Privacy Policy

Who we are

IntactPhysio is a private physiotherapy clinic at Regus, Davidson House, The Forbury, Reading RG1 3EU. We are the data controller for the information described in this policy.

• Registered company name: INTACT PHYSIO LIMITED
• Company number: 17488519
• ICO registration: applied for; the registration number will be published here once it is issued.

If you have a question about your information, email [email protected] or call 0333 054 0977.

What we collect

We only collect what we need to treat you safely and run the clinic.

• Identity and contact details — your name, date of birth, address, telephone number and email address.
• Health information — your symptoms and history, what we find on examination, the treatment we provide, your progress, and any scans, letters or reports you give us. This is special category data and is treated accordingly.
• Insurance details — your insurer, policy number and authorisation number, if you are claiming.
• Payment records — what you paid and when. Card details are handled by our payment provider and are not stored by us.
• Correspondence — enquiries you send us by email, telephone or WhatsApp.
• Website usage — only if you accept cookies. See our Cookie Policy.

Why we are allowed to hold it

Under UK GDPR we must have a lawful basis for using your information, and a second basis for health information specifically.

• To provide your care — Article 6(1)(b), performance of a contract, and Article 9(2)(h), the provision of health treatment and the management of health care services by a professional bound by a duty of confidentiality.
• To meet our legal and professional obligations — Article 6(1)(c), including record keeping required by our regulator and tax law.
• To run the clinic — Article 6(1)(f), legitimate interests, for things like appointment reminders and keeping our records accurate.
• Website analytics and advertising measurement — Article 6(1)(a), consent, which you give or refuse through the cookie banner and can change at any time.

Who we share it with

We do not sell your information, and we do not share it for marketing. We share it only where it is necessary:

• Your insurer, if you are claiming — the minimum needed to process the claim.
• Your GP or another clinician, where it is in your interests and with your consent, except in the rare circumstances where the law requires or permits disclosure without it.
• Our suppliers, who act on our instructions only — our practice management software, email provider and accountant. Each is bound by a contract that restricts what they may do with the information.
• Regulators, insurers or the courts, where we are legally obliged to disclose.

Some of our suppliers process data outside the UK. Where that happens, the transfer is covered by UK adequacy regulations or by standard contractual clauses.

How long we keep it

We keep information only for as long as we need it, which is what Article 5(1)(e) of the UK GDPR requires of us. Rather than fix an arbitrary period, we work to the criteria below, which come from the law that applies to each kind of record.

• Clinical records — kept for as long as they are needed for your care, and then for the period during which a claim could still be brought. Under the Limitation Act 1980 a personal injury claim may be made within three years of the injury, or of the date the person first became aware of it (section 11), and that clock does not start for someone who was under 18 at the time until they reach adulthood (section 28). Records for patients treated as children are therefore kept longer than those for adults. We also follow the records-retention guidance that applies to physiotherapy practice.
• Financial and tax records — six years, which is what HMRC requires of a limited company, and what the Value Added Tax Act 1994 requires where VAT applies.
• Company and accounting records — as required by the Companies Act 2006.
• Enquiries that do not lead to an appointment — only as long as we need to deal with the enquiry, then deleted.
• Website analytics — as set out in our Cookie Policy, and only where you have consented.

If you would like to know exactly how long we will hold your own record, ask us and we will tell you.

When a retention period ends, records are securely destroyed.

How we keep it safe

Records are held on access-controlled systems, protected by encryption and individual logins. Paper notes, where we hold any, are kept locked away. Only the people who need to see your record to do their job have access to it, and every member of the clinical team is bound by a professional duty of confidentiality.

Your rights

You can ask us to:

• give you a copy of the information we hold about you;
• correct anything that is wrong;
• delete information, where we are not required to keep it;
• restrict or object to how we use it;
• provide it in a portable format;
• withdraw consent, where consent is the basis we rely on.

Email [email protected] and we will respond within one month. There is normally no charge. Some rights are qualified — we cannot delete a clinical record we are professionally required to keep, for instance — and we will explain if that applies.

If you are unhappy

Tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We will update this page when our practice changes and revise the date at the top.