we”, “us”, “our”) provides physiotherapy services, including home-based appointments and this website (the “Site”).
Data Controller: UP Physiotherapy (trading name of CTS Medical services LTD), Lammas Barn Poynton Green, Shawbury, Shrewsbury, England, SY4 4JN.
Contact: hello@up-physiotherapy.co.uk
ICO registration: [ICO number] (add once available).

This policy explains how we collect, use, share and protect your personal information in line with UK GDPR and the Data Protection Act 2018.

1) What we collect

Website enquiries: name, contact details, message content, preferred appointment times.
Booking/admin data: contact details, address for home visits, availability, billing details.
Clinical records (special category data): relevant medical history, assessment findings, treatment notes, outcome measures, and correspondence with you and (with consent) your GP/other professionals.
Technical data: IP address, device/browser information, pages viewed, and cookies (see Cookie section).
Marketing preferences: your choices about receiving updates.

2) Where data comes from

Directly from you (forms, calls, emails, in person), from referrers with your consent, or from publicly available sources for basic business checks (e.g., postcode look-ups).

3) Why we use your data (lawful bases)

Provide care & manage appointments (Contract).
Create and maintain clinical records & meet professional obligations (Legal obligation; Article 9(2)(h)—health or social care).
Communicate with your GP/other professionals when you ask us to (Consent or vital interests).
Business administration such as invoicing and accounting (Legal obligation/Legitimate interests).
Improve and secure our Site (Legitimate interests).
Send optional updates/news (Consent—you can opt out any time).

4) Sharing your data

We only share what is necessary:

With healthcare professionals you authorise (e.g., your GP, community teams).
With service providers acting on our instructions (hosting, email, practice software, payment processing). They must keep your data secure and not use it for their own purposes.
Where required by law, regulation, court order or to protect vital interests.

We do not sell your data.

5) International transfers

If a provider stores data outside the UK, we ensure appropriate safeguards are in place (e.g., UK International Data Transfer Agreement or an adequacy decision).

6) Retention

Clinical records: kept for a minimum of eight (8) years after your last appointment, or, for children, until the 25th birthday (or longer if required by law/professional guidance).
Enquiry/administrative data: usually kept for up to 3 years (or longer if needed for legal/accounting purposes).
When retention ends, we delete or anonymise the data.

7) Security

We use appropriate technical and organisational measures to protect your data (access controls, encryption where appropriate, staff confidentiality, regular reviews). No method is 100% secure; we limit what we collect and who can access it.

8) Your rights

You can: access, correct, erase, restrict or object to processing; obtain a copy (portability) of data you provided; withdraw consent at any time; and complain to the Information Commissioner’s Office (ico.org.uk). Please contact us first so we can help.

9) Cookies

We use essential cookies for the Site to function. Optional analytics cookies (if enabled) help us improve performance.

You can accept/decline non-essential cookies via our banner.
Manage cookies in your browser settings.
If you do not use analytics, remove this paragraph. If you do, state the tool (e.g., “Google Analytics”) and link to its controls.

10) Children

Our services are for adults and older people; we treat children only with appropriate parental/guardian authority.

11) Updates

We may update this policy from time to time. The latest version will always appear here with the effective date.