PRIVACY NOTICE

Waterland Physiotherapy

Last updated: September 2026

Waterland Physiotherapy respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store and protect personal information when you contact us, use our services, visit our website or receive treatment from us.

This notice applies to patients, prospective patients, website visitors and other individuals whose personal information we process in connection with Waterland Physiotherapy.

1. Who we are

Waterland Physiotherapy is a private physiotherapy practice based at:

Waterland Cottage
Knowle Lane
Cranleigh
Surrey
GU6 8JW
United Kingdom

For the purposes of data protection legislation, Waterland Physiotherapy is the organisation responsible for deciding how and why your personal information is processed.

Data protection contact:
Jecy Franklin
Waterland Physiotherapy
Knowle Lane
Cranleigh
Surrey
GU6 8JW

Email: waterlandphysiotherapy@gmail.com

Telephone: [insert telephone number]

2. The information we collect

Depending on your relationship with us and the services you use, we may collect and process the following information:

Personal and contact information

This may include:

· your name;

· date of birth;

· postal address;

· telephone number;

· email address;

· emergency contact details;

· appointment information.

Health information

When you receive physiotherapy, we may collect information relevant to your assessment and treatment, including:

· your presenting problem and symptoms;

· medical history;

· previous injuries and operations;

· relevant diagnoses;

· medication;

· allergies and other relevant health information;

· clinical assessment findings;

· treatment provided;

· progress and response to treatment;

· information provided by other healthcare professionals where relevant to your care.

Health information is considered special category personal data under UK data protection law and is therefore subject to additional protection.

Payment and administrative information

Where applicable, we may process information relating to:

· payments;

· invoices;

· insurance claims;

· appointment history;

· correspondence concerning your treatment.

We do not normally need to collect financial information such as full payment-card details ourselves where payment is processed through a third-party payment provider.

3. How we collect your information

We may collect personal information:

· directly from you when you contact us;

· when you complete a booking or registration form;

· during your assessment or treatment;

· through correspondence with you by telephone, email or other agreed communication methods;

· through our website;

· from another healthcare professional where you have asked them to provide information to us or where information sharing is appropriate and lawful for your care;

· from an insurer or other organisation involved in arranging or paying for your treatment.

If we receive personal information about you from another source, we will provide you with the information required by applicable data protection law unless an exemption applies.

4. Why we use your information

We use personal information only where we have a lawful reason to do so.

The purposes for which we may use your information include:

Providing physiotherapy and healthcare services

We use relevant personal and health information to:

· assess your condition;

· provide physiotherapy treatment;

· monitor your progress;

· plan and modify your treatment;

· provide appropriate clinical advice;

· communicate with you about your care;

· maintain accurate clinical records.

Managing appointments

We use your contact information to:

· arrange appointments;

· confirm appointments;

· rearrange or cancel appointments;

· contact you about matters directly relating to your appointment or treatment.

Communicating with other healthcare professionals

Where appropriate and lawful, we may share relevant information with healthcare professionals involved in your care, such as your GP, consultant, surgeon or another treating practitioner.

We will normally seek your permission before sharing identifiable clinical information for purposes outside your direct care, unless there is another lawful basis for doing so.

There may be circumstances in which information must be disclosed without your consent, for example where disclosure is required or permitted by law, or where necessary to protect someone from serious harm.

Administration and business management

We may use personal information to:

· maintain our clinical and administrative records;

· process payments and invoices;

· manage insurance claims;

· obtain professional or legal advice where necessary;

· manage complaints;

· maintain the security of our systems;

· prevent or investigate fraud or other unlawful activity;

· comply with our legal and professional obligations.

5. Our lawful bases for processing your information

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing personal information.

Depending on the circumstances, the lawful bases we may rely upon include:

· Performance of a contract – where processing is necessary to provide services you have requested from us.

· Legitimate interests – where processing is necessary for legitimate interests pursued by Waterland Physiotherapy, provided those interests are not overridden by your rights and freedoms.

· Legal obligation – where we are required to process information to comply with a legal or regulatory obligation.

· Consent – where we have specifically asked you to provide consent for a particular use of your information.

Where we process health information, which is special category data, we will also rely on an appropriate condition under Article 9 of the UK GDPR, as applicable to the circumstances.

Your consent to receive physiotherapy treatment is separate from the lawful basis on which we process your personal information.

6. Consent to treatment and confidentiality

Before providing physiotherapy treatment, we will obtain appropriate informed and voluntary consent in accordance with our professional obligations.

Consent to treatment is not the same as consent under data protection law.

We will treat your health information as confidential and will only disclose it where:

· you have given appropriate permission;

· disclosure is necessary for your care and is lawful;

· disclosure is required or permitted by law;

· disclosure is necessary in the public interest; or

· disclosure is necessary to protect someone from serious harm.

As a regulated healthcare professional, Waterland Physiotherapy follows the relevant professional standards of the Health and Care Professions Council (HCPC), including requirements concerning confidentiality and secure record keeping.

7. Sharing your information

We do not sell or rent your personal information.

Where necessary, we may share relevant information with:

· your GP;

· consultants;

· surgeons;

· other healthcare professionals involved in your care;

· your health insurer or other organisation responsible for funding your treatment;

· professional advisers, where necessary;

· organisations that provide services to us, such as clinical record, IT, email, payment or website providers;

· regulatory, legal or governmental authorities where we are legally required to do so.

Where another organisation processes personal information on our behalf, we will take appropriate steps to ensure that it provides appropriate protection for that information.

