Privacy Policy

1. About This Policy

Stride Sports Physiotherapy Ltd (“we”, “us”, “our”) is committed to protecting your personal information and being transparent about how we use it. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.

This policy applies to all personal data collected through our website (www.stridesportsphysio.com), by telephone, by email, via WhatsApp, and during the course of providing physiotherapy treatment.

We are registered as a data controller with the Information Commissioner's Office (ICO).

2. Who We Are

• Data Controller: Stride Sports Physiotherapy Ltd
• Practitioner: Melissa Reynolds, BSc (Hons) Physiotherapy, MSc Sports and Exercise Physiotherapy
• Clinic address: Rep Studio, 37-38 Margaret Street, Marylebone, London W1G 0JF
• Email: mel@stridesportsphysio.com
• Telephone: 07826 923 555

Melissa Reynolds is registered with the Health and Care Professions Council (HCPC) and is a member of the Chartered Society of Physiotherapy (CSP).

3. What Personal Data We Collect

3.1 Personal data

We may collect the following categories of personal data:

• Full name, date of birth, and contact details (address, telephone number, email address)
• GP details and emergency contact information
• Insurance policy details (where applicable), including insurer name and authorisation codes
• Payment information (we do not store card details; payments are processed securely through third-party providers)
• Booking and appointment history
• Communications with us, including emails, WhatsApp messages, and telephone records

3.2 Special Category (health) data

As a physiotherapy practice, we process health data, which is classified as Special Category data under UK GDPR. This includes:

• Medical history, diagnosis, and clinical notes
• Details of your injury, condition, or symptoms
• Treatment records, progress notes, and outcome measures
• Information about medications or other healthcare providers involved in your care
• Details of any surgical or medical procedures relevant to your treatment

We process this data because it is necessary for the provision of health care and treatment, and for the management of our services, under Article 9(2)(h) of the UK GDPR. We also process it where we are legally or professionally required to do so. This is explained further in section 5.

3.3 Website data

When you visit our website, we may automatically collect technical data including your IP address, browser type, pages visited, and time spent on the site. Where you have accepted them, we use this for website analytics, to measure whether our advertising is working, and for security. We do not use it to build advertising profiles about you. Our Cookie Policy explains this in full and lets you change your choice at any time.

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• To provide physiotherapy assessment and treatment
• To maintain accurate clinical records as required by the HCPC and CSP
• To communicate with you about appointments, treatment plans, and your care
• To process insurance claims on your behalf with your authorisation
• To communicate with your GP, consultant, or other healthcare professionals involved in your care (with your consent)
• To process payments for services rendered
• To send appointment reminders and follow-up communications
• To comply with our legal and regulatory obligations
• To respond to Subject Access Requests and other data rights requests

5. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

Provision of health care (Article 9(2)(h)) - For processing your health data. This covers assessment, diagnosis, treatment and the management of our services. It is the condition that applies to regulated healthcare providers and does not depend on your consent, which is why clinical records cannot simply be deleted on request (see section 7).

Quality and safety of care (Article 9(2)(i)) - Where we review clinical records for audit, supervision or to maintain standards of care.

Consent - For optional marketing communications only. You may withdraw this consent at any time by contacting us, and doing so will not affect your treatment or our clinical records.

Contract - To fulfil our agreement with you to provide physiotherapy services, including processing bookings and payments.

Legal obligation - We are required by the HCPC and CSP to maintain clinical records. These records cannot be deleted upon request, as our regulatory bodies may require access to clinical data in certain circumstances.

Legitimate interests - For internal administration, improving our services, and ensuring the security of our systems.

6. Who We Share Your Data With

We will never sell your personal data. We may share your information only in the following circumstances:

• Healthcare professionals - your GP, consultant, surgeon, or other clinicians involved in your care, where clinically necessary and with your knowledge.
• Insurance companies - your insurer (e.g. Bupa, AXA Health, WPA, Aviva, Healix, Cigna) where you are claiming for treatment under a policy, and where you have authorised us to do so.
• Practice management software - we use Splose to manage appointments and clinical records. Splose processes data in accordance with UK GDPR. Please refer to Splose's privacy policy for further details.
• Website analytics providers - Google and PostHog receive information about how this website is used, where you have accepted analytics cookies. They never receive your name, contact details or any information about your health. See our Cookie Policy for detail.
• Legal and regulatory bodies - the HCPC, CSP, ICO, or other regulatory authorities where we are legally required to disclose information.
• Law enforcement - the police or other authorities, where required by law or court order.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

7. How Long We Keep Your Data

We keep personal data only for as long as it is needed for the purpose it was collected for, and for as long as our professional, regulatory and legal obligations require. The periods below are the minimums that apply to us:

• Adult clinical records: a minimum of 8 years from the date of last treatment
• Children's records: at least until the patient's 26th birthday (8 years after their 18th birthday)
• Financial and billing records: at least 6 years, in line with HMRC requirements
• Enquiries and general correspondence: no longer than is necessary for the purpose they were sent for

Records are reviewed periodically and securely destroyed once they are no longer required for the purposes set out in this policy or by our regulatory obligations.

Please note that clinical records cannot be deleted on request alone. Our regulatory bodies (HCPC and CSP) may require access to clinical data, and we are legally obliged to retain records for the minimum periods set out above.

8. Data Security

We take the security of your personal data seriously. Our security measures include:

• Clinical records are stored within Splose, a GDPR-compliant, encrypted practice management system
• All electronic communications containing personal data are sent via secure, encrypted channels where possible
• Access to clinical records is restricted to Melissa Reynolds
• We apply appropriate technical and organisational measures to the systems we use, and review them periodically

Please note that communications via WhatsApp and standard email are not fully encrypted in a clinical sense. We recommend you do not share sensitive health information through these channels if you have concerns, and we will use secure alternatives where possible.

In the event of a personal data breach, we will assess it promptly and, where it is likely to result in a risk to your rights and freedoms, notify the ICO within 72 hours of becoming aware of it. We will inform affected individuals where the law requires us to.

9. Your Rights

Under UK GDPR, you have the following rights:

Right of access - You may request a copy of the personal data we hold about you. We will respond within one month. Where a request is particularly complex we may extend this by up to two further months and will tell you if so. There is normally no charge, though we may charge a reasonable fee where a request is manifestly unfounded or excessive.

Right to rectification - If any information we hold about you is inaccurate or incomplete, you may ask us to correct it.

Right to erasure - In certain circumstances, you may request that we delete your data. Please note this right is limited in respect of clinical records, which we are legally required to retain.

Right to restrict processing - You may ask us to pause the processing of your data in certain circumstances.

Right to data portability - You may request a copy of your data in a commonly used format.

Right to object - You may object to our processing of your data where we rely on legitimate interests as our lawful basis.

Rights related to automated decision-making - We do not use automated decision-making or profiling.

To exercise any of these rights, please contact us at mel@stridesportsphysio.com. We may need to verify your identity before processing your request.

10. Cookies and Website Analytics

Our website uses cookies. Only strictly necessary cookies are set unless you accept others. When you first visit you can accept all cookies, accept only those that are strictly necessary, or choose analytics and advertising separately, and you can change your choice at any time using the Cookie Settings link in the footer of every page. Our Cookie Policy sets out exactly which cookies we use, what each one does and how long it lasts.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal information.

12. Complaints

If you have any concerns about how we handle your personal data, please contact us in the first instance at mel@stridesportsphysio.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on our website. Material changes will be communicated to active patients directly. The version date at the top of this document indicates when it was last reviewed.