PRIVACY POLICY
Last updated: 23/05/26

The Home Physio Service (“I”, “me”, “my practice”) is committed to protecting your personal information with the highest standards of clinical professionalism, confidentiality, and legal compliance. This Privacy Policy explains how I collect, use, store, and protect your data when you visit my website or receive physiotherapy services.

Data Controller: Nina Stuckey, The Home Physio Service
Correspondence Address: 5 Brayford Square, London, E1 0SG, United Kingdom
Email: info@thehomephysioservice.co.uk
ICO Registration Number: ICO: ZC117603 

1. Personal Data I Collect

1.1 Information You Provide Through the Website

When you contact me through the website, I may collect:

• Name

• Email address

• Phone number

• Any information you include in your message (this may include health information if you choose to provide it)

1.2 Information Collected During Physiotherapy Treatment

(Processed securely within Cliniko)

• Identity details (name, date of birth)

• Contact details

• Clinical notes

• Assessment findings

• Treatment plans

• Outcome measures

• Relevant medical history

• Safeguarding information (if applicable)

1.3 Technical Data (Website Use)

This website currently uses essential cookies only to support basic functionality.

At present, no analytics or non-essential tracking technologies are used.
If analytics or other optional tools are introduced in the future, they will only be activated with your consent via the cookie banner.

2. Special Category Data (Health Information)

As a registered physiotherapist, I process special category data relating to your health. This information is handled with enhanced protection and processed under the lawful bases outlined in Section 3.

3. Lawful Basis for Processing

3.1 Providing Physiotherapy Treatment

• Contract (providing the service you request)

• Legitimate Interests (delivering safe and effective care)

• Special Category Condition: Health or social care treatment by a health professional

3.2 Record Keeping

• Legal Obligation (professional and statutory requirements)

• Special Category Condition: Health or social care treatment

3.3 Appointment and Enquiry Communication

• Legitimate Interests

3.4 Website Functionality

• Legitimate Interests (for essential website operation)

3.5 Website Analytics (if introduced in future)

• Consent (via cookie banner)

3.6 Marketing Emails (if ever used)

• Consent
  (I do not currently send marketing emails.)

Important: Withdrawal of consent does not apply where processing is required for the provision of healthcare or to meet legal and professional obligations, including clinical record keeping.

4. How Your Data Is Stored and Protected

4.1 Clinical Records (Cliniko)

Clinical notes are stored in Cliniko, a GDPR-compliant clinical records system with:

• Encryption

• Access controls

• Secure servers

• Audit logs

Cliniko acts as a data processor, and appropriate data processing agreements are in place.

4.2 Email and Website Enquiries

Website enquiries are received into a secure, password-protected inbox (info@thehomephysioservice.co.uk), accessed only by me.

Important information about email security
Email is not end-to-end encrypted. To protect your privacy, please avoid sending detailed medical or sensitive information by email.
If you choose to send sensitive information via email, you do so at your own discretion. Where appropriate, I can arrange a more secure communication method.

4.3 Paper Notes (if used)

Stored in a locked cabinet in a secure location.

4.4 Device Security

To protect your data, all devices used to access personal information are:

• Protected with biometric login (fingerprint or facial recognition)

• Secured with a password or access code

• Set to lock automatically after inactivity

Clinical records are not stored on the device; they are accessed securely through Cliniko.

4.5 Secure Data Destruction

When data reaches the end of its retention period, it is destroyed securely using:

• Cross-shredding for paper

• Secure digital erasure for electronic files

5. How Long Your Data Is Kept

I follow professional and legal retention standards, in line with CSP and HCPC guidance:

• Adults: 8 years from the date of last contact

• Children: Until age 25

• Pregnancy-related care: 25 years

After this period, records are securely destroyed.

Email enquiries that do not form part of your clinical record are retained for 12 months and then securely deleted.

6. Who Your Data Is Shared With

I only share your data when necessary and lawful:

• Your GP or other healthcare professionals (with your consent, unless required for safeguarding or to protect vital interests)

• Cliniko (clinical records provider)

• Insurance companies (if you request reimbursement)

• HMRC (financial records only)

• Safeguarding authorities (where required by law)

I do not sell or share your data with third-party marketers.

7. Data Processors Used by This Practice

To deliver my services, I use trusted third-party providers who process data on my behalf:

• Cliniko – clinical records system

• Website hosting provider – stores website files and technical logs

• Email provider – manages secure email delivery

All data processors act under appropriate contractual safeguards in line with UK GDPR.

These providers may process data on servers located outside the UK. Where this occurs, appropriate safeguards are applied, such as UK adequacy regulations or Standard Contractual Clauses.

8. Your Rights

Under UK GDPR, you have the right to:

• Access your data

• Request correction

• Request deletion (where legally possible)

• Restrict processing

• Object to processing

• Data portability

• Withdraw consent (for consent-based processing)

Some rights may be limited where data is required for the provision of healthcare or to meet legal obligations.

To exercise your rights, contact: info@thehomephysioservice.co.uk

9. Cookies and Website Tracking

This website uses essential cookies to ensure basic functionality, such as remembering your preferences and supporting how the site operates.

At present, no analytics or non-essential cookies are used. A cookie banner is in place to manage your preferences.

If analytics or other optional tools are introduced in the future, they will only be activated with your consent via the cookie banner.

For full details about the types of cookies used, how long they are stored, and how to manage your preferences, please see the Cookie Policy.

10. Security Measures

I take appropriate technical and organisational measures to protect your data, including (but not limited to):

• Biometric login and password protection on devices

• Automatic device lock

• Secure access to Cliniko

• Secure email access

• Limited access to data

• Regular review of data protection practices

These measures support compliance with UK GDPR and HCPC Standards of Conduct, Performance and Ethics.

11. Complaints

If you have concerns about how your data is handled, please contact me first:
Email: info@thehomephysioservice.co.uk

If you remain dissatisfied, you can contact the ICO:
Information Commissioner’s Office
www.ico.org.uk
0303 123 1113

12. Updates to This Policy

This policy may be updated periodically to reflect changes in law or practice. The latest version will always be available on this website.