Privacy Notice

Who we are

Community Physio Plymouth provides private physiotherapy at home and in the workplace. The organisation responsible for your information (the data controller) is [To confirm: legal business name, trading status and registered address]. ICO registration number: [To confirm: ICO registration number].

You can contact us about your information at hello@communityphysioplymouth.co.uk.

What we collect

When you use our appointment request form, we collect:

• your name, email address and phone number;
• the visit address and postcode, and your company name for workplace visits;
• the type of visit and service you are interested in, and your preferred date and time;
• any brief overview of your symptoms you choose to give us. This is health information, and the field is optional.

If you go on to receive care, your physiotherapist will also make clinical notes about your assessment and treatment.

How we use it

• to respond to your enquiry and check whether we can help;
• to contact you to agree a date, time and location for your appointment;
• to plan, deliver and record your physiotherapy care.

Under UK GDPR, our lawful basis for using your details is that it is necessary to take steps at your request before entering into an agreement with you, and to provide the care you have agreed to (Article 6(1)(b)). For health information, we rely on the condition that it is necessary for the provision of health care by, or under the responsibility of, a health professional bound by a duty of confidentiality (Article 9(2)(h)).

Who we share it with

Your details are shared with the physiotherapist assigned to your care. This may be a self-employed or subcontracted physiotherapist working on our behalf, who will only use your information to provide your care.

We use a small number of service providers who handle information on our behalf and only as we instruct:

• Lovable — hosts our website and stores appointment requests and clinical notes in our booking system;
• IONOS — provides our website domain and our email, so emails you send us are stored by IONOS;
• new appointment requests trigger a notification email to the practice, sent through Lovable's email service.

We do not currently use a separate payment or clinical records system. If that changes, we will update this notice.

We do not sell your information. We will only share it with others, such as your GP, with your agreement or where the law requires it.

How it is stored and how long we keep it

Appointment requests are stored in our online booking system. Access is limited to the practice account used to manage bookings and the physiotherapist assigned to your care.

We keep enquiry details and clinical records for [To confirm: retention periods for enquiries that do not lead to care, and for clinical records].

Your rights

Under UK data protection law you can ask to see the information we hold about you, and ask us to correct it, delete it or limit how we use it. Email us to make a request. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).