Our Commitment
At Movement Matters Physiotherapy Ltd, protecting your privacy is fundamental to the care we provide. We are committed to processing your personal information fairly, lawfully, transparently and securely in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, Information Commissioner’s Office (ICO) guidance, the Common Law Duty of Confidentiality, and the professional standards of the Health and Care Professions Council (HCPC) and the Chartered Society of Physiotherapy (CSP).
This policy explains what information we collect, why we collect it, how we use it, who we share it with, how we protect it and the rights available to you.
1. Who We Are
Movement Matters Physiotherapy Ltd is the Data Controller responsible for your personal information.
47 Rectory Road, Hadleigh, Essex SS7 2NA
Email: [email protected]
Company No: 11103038
2. Information We Collect
We may collect your contact details, date of birth, emergency contact details, correspondence and if you become a patient, medical history, assessment findings, diagnosis, treatment records, exercise programmes and other information required to provide safe physiotherapy care.
Health information is Special Category Personal Data and is protected by additional legal safeguards.
3. How We Collect Information
Information is collected when you contact us by telephone or email, submit a website enquiry form, communicate through our Tawk.to chatbot, attend appointments, complete patient paperwork or speak with your physiotherapist.
With your knowledge and where appropriate, we may also receive information from GPs, consultants, insurers, or other healthcare professionals involved in your care.
4. Why We Use Your Information
We use your information to respond to enquiries, arrange appointments, provide physiotherapy treatment, maintain accurate clinical records, send appointment reminders by email, process in clinic card payments, comply with legal and professional obligations, improve our services and manage feedback or complaints.
We do not sell your personal information.
5. Lawful Basis
Our lawful bases include performance of a contract, compliance with legal obligations, legitimate interests and Article 9(2)(h) UK GDPR for the provision of healthcare.
Where consent is requested for a specific purpose, you may withdraw it at any time.
6. Sharing Information
Information is only shared where necessary and appropriate, for example with healthcare professionals involved in your care, your GP where clinically appropriate, insurers funding treatment, our secure practice management software provider (PPS), trusted service providers acting under contract, regulators or law enforcement where required by law.
7. CCTV
CCTV is used in selected public areas of our clinic to help protect patients, visitors, staff and property.
Cameras are not installed in treatment rooms or private areas. Footage is accessed only by authorised personnel and is normally retained for approximately 30 days unless required for an investigation.
8. Website, Cookies and Analytics
Our website uses essential cookies and may use Google Analytics to understand how visitors use our website and to improve performance.
Where required by law, non-essential cookies are only operated after you have provided consent through our cookie preferences.
9. Website Enquiries and Chatbot
Our website enquiry form and Tawk.to chatbot allow you to contact us conveniently.
Information you provide is used to respond to your enquiry and, where appropriate, arrange an appointment. Please avoid including unnecessary or extensive medical information in chatbot conversations.
10. Keeping Information Secure
We use secure electronic patient records (PPS), password protected systems, restricted staff access, staff confidentiality training and appropriate technical and organisational security measures to safeguard your information.
11. Retention
We retain information only for as long as necessary to meet legal, clinical, and professional requirements.
Record — Typical Retention
Adult clinical records — 8 years after last treatment
Children’s clinical records — Until age 25 (or longer where required)
Financial records — 7 years
CCTV — Approx. 30 days unless required
12. Your Rights
You have the right to make a subject access request, which under GDPR allows patients to ask us for copies of personal data we hold on to them, you have the right to ask for inaccurate information to be corrected, request erasure where applicable, restrict or object to certain processing, request data portability where applicable, withdraw consent where consent is relied upon and complain to the Information Commissioner’s Office (ICO).
13. Questions or Complaints
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us using the details provided in this policy.
If you are unhappy with how we have handled your information, we encourage you to contact us first so that we have the opportunity to resolve your concerns before contacting the ICO.
14. Changes to this Policy
This Privacy Policy is reviewed regularly and updated whenever legislation, regulatory guidance or our services change.
The most up-to-date version will always be available on our website.