Privacy Notice

Will Sharman Physio
Optimum Health
11 Westmoreland Street
Harrogate
HG1 5AY

Email: info@willsharmanphysio.co.uk

About this privacy notice

This privacy notice explains how Will Sharman Physio (“I”, “me”, “my” or “Will Sharman Physio”) collects, uses, stores and protects your personal information.

I am a sole-trader physiotherapist providing physiotherapy services from Optimum Health in Harrogate, with a mobile physiotherapy service also available.

I am the data controller for the personal information I collect and use in connection with my physiotherapy practice.

I take the privacy and security of your personal information seriously and process your information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information I collect

Depending on how you interact with me and the services you receive, I may collect and process the following information:

Contact and identification information

This may include:

• your name
• telephone number
• email address
• postal address
• emergency contact details where relevant
• information needed to arrange and manage appointments.

Health and clinical information

When you receive physiotherapy treatment, I may collect information about your health, including:

• your medical history
• current symptoms and condition
• previous injuries and treatments
• medications where relevant to your treatment
• information about your physical health and function
• assessment findings
• clinical observations
• diagnosis or clinical impression where appropriate
• treatment provided
• treatment plans and exercise programmes
• your progress and response to treatment
• other information relevant to providing safe and appropriate physiotherapy care.

Health information is considered special category personal data under UK data protection law and receives additional protection.

Appointment and communication information

I may retain information relating to your appointments and communications with me, including communications by:

• telephone
• email
• WhatsApp
• the booking portal on my website
• other direct communications relating to your care.

Payment information

If you pay for treatment by card, payment will be processed using SumUp.

I do not need to retain your full card details as part of your clinical record.

How I collect your information

I may collect information:

• when you contact me by telephone, email or WhatsApp
• when you book an appointment through the booking portal on my website
• when you book an appointment
• during your physiotherapy assessment and treatment
• when you provide information verbally or in writing
• when you make a payment
• when you communicate with me about your treatment
• where necessary and lawful, from another person or organisation involved in your care.

Where possible, I collect personal information directly from you.

Why I use your information

I use your personal information for purposes including:

• responding to enquiries
• arranging and managing appointments
• providing physiotherapy assessment and treatment
• maintaining accurate clinical records
• developing and reviewing your treatment plan
• providing exercise programmes and rehabilitation information
• communicating with you about your appointments and treatment
• processing payments and maintaining appropriate financial records
• managing my business and professional obligations
• complying with legal and regulatory requirements
• dealing with complaints or concerns
• maintaining appropriate insurance and professional records
• protecting the health, safety and rights of patients and others.

I will only use your information for purposes that are lawful and appropriate.

Legal basis for using your information

For ordinary personal information, I will generally rely on one or more of the following lawful bases under the UK GDPR:

• Contract – where processing is necessary to provide the physiotherapy services you have requested
• Legal obligation – where I am required to keep or disclose information to comply with a legal requirement
• Legitimate interests – where processing is necessary for the legitimate operation and administration of my practice, provided those interests are not overridden by your rights
• Consent – where I specifically ask for your consent for a particular use of your information.

Health information

Information concerning your physical or mental health is special category data.

I process health information where necessary to provide healthcare and physiotherapy services, maintain appropriate clinical records and manage your treatment.

I will only process special category data where an appropriate condition under UK data protection law applies.

Clinical records

As a physiotherapist, I have professional and legal responsibilities to maintain accurate and appropriate records of the care I provide.

Your clinical record may include information about your assessment, examination, clinical reasoning, treatment, advice, exercise programme and progress.

Your clinical records will be maintained electronically using Rehab Guru.

Rehab Guru acts as a data processor in relation to patient information that I enter into its system. I remain responsible for determining how and why your clinical information is processed.

Rehab Guru states that its primary data centre and primary servers are based in the UK by default, and that clinicians remain the data controllers for their patients’ information.

You can read Rehab Guru’s own privacy information on its website.

Temporary handwritten notes

During an appointment I may make temporary handwritten notes to assist with the assessment and treatment process.

Where information from these notes forms part of your clinical record, the relevant information will be transferred to your electronic clinical record.

Temporary handwritten notes will then be securely destroyed when they are no longer required and the relevant information has been incorporated into your clinical record.

The electronic clinical record retained in Rehab Guru is the formal clinical record.

Who I share your information with

I will only share your personal information where there is a lawful and appropriate reason to do so.

Depending on the circumstances, this may include sharing information with:

• Rehab Guru, which provides the clinical record and rehabilitation software I use, and the online booking portal shown on my website
• SumUp, where necessary to process card payments
• professional advisers such as my accountant, where appropriate
• insurers or legal advisers where necessary
• regulatory, government or law-enforcement bodies where I am legally required to provide information
• other healthcare professionals where this is necessary and lawful for your care.

I will not routinely share your clinical information with your GP, consultant or another healthcare professional unless there is an appropriate reason and lawful basis to do so.

I will not sell your personal information.

Telephone, email and WhatsApp

I may use telephone, email and WhatsApp to communicate with you about appointments, treatment and other matters relating to my physiotherapy service.

Please be aware that telephone, email and messaging services are provided by third-party communication providers and therefore information transmitted through these services may be subject to their own privacy policies and terms.

