Version Date: September 16 2026
At Claire Gurney Physiotherapy, we are committed to protecting your privacy and handling your personal information fairly, lawfully, and transparently.
This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. The Information We Collect
Depending on the services you use, we may collect:
To provide physiotherapy and Pilates services safely and effectively, we may collect:
Health information is classified as special category data and is afforded additional protection under UK GDPR. Claire Gurney Physiotherapy is registered with the UK Information Commissioner’s Office (ICO).
We may collect information relating to payments, including invoices and payment history.
3. How We Collect Information
We may collect your information when you:
4. How We Use Your Information
We use your information to:
Where you have given consent, we may also send occasional information about our services, classes, or promotions. You may withdraw your consent for marketing at any time.
By attending an appointment or Pilates class you consent to your information being used to contact you when appropriate and necessary (e.g to inform you a class/appointment is cancelled).
5. Lawful Basis for Processing
Under UK GDPR, we process your information under one or more of the following lawful bases:
Health information is processed under Article 9 UK GDPR because it is necessary for the provision of health care and the management of health services.
6. Sharing Your Information
We treat your information as confidential.
We may share information only where appropriate with:
Your GP (with your consent where appropriate)
Consultants or other healthcare professionals involved in your care
Private medical insurers (if you are insured and claim through them for your treatment.
Solicitors (where authorised)
Regulatory bodies where legally required
Professional advisers
Secure software providers who assist in delivering our services (we use “Jane” for booking and note taking software and “physitrack” to provide exercise programmes).
We never sell your personal information.
We take appropriate technical and organisational measures to protect your information from unauthorised access, loss, misuse, or disclosure.
8. How Long We Keep Your Information
Clinical records are retained in accordance with current legal, professional, and insurance requirements.
In most circumstances, physiotherapy records are retained for a minimum of:
Financial records may be retained for longer where required by tax legislation.
Under UK GDPR, you have the right to:
Our website may contain links to third-party websites or use third-party providers such as online booking systems, payment processors, or analytics providers. We use the provider “Jane” for booking, note taking and some payments. “Sumup” is used for some invoices.
These organisations have their own privacy policies, and we are not responsible for their privacy practices.
12. Marketing Communications
We will only send marketing communications where you have given your consent or where permitted by law. You can withdraw your consent at any time by contacting us.
You can unsubscribe or withdraw your