Privacy Policy

​

The Bristol Physio is committed to protecting your privacy and handling your personal information securely, fairly and transparently.

This Privacy Policy explains what information I collect, why I use it, who it may be shared with, how long it may be kept and the rights you have over your information.

 

​

1. Who is responsible for your information?

The Bristol Physio is responsible for the personal information described in this Privacy Policy.

If you have any questions about your information, would like to exercise any of your data-protection rights or have a concern about how your information has been handled, you can contact me:

​

Email: daniel@thebristolphysio.com

​

In writing:
The Bristol Physio
First Floor
77a Queens Rd
Clifton
Bristol
BS8 1QP

​

​

2. What information do I collect?

The information I collect depends on how you use The Bristol Physio's services.

It may include:

​

Personal and contact information

• your name;

• date of birth;

• address;

• email address;

• telephone number;

• emergency contact details;

• occupation where relevant.

 

Health and clinical information

To provide physiotherapy and related healthcare services, I may collect information including:

• your symptoms and injuries;

• medical history;

• medication;

• allergies;

• previous treatment;

• investigations, scans or reports;

• diagnoses and clinical impressions;

• assessment findings;

• treatment provided;

• exercise and rehabilitation programmes;

• outcome measures;

• treatment goals and progress;

• relevant lifestyle, work, sport and activity information;

• correspondence with other healthcare professionals;

• photographs or videos where clinically appropriate and properly consented to.

Health information is classed as special category personal data and receives additional protection under data-protection law.

 

Appointment and booking information

This may include:

• appointment dates and times;

• booking history;

• cancellations and rescheduling;

• missed appointments;

• communications relating to your appointments;

• services booked.

 

Health-insurance information

If your treatment is funded through health insurance, I may collect information such as:

• the name of your insurer;

• membership or policy number;

• authorisation number;

• number of authorised sessions;

• excess information;

• information needed to submit or manage a claim.

 

Payment information

I may process information relating to:

• payments;

• invoices;

• refunds;

• outstanding balances;

• appointment prepayments;

• cancellation charges;

• missed-appointment charges;

• limited information provided by my payment processor about a payment or payment method.

I do not personally store your full payment-card number or card security code in your clinical records or ordinary business systems.

 

Website information

When you use this website, certain technical information may be collected, including:

• IP address;

• browser and device information;

• pages viewed;

• website interactions;

• cookie preferences;

• analytics information where you have consented to analytics cookies.

 

3. Information about children and young people

The Bristol Physio provides physiotherapy to children and young people under the age of 18.

Where a child or young person receives treatment, I may process information about:

• the child or young person;

• a parent or person with parental responsibility;

• relevant carers;

• consent and parental responsibility;

• healthcare;

• appointments;

• safeguarding where necessary.

Children and young people have privacy and confidentiality rights in their own right.

Where appropriate, information will be explained in a way that is suitable for the child's age and understanding.

A young person's information will not automatically be disclosed to a parent or carer simply because they are under 18 where they have the legal capacity to make the relevant healthcare decision themselves.

However, information may need to be shared where this is necessary to protect the child or another person from serious harm, to meet safeguarding responsibilities or where there is another lawful reason for doing so.

 

4. Where does the information come from?

Most information is provided directly by you.

I may also receive relevant information from:

• parents or people with parental responsibility;

• carers;

• GPs;

• consultants;

• hospitals;

• other physiotherapists or healthcare professionals;

• health insurers;

• employers or occupational-health providers where appropriate;

• other people or organisations involved in your referral or care.

 

5. Why do I use your information?

I may use your information to:

• respond to enquiries;

• arrange and manage appointments;

• assess your health and symptoms;

• provide physiotherapy and other healthcare services;

• develop and monitor your treatment or rehabilitation plan;

• maintain accurate clinical records;

• provide exercise programmes and clinical advice;

• communicate with you about your care;

• make appropriate referrals;

• communicate with other healthcare professionals where necessary;

• manage health-insurance authorisations and claims;

• process payments and refunds;

• administer appointment prepayments;

• manage cancellation and missed-appointment charges;

• respond to complaints or concerns;

• investigate clinical incidents;

• meet safeguarding responsibilities;

• protect you or another person from serious harm;

• comply with legal, professional, regulatory, insurance, accounting and tax requirements;

• establish, exercise or defend legal claims;

• protect the security of the website and business systems;

• understand how the website is used where you have consented to relevant cookies;

• improve the services I provide.