I will take reasonable steps to limit the amount of sensitive clinical information communicated through ordinary messaging services.

For detailed clinical information, I will generally use your clinical record rather than relying on WhatsApp or ordinary email as the primary record.

Payments

Card payments are processed using SumUp.

Payment processing involves the transfer of relevant payment information to SumUp. I do not need to store your full card number or security code in my clinical records.

SumUp processes personal information in accordance with its own privacy information and applicable data protection requirements.

Booking an appointment online

The booking page on my website displays a booking portal provided by Rehab Guru, the clinical record system I use. The portal is shown within my website, but the information you enter into it is submitted directly to Rehab Guru rather than to my website.

When you book through the portal you will be asked for the information needed to make an appointment, which may include your name, email address, telephone number and the appointment you would like. Rehab Guru may also set cookies or use similar technologies within the booking portal in order for it to work. These are set by Rehab Guru, not by my website, and are covered by Rehab Guru’s own privacy information.

Please avoid including detailed medical or other sensitive health information when booking unless it is specifically requested. Once your appointment is booked I will send you a pre-appointment form, which is the appropriate place for your medical history.

You can also book by telephone, email or WhatsApp if you would prefer not to use the online portal.

Cookies

My website does not set any cookies of its own. It does not use advertising cookies, tracking cookies or analytics cookies, and it does not build a profile of you or follow you to other websites. That is why you are not asked to accept or decline cookies when you arrive.

There is one exception, and only on the booking page. The Rehab Guru booking portal shown on that page may set cookies or use similar technologies within its own part of the page so that the booking process works. Those are set by Rehab Guru rather than by me, and are covered by Rehab Guru’s own privacy information. You will only encounter them if you visit the booking page.

If I ever introduce cookies of my own, I will update this notice first, and I will ask for your consent where the law requires it.

Website analytics

I do not use Google Analytics.

I use Cloudflare Web Analytics to see how many people visit the website and which pages they read. It counts visits without using cookies, without fingerprinting your device and without tracking individuals across websites. I cannot identify you from it.

I do not use website analytics to collect or analyse your clinical health information.

If I change the way analytics work, I will update this notice.

How I protect your information

I take appropriate technical and organisational measures to protect your personal information from:

• unauthorised access
• loss
• misuse
• alteration
• disclosure
• destruction.

Electronic clinical records are stored using appropriate security measures provided by the systems I use.

I will only keep physical information for as long as necessary and will securely dispose of information when it is no longer required.

How long I keep your information

I will retain personal information only for as long as it is necessary for the purposes for which it was collected, taking into account my professional, legal, regulatory and insurance obligations.

Clinical records

I currently intend to retain adult clinical records for eight years from the date of last treatment, unless there is a lawful reason to retain them for longer.

This approach is consistent with the general retention period identified in Chartered Society of Physiotherapy guidance for adult health records.

If you are under 18, different retention requirements may apply. I do not currently routinely provide treatment to children.

Financial records

Information relating to payments and financial transactions may need to be retained for longer where required for accounting, taxation or other legal purposes.

Enquiries

Information relating to enquiries that do not result in treatment will normally only be retained for as long as reasonably necessary to deal with the enquiry and maintain appropriate business records.

Your rights

Under applicable data protection law, you may have rights including:

• the right to be informed about how your personal information is used
• the right to access your personal information
• the right to request correction of inaccurate information
• the right to request deletion of information in certain circumstances
• the right to restrict processing in certain circumstances
• the right to object to certain processing
• the right to data portability in certain circumstances.

These rights are subject to legal exceptions and may not apply in every situation.

For example, I may be required to retain certain clinical or financial records even if you ask for them to be deleted.

Access to your clinical records

You have the right to request access to personal information that I hold about you, subject to the requirements and exemptions of applicable data protection law.

If you would like to request a copy of your information, please contact me using:

Email: info@willsharmanphysio.co.uk

I may need to verify your identity before providing information.

Keeping your information accurate

I aim to ensure that the personal information I hold is accurate and up to date.

If any of your information changes, or if you believe information I hold about you is incorrect, please contact me so that I can consider and, where appropriate, update it.

Data breaches

If I become aware of a personal data breach, I will assess the breach and take appropriate action in accordance with my legal obligations.

Where a breach is likely to result in a risk to individuals’ rights and freedoms, I will notify the Information Commissioner’s Office where required and will notify affected individuals where legally required.

Complaints

If you have any concerns about how I have handled your personal information, please contact me first:

Will Sharman Physio
Optimum Health
11 Westmoreland Street
Harrogate
HG1 5AY

Email: info@wsphysio.co.uk

You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your personal information has been handled unlawfully.

The ICO’s website is:

Information Commissioner’s Office (ICO)

Changes to this privacy notice

I may update this privacy notice from time to time to reflect changes to my services, the systems I use or applicable data protection requirements.

The latest version will be made available on my website and will show the date on which it was last updated.

Contact

If you have any questions about this privacy notice or how I process your personal information, please contact:

Will Sharman Physio
Optimum Health
11 Westmoreland Street
Harrogate
HG1 5AY

Email: info@willsharmanphysio.co.uk