We only share information that is relevant and necessary for the particular purpose.

8. Clinical records

We maintain accurate clinical records as part of providing safe and effective physiotherapy care and meeting our professional and legal obligations.

Clinical records may include information about your assessment, diagnosis where appropriate, treatment, progress, clinical advice and communications relevant to your care.

We take reasonable technical and organisational measures to protect clinical records from loss, damage, unauthorised access or inappropriate disclosure.

Electronic clinical records are stored using secure systems and access is restricted to those who need the information for legitimate professional or administrative purposes.

9. How long we keep your information

We retain personal information only for as long as it is reasonably necessary for the purpose for which it was collected, taking into account our legal, professional, insurance and other obligations.

As a general rule:

· Adult clinical records will normally be retained for eight years from the date of the patient's last treatment.

· Records relating to children and young people will normally be retained until the patient's 25th birthday, or for the applicable period required by relevant professional guidance and law.

Some information may need to be retained for longer where this is necessary because of legal, insurance, regulatory or other legitimate obligations.

When information is no longer required, it will be securely deleted or disposed of.

10. Electronic storage and third-party service providers

We use carefully selected third-party service providers to help us operate the practice.

For example, patient records may be maintained using Cliniko, a cloud-based practice management and clinical record system.

We will ensure that our use of third-party providers is subject to appropriate contractual and data protection safeguards.

Because third-party providers can change their infrastructure, hosting arrangements and sub-processors, information about the location and security arrangements of those services may be updated from time to time.

We will not state that all information is stored exclusively in the UK unless this has been verified for each relevant service provider.

11. Data security

We take reasonable and appropriate measures to protect personal information against:

· unauthorised access;

· accidental loss;

· destruction;

· damage;

· alteration;

· inappropriate disclosure.

These measures may include:

· password protection;

· access controls;

· secure electronic systems;

· secure storage of paper records where applicable;

· appropriate device security;

· confidentiality obligations for people who have access to personal information;

· secure methods of transferring information.

No method of electronic transmission or storage can be guaranteed to be completely secure. However, we take appropriate steps to reduce the risks to your information.

12. Emails, telephone calls and other communications

We may use the contact information you provide to communicate with you about:

· appointments;

· treatment;

· invoices and payments;

· administrative matters;

· information that you have specifically requested.

We may also communicate with other healthcare professionals where this is necessary and lawful for your care.

Please be aware that ordinary email and telephone communication may not always provide the same level of security as our clinical record system.

13. Direct marketing

We may occasionally wish to send information about Waterland Physiotherapy services, educational information, classes, events or other relevant activities.

We will comply with applicable data protection law and the Privacy and Electronic Communications Regulations (PECR) when carrying out direct marketing.

Where consent is required for electronic marketing, we will obtain consent through a clear and separate opt-in process.

For example, you may be asked separately whether you wish to receive:

· marketing emails;

· marketing text messages; or

· other forms of direct marketing.

Agreeing to this Privacy Notice does not by itself constitute consent to receive marketing communications.

You can withdraw your marketing consent at any time.

Every electronic marketing message will provide an appropriate way to unsubscribe or opt out.

You may also contact us directly to ask us to stop sending marketing communications.

14. Website and cookies

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function correctly. Other cookies may be used for purposes such as website analytics or improving the website.

The cookies actually used by the website may change as website services, plugins and providers are added or removed.

Where consent is required for non-essential cookies or similar technologies, we will obtain consent in accordance with applicable law.

You can also control or disable cookies through your browser settings, although doing so may affect how the website functions.

15. Your data protection rights

Depending on the circumstances, you have rights under data protection law including:

Right of access

You can ask for a copy of the personal information we hold about you.

Right to rectification

You can ask us to correct inaccurate or incomplete personal information.

Right to erasure

In certain circumstances, you can ask us to delete your personal information.

This right is not absolute. For example, we may need to retain clinical records where we have a legal, professional or other legitimate reason to do so.

Right to restriction

In certain circumstances, you can ask us to restrict how we use your personal information.

Right to data portability

In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format and to ask us to transmit it to another organisation.

Right to object

You may have the right to object to certain types of processing, including direct marketing.

Right to withdraw consent

Where we rely on your consent, you can withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Some of these rights apply only in particular circumstances and may be subject to legal exemptions.

16. How to exercise your rights

To exercise any of your data protection rights, please contact:

Jecy Franklin
Waterland Physiotherapy
Knowle Lane
Cranleigh
Surrey
GU6 8JW

Email: waterlandphysiotherapy@gmail.com

We may need to verify your identity before releasing personal information.

We will normally respond to a valid request within the period required by applicable data protection law.

We will not normally charge a fee for exercising your data protection rights. A reasonable fee may apply in limited circumstances permitted by law, or we may refuse a request where the law permits us to do so.

17. Complaints

If you have concerns about how Waterland Physiotherapy has handled your personal information, please contact us first so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), which is the UK's independent supervisory authority for data protection.

You can contact the ICO through its website:

Information Commissioner's Office (ICO)

The ICO's general contact details are available on its website.

18. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in:

· the services we provide;

· the way we process personal information;

· technology and third-party service providers;

· legal or regulatory requirements.

The most recent version will be made available on our website.

Last updated: September 2026

19. Important information about this Privacy Notice

This Privacy Notice is intended to explain clearly how Waterland Physiotherapy handles personal information.

It does not replace your statutory rights under the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations or other applicable legislation.

Waterland Physiotherapy will continue to review its data protection arrangements to ensure that personal information is handled lawfully, securely and confidentially.