I will not use your information for an unrelated purpose without considering whether I have a lawful reason to do so.

​

6. What is my legal basis for using your information?

Data-protection law requires a lawful basis for using personal information.

Different lawful bases may apply depending on why your information is being used.

These may include:

 

Providing a service or fulfilling a contract

I need to use certain information to:

• arrange appointments;

• provide services you have requested;

• manage bookings;

• process payments;

• administer agreed booking, cancellation and payment terms.

 

Legal obligations

I may need to use or retain information to comply with legal, regulatory, accounting, tax, safeguarding or other legal obligations.

 

Legitimate interests

I may use information where this is reasonably necessary for the legitimate operation and protection of The Bristol Physio, provided that this does not unfairly override your rights.

This may include:

• running and improving the clinic;

• maintaining appropriate business records;

• preventing fraud;

• maintaining website and system security;

• dealing with complaints;

• recovering properly due charges;

• establishing or defending legal claims.

 

Consent

In some circumstances I may ask for your consent, for example for:

• certain photographs or videos;

• particular uses of your information;

• optional marketing;

• non-essential website cookies.

Where I rely on consent, you can withdraw it.

 

Vital interests

Information may be used where necessary to protect your life or somebody else's life in an emergency.

 

7. How do I lawfully use health information?

Health information receives additional protection under UK data-protection law.

I process health information where it is necessary for purposes such as:

• assessing your health;

• providing physiotherapy or healthcare treatment;

• managing your rehabilitation;

• communicating appropriately with other healthcare professionals;

• maintaining clinical records.

As a regulated healthcare professional, I am subject to professional confidentiality obligations.

Health information may also be processed where necessary for safeguarding, protecting vital interests, or establishing, exercising or defending legal claims where the relevant legal conditions are met.

 

8. How are payments handled?

Payments may be processed using Stripe, a specialist payment provider.

When you enter your card information into a Stripe payment facility, your sensitive card information is securely transmitted to and processed by Stripe.

​

The Bristol Physio does not personally receive or store your full card number or card security code in your clinical record.

I may receive limited payment information from Stripe, such as:

• confirmation that a payment was successful or unsuccessful;

• card type;

• the last four digits of a card;

• expiry information;

• transaction references.

 

Saved payment methods

Where a payment method is saved with Stripe for future use, you will be informed about this before it is saved.

A saved payment method may only be used for purposes that have been explained to you and that form part of the applicable booking and payment arrangements.

​

This may include, where applicable:

• paying for booked treatment;

• appointment prepayments;

• properly due outstanding appointment charges;

• charges arising under The Bristol Physio's Cancellation and Missed Appointment Policy.

 

Saving a payment method does not give The Bristol Physio unrestricted permission to make unrelated charges.

If your treatment is funded by a health insurer, cancellation or missed-appointment charges may still be your personal responsibility where they are not covered by your insurer.

​

​

9. Who might I share your information with?

I will only share personal information where there is an appropriate reason to do so.

Depending on the circumstances, this may include:

 

Healthcare professionals

 

For example:

• your GP;

• consultant;

• hospital;

• another physiotherapist;

• another healthcare professional involved in your care.

 

Health insurers

Where you are receiving treatment through private health insurance.

 

Service providers

I use trusted organisations to help operate the clinic and website.

These may include:

• Cliniko, for clinical records and appointment management;

• Stripe, for payment processing;

• Wix, for website hosting and website services;

• secure email, IT and data-storage providers;

• approved clinical documentation or transcription services where used;

• accountants and professional advisers where required.

 

These organisations only receive information appropriate to the services they provide and are required to handle personal information appropriately.

 

Professional and legal organisations

Information may also be shared where necessary with:

• professional indemnity insurers;

• legal advisers;

• professional regulators;

• safeguarding authorities;

• the Information Commissioner's Office;

• other statutory authorities.

 

Emergency or safeguarding situations

Where justified and necessary, information may be shared with:

• emergency services;

• safeguarding services;

• police;

• other appropriate organisations

where this is necessary to protect you or somebody else or to comply with a legal or professional duty.

I do not sell your medical or personal information to advertisers.

 

10. Is information transferred outside the UK?

Some technology and service providers may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, I will take reasonable steps to ensure that an appropriate lawful transfer mechanism and safeguards are in place where required by UK data-protection law.

 

11. How long do I keep your information?

I only keep personal information for as long as it is reasonably required for the purpose for which it was collected and to meet professional, legal, regulatory and insurance obligations.

Clinical records generally need to be retained for a number of years after treatment has finished.

Records relating to children and young people may need to be retained for longer than adult records.

Other information, such as:

• financial records;

• complaints;

• clinical incidents;

• safeguarding information;

• insurance information;

• legal correspondence

may have different retention periods.

Information that no longer needs to be retained will be securely deleted or destroyed where appropriate.

 

12. Cookies and the website

This website uses cookies and similar technologies.

Some cookies are essential because they are necessary for the website to function correctly and securely.

Other cookies may be used for purposes such as:

• analytics;

• website functionality;

• understanding website use;

• marketing.

Where consent is required, non-essential cookies will not be activated until you have made a choice through the website's cookie banner.

You can:

• accept non-essential cookies;

• reject non-essential cookies;

• manage individual cookie categories;

• change your preferences later through the website's cookie settings.

Please see the cookie controls on this website for further information.

 

13. Marketing

Where The Bristol Physio sends electronic marketing, this will only be done where there is an appropriate legal basis.

You can unsubscribe from marketing communications at any time.

Opting out of marketing will not stop necessary communications concerning:

• your appointments;

• payments;

• treatment;

• clinical care;

• other important administrative matters.

 

14. How do I protect your information?

I take reasonable technical and organisational measures to protect personal and health information.

These include, where appropriate:

• secure clinical-record systems;

• password protection;

• access controls;

• multi-factor authentication;

• encryption;

• secure payment processors;

• device security;

• appropriate software updates;

• secure backups;

• confidentiality procedures.

Although no electronic system can be guaranteed to be completely risk-free, appropriate measures are taken to reduce the risk of loss, misuse, unauthorised access or disclosure.

 

15. Your data-protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• ask what personal information I hold about you;

• request a copy of your personal information;

• ask for inaccurate information to be corrected;

• ask for certain information to be erased;

• ask for processing to be restricted;

• object to certain uses of your information;

• receive certain information in a portable format;

• withdraw consent where processing is based on your consent.

 

These rights are not absolute.

For example, requesting deletion does not necessarily mean that clinical records can immediately be deleted where there is a legitimate professional, legal or insurance reason for retaining them.

 

To exercise a data-protection right, email: daniel@thebristolphysio.com

​

or write to:

​

The Bristol Physio
First Floor
77a Queens Rd
Clifton
Bristol
BS8 1QP

 

16. Your right to object

Where your personal information is processed on the basis of legitimate interests, you may have the right to object to that processing.

You also have the right to object to your personal information being used for direct marketing.

If you object, I will consider your request in accordance with applicable data-protection law.

 

17. Complaints about how your information is used

If you are unhappy with the way your personal information has been handled, I would encourage you to contact me first so that I can investigate your concern.

Email: daniel@thebristolphysio.com

In writing:
The Bristol Physio
First Floor
77a Queens Rd
Clifton
Bristol
BS8 1QP

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

 

18. Changes to this Privacy Policy

I may update this Privacy Policy from time to time, for example if:

• the services I provide change;

• booking or payment arrangements change;

• website technology changes;

• service providers change;

• data-protection requirements change.

​

Updated August 2026