Legal
Privacy notice
Draft for the practitioner to review and adopt. Not legal advice. The full working version, with the record of processing activities and the data protection impact assessment, is in the repository under /docs.
Who holds your information
Chapman Physiotherapy & Performance is the data controller for the information held about you, and is registered with the Information Commissioner's Office.
What we hold and why
Your contact details, the consultation form you complete, notes made at each appointment, and the exercise plan and progress you log. Your clinical record is held under Article 9(2)(h) of the UK GDPR, which covers the provision of health care by a professional under a duty of confidence. It is not held on the basis of your consent, which means you cannot be asked to consent to it and it is not deleted on request.
Consent is used separately and only where it genuinely applies: the authorisation for the late cancellation charge.
Where it is held
In the United Kingdom, on encrypted infrastructure, with access restricted to the treating practitioner. Every access to a clinical note is logged.
How long we keep it
Clinical records are kept for the period required by professional record-keeping standards, which for an adult is a minimum of eight years after the final appointment and longer for anyone treated as a child. Dictation audio is deleted after 30 days.
Your rights
You can ask for a copy of everything held about you and we will provide it. You can ask for factual errors to be corrected. You can complain to the Information Commissioner's Office at any time.
Who else touches your data
A small number of suppliers process data on our behalf under written agreements: hosting, the database, payment processing for the cancellation fee, email delivery, calendar sync, and the speech-to-text service used for dictation. Each is named, with what it does, in the register kept with this notice.