1. Who We Are

Stockton Heath Physiotherapy & Wellness (“we”, “our”, “us”, “the clinic”) is committed to protecting your personal information and respecting your privacy. This notice explains what personal data we collect, how we use and protect it, and the rights you have over it.

Clinic address: 16 & 1 Dundonald Avenue, Stockton Heath, Warrington, WA4 6JT

Website: stocktonheathphysio.co.uk

Telephone: 01925 266 881

Email: admin@masseyphysiotherapy.co.uk

Data Controller: Daniel Massey (Clinic Director)

ICO registration number: ZA476970

2. The Personal Data We Collect

We collect and process the following types of personal data:

Identification data: name, address, contact details and date of birth.
Health data (special category): medical history, treatment notes, rehabilitation plans and diagnostic information.
Financial data: billing records, insurance authorisations and payment references. See section 6 for how card details are handled.
Staff data (for employees): payroll records, contact details and HR files.

We will not collect more information than is necessary for the purposes set out in this notice.

3. Our Lawful Bases for Processing

Under the UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are:

Contract (Article 6(1)(b)): to provide the physiotherapy and wellness services you have booked and to manage your appointments and account.
Legal obligation (Article 6(1)(c)): to meet our legal, tax, health-and-safety and professional record-keeping duties.
Legitimate interests (Article 6(1)(f)): to run, secure, administer and improve the clinic, provided your rights do not override these interests.
Consent (Article 6(1)(a)): for optional activities such as marketing communications and certain referrals; you may withdraw consent at any time.

Because health information is “special category” data, we rely on the additional condition in Article 9(2)(h) of the UK GDPR — the provision of health care and treatment by, or under the responsibility of, a health professional bound by a duty of confidentiality — together with the associated conditions in Schedule 1 of the Data Protection Act 2018. In an emergency we may rely on Article 9(2)(c) (protecting vital interests).

4. How We Use Your Data

We use your information to:

provide safe, effective physiotherapy, rehabilitation and wellness services;
manage bookings, payments and insurance claims;
communicate with you about appointments, treatment or clinic updates;
refer you to GPs, consultants or NHS services, only with your consent;
meet our legal, regulatory and professional obligations.

5. How We Store and Protect Your Data

Jane (practice management): our booking and clinical system securely stores your medical and billing data in encrypted, cloud-based form.
Clinic Coach / High Level: used for secure patient communication, engagement and data sharing.
Avensure / People Cloud: stores staff payroll and HR records.
Locked cabinets: legacy paper records for patients of the previous clinic owner are held in locked storage.
Access controls: staff access is limited on the basis of role.
Encryption: all online systems are password-protected and encrypted.

6. Payments and Card Details

When you book online, our website directs you to Jane’s secure booking platform, where you register an account and enter your card details. Your card information is collected and stored by Jane using its PCI-DSS compliant systems. Our website does not collect, process or store your card details. Card payments made in the clinic are handled by our card-terminal provider, which is also PCI-DSS compliant. We retain only billing references and records needed for accounting and insurance purposes.

7. Sharing Your Data

We only share your data where necessary, and with your consent where required, including with:

insurance companies — to process claims, using treatment codes where possible;
healthcare providers — GPs, consultants or NHS services, only with your explicit consent;
third-party service providers — such as our practice-management, communication, payment and IT providers, each bound by data-protection obligations;
legal or regulatory bodies — where we are required to do so by law.

We do not sell your data to third parties.

8. Transfers Outside the UK

Some of our service providers are based outside the United Kingdom — for example Jane (Canada) and High Level (United States) — and your data may be stored or processed there. Where data is transferred outside the UK, we ensure it is protected by appropriate safeguards recognised under the UK GDPR, such as UK ‘adequacy’ regulations or an International Data Transfer Agreement / Standard Contractual Clauses.

9. How Long We Keep Your Data

Patient records: retained for a minimum of 8 years after your last appointment (in line with CSP/HCPC guidance), or, for a child, until they reach the age of 25.
Financial records: retained for 7 years to comply with HMRC requirements.
Staff records: retained for the duration of employment plus 6 years.

After these periods, records are securely destroyed.

10. Your Rights

Under the UK GDPR you have the right to:

access the personal data we hold about you;
request correction of inaccurate data;
request deletion of your data, where legally possible;
restrict or object to our processing of your data;
request transfer of your data to another provider;
withdraw consent at any time, where we rely on consent;
make a complaint to the Information Commissioner’s Office (see section 14).

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

11. Marketing Communications

Where you have agreed to receive them, we may send you clinic news, offers and health information by email or text. Every marketing message includes a simple way to unsubscribe, and you can ask us to stop at any time by contacting the clinic. Opting out of marketing does not affect messages we need to send you about your care and appointments.

12. Cookies and Website Data

Our website uses essential cookies to function properly and may use limited analytics to help us improve performance. You can control cookies through your browser settings. Where we use non-essential cookies, we will ask for your consent through a cookie banner.

13. Changes to This Notice

We may update this notice from time to time. The most recent version will always be available on our website, with the effective date shown at the top.

14. Contact Us and Complaints

If you have any questions about how we use your data, or wish to exercise your rights, please contact:

Data Controller: Daniel Massey, Clinic Director

Email: admin@masseyphysiotherapy.co.uk

Phone: 01925 266 881

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.