PRIVACY POLICY

Rehab & Restore Physiotherapy

Last updated: 4 October 2026

Your privacy matters to me. This policy explains how I collect, use and protect your personal information when you contact Rehab & Restore Physiotherapy, use this website or receive physiotherapy care.

Who is responsible for your information?

I am Christabel Entwistle, a sole trader trading as Rehab & Restore Physiotherapy. I am the data controller, which means I am responsible for deciding how your personal information is used.

Email: chrissie@rehabandrestorephysio.co.uk

Business correspondence address: 11 Westfield Close, Backwell, BS48 3NQ

This address is for correspondence only. Appointments take place at the clinic or through arranged home visits.

What information do I collect?

Depending on your enquiry or care, I may collect:

Your name, date of birth, address and contact details.
Information you provide through the enquiry form, email, telephone or appointments.
Relevant medical history, medication details, symptoms and treatment goals.
Assessment findings, treatment notes and correspondence relating to your care.
Appointment, invoice and payment information.
Parent, carer or emergency contact details where relevant.
Information about website use, depending on the cookies and settings enabled.

Most information comes directly from you. With appropriate permission or another lawful justification, I may also receive relevant information from a parent, carer, referring clinician or another professional involved in your care.

Please keep website enquiries brief and avoid including detailed medical information. Relevant health information can be discussed during the assessment process.

Why do I use your information?

I use your information to:

Respond to enquiries and arrange appointments.
Assess your needs and provide safe, personalised physiotherapy.
Maintain accurate clinical records and communicate about your care.
Process payments and keep business accounts.
Meet legal and professional responsibilities.
Manage complaints or establish, exercise or defend legal claims.

Providing relevant health information is necessary for safe assessment and treatment. If essential information is unavailable, I may be unable to provide care.

The legal grounds for using your information.

Under UK data protection law, I rely on:

Contract: to respond to requests about treatment and provide the services you book.
Legal obligation: to meet applicable legal requirements, including accounting and tax duties.Legitimate interests: to administer the practice, manage enquiries and complaints, and protect legal rights, where these interests do not override your rights.
Consent: where I specifically ask for your permission for an optional use of your information. You can withdraw that consent at any time.

Health information receives additional protection. I use it where necessary to provide healthcare under Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018, subject to professional confidentiality. Where health information is necessary for legal claims, Article 9(2)(f) may apply.

Consent to physiotherapy treatment is separate from the legal grounds for using personal information.

Who might information be shared with?

I only share information where necessary and with a lawful justification. Recipients may include:

Healthcare professionals involved in your care.
Website, email, clinical record and payment service providers.
Accountants, insurers or professional advisers where required.
Regulators or public authorities where disclosure is legally required or justified, including safeguarding concerns.

The website uses Wix, and business email uses Microsoft 365. Clinical records, booking and payment are provided by Clinikco.

I do not sell your personal information.

How is information stored and protected?

Clinical records, appointment information and relevant correspondence are stored electronically using Cliniko, a secure practice-management system. Cliniko accounts created in the UK have their main account data stored in the UK. Information is encrypted while being transferred and while stored, and is backed up regularly. Business emails are managed through Microsoft 365, while website enquiries are received through Wix. Access to these systems is restricted using individual passwords, two-factor authentication where available and appropriate access controls. Computers and mobile devices used for the practice are password-protected, kept updated and set to lock automatically when not in use. Paper clinical records are not routinely maintained. If temporary handwritten notes or paper documents are created or received, they are kept securely, transferred to the electronic clinical record where appropriate and confidentially destroyed when no longer required. Any paper records that must be retained are stored in a locked location with access restricted to authorised individuals. Reasonable technical and organisational measures are used to protect personal information against unauthorised access, loss, alteration or disclosure. Some service providers or their approved subprocessors may access or process information outside the UK. Although the main data for UK Cliniko accounts is stored in the UK, Cliniko’s provider is based in Australia and may use international subprocessors. Microsoft and Wix may also process information using international systems and service providers. Where personal information is transferred outside the UK, it is protected using safeguards permitted under UK data-protection law. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or other legally recognised safeguards. Further information about international transfers and the safeguards used is available in the privacy and data-processing documentation published by Cliniko, Microsoft and Wix. You may also contact Rehab & Restore Physiotherapy using the details in this privacy notice to request further information or a copy of the relevant safeguards.

How long is information kept?

Information is kept only for as long as necessary for its purpose and to meet applicable legal, professional and insurance requirements. The usual retention periods are:

Enquiries that do not lead to treatment: 12 months from the date of the last communication.
Adult clinical records: 8 years from the date of the last appointment or the end of treatment.
Children’s clinical records: until the patient’s 25th birthday, or until their 26th birthday if treatment ended when they were 17.
Invoices and accounting records: for at least 5 years after the 31 January Self Assessment submission deadline for the relevant tax year.

Information may be retained for longer where this is necessary because of a complaint, legal claim, safeguarding concern, insurance requirement or another legal or professional obligation. At the end of the relevant retention period, records will be securely deleted or confidentially destroyed.

Your rights

Depending on the circumstances, you may have the right to:

Access your personal information.
Ask for inaccurate information to be corrected.
Request deletion or restriction of its use.
Object to certain uses of your information.
Receive certain information in a portable format.
Withdraw consent where processing relies on consent.

These rights are not absolute. For example, clinical records may need to be retained even if you request deletion.

To make a request, please contact me using the details above.

This website is hosted on Wix and uses cookies and similar technologies. Essential cookies are used for security, fraud prevention and the basic operation of the website. These cookies are necessary for the website to function and cannot be disabled through the website’s cookie controls.

With a visitor’s consent, functional and analytics cookies may also be used. Functional cookies help remember choices and enable additional website features. Analytics cookies, including those used by Wix Analytics, help me understand how visitors use the website and improve its performance. I do not currently use cookies for targeted advertising. When visiting the website, you can accept all cookies, reject non-essential cookies or choose which categories to allow through the cookie banner. The current cookie names, providers, purposes and storage periods can be viewed at any time through the Cookie Settings option displayed on the website. You can change or withdraw your consent through Cookie Settings. You may also delete or block cookies using your browser settings, although doing so may affect how some parts of the website function.

Questions or complaints

Please contact me if you have any questions or concerns about your information.

You also have the right to complain to the Information Commissioner’s Office:

Website: https://ico.org.uk/make-a-complaint/Telephone: 0303 123 1113

Changes to this policy

This policy will be updated when necessary. The latest version will be available on this page.