Privacy Policy

# Privacy Policy

**Physique Harmony Ltd**

Last updated: 09/2026

## 1. Who we are

Physique Harmony Ltd provides physiotherapy, massage and personal training in Leicester and the
surrounding area, both at our premises and in people's homes.

We are the "data controller" for the information described in this policy. That means we decide
what information is collected and what happens to it.

- **Company:** Physique Harmony Ltd, registered in England and Wales, company number 10743413
- **Email:** info@physiqueharmony.com
- **Phone:** 07565258851
- **ICO registration number:** 00010551435

Our physiotherapists are registered with the Health and Care Professions Council (HCPC) and work
to its standards, which include rules about confidentiality and record keeping.

## 2. What information we collect

**When you contact us or fill in a form on our website**

- Your name
- Your email address and phone number
- The service you are interested in
- Anything you tell us in the message box, which often includes information about your health
- Whether you have asked to receive our emails

**When you book and attend appointments**

- Contact and appointment details
- Health information you give us: your symptoms, medical history, medication, previous injuries
  or operations, and anything else relevant to your care
- Our clinical notes: what we assessed, what we found, what we did and what we recommended
- Your exercise plans and any written reports we prepare for you, including Physio MOT reports
- Payment records and invoices

**When you use our website**

- Technical information such as your device type, browser, approximate location and the pages
  you visit

**Information from other people**

Occasionally we receive information about you from someone else: a family member arranging an
appointment on your behalf, a GP, a consultant or an insurer. We only use it for your care.

## 3. Why we use your information, and our lawful basis

UK data protection law requires us to have a lawful basis for using your information. Ours are:

| What we use it for | Lawful basis |
|---|---|
| Replying to your enquiry and arranging appointments | Taking steps at your request before entering a contract |
| Providing treatment and keeping clinical records | Contract, and for health information the provision of healthcare under Article 9(2)(h) UK GDPR |
| Taking payment, issuing invoices, keeping accounts | Legal obligation, and our legitimate interest in running the business |
| Sending appointment reminders | Our legitimate interest in you not missing an appointment you have paid for |
| Sending marketing emails | Your consent, or the soft opt-in rules where they apply |
| Understanding how our website is used|
| Dealing with complaints, insurance and legal claims | Our legitimate interest in defending our position, and legal obligation |

## 4. Health information

Information about your health gets extra protection in law, and we treat it accordingly.

We collect it because we cannot assess or treat you without it. We use it to provide your care,
to write your notes and reports, and to keep the records that our professional regulator and our
insurers require us to keep.

Everyone who sees your health information is bound by a duty of confidentiality, either as a
registered healthcare professional or by contract.

If you write about a health problem in a website contact form, that information reaches us by
email and is stored in our website provider's systems before it becomes part of your clinical
record. If you would rather not put health details in a web form, just say you would like a call
back and we will take the details by phone.

## 5. Marketing

We only send marketing emails to people who have asked for them, or who have used our services
and have not told us to stop.

Every marketing email has an unsubscribe link. You can also reply to any of our emails, or call
us, and we will take you off the list. Unsubscribing from marketing does not affect appointment
reminders or messages about your care, which are not marketing.

We do not sell your information and we do not share it with other businesses for their marketing.

## 6. Who we share your information with

We share information only where we need to. That can include:

- **Our website and booking provider (Wix.com Ltd)**, which hosts our website, contact forms,
  booking system and email marketing
- **Our payment providers**, where you pay by card, bank transfer or payment link
- **Our accountant and HMRC**, for invoices, tax and statutory records
- **Google**, for website analytics and advertising, as described in section 8
- **Other healthcare professionals**, such as your GP or consultant, but only with your
  agreement, except in the rare cases where the law requires or permits it without agreement
- **Our insurers and professional advisers**, if there is a claim or complaint
- **Anyone we are legally required to share it with**, for example a court order or a safeguarding
  concern where someone is at risk of serious harm

Some of these providers store data outside the UK. Where that happens, they are required to
protect it to UK standards through approved safeguards such as the International Data Transfer
Agreement or the UK Addendum to the EU Standard Contractual Clauses.

## 7. How long we keep it

- **Clinical records for adults:** 8 years after your last appointment
- **Enquiries that never became appointments:** 12 months then deleted
- **Invoices and accounting records:** 6 years from the end of the relevant financial year, as
  required by law
- **Marketing contacts:** until you unsubscribe, and we review the list annually

## 8. analytics
- **Google Ads**, which tells us whether an advert led to an enquiry, and which allows us to show
  our adverts to people who have visited the site.

## 9. Your rights

You have the right to:

- **Ask what we hold about you** and get a copy, normally within one month and free of charge
- **Have mistakes corrected**
- **Ask us to delete information**, though we cannot delete clinical records we are required to keep
- **Object to how we use it**, including stopping marketing at any time
- **Ask us to restrict how we use it** while a concern is being sorted out
- **Ask for a copy in a portable format** where we hold it on the basis of consent or contract
- **Withdraw consent** where we relied on it, which does not affect anything done beforehand

To use any of these, email info@physiqueharmony.com or call 07565258851. We may ask you to
confirm your identity first, so that we do not hand your records to the wrong person.

## 10. Keeping your information safe

We use password-protected systems, restrict access to those who need it, and keep paper records
secure where we hold any. Our website connection is encrypted. No system is perfectly secure, but
if something goes wrong and it puts you at risk, we will tell you and report it to the
Information Commissioner's Office as the law requires.

## 11. If you are unhappy

Tell us first, at info@physiqueharmony.com. We would rather hear about a problem and fix it.

If you are not satisfied with our response, you can complain to the Information Commissioner's
Office, which regulates data protection in the UK:

- Website: ico.org.uk
- Helpline: 0303 123 1113

You can also raise concerns about a registered physiotherapist with the Health and Care
Professions Council at hcpc-uk.org.

## 12. Changes to this policy

If we change this policy we will update the date at the top. If the change is significant we will
say so on the website.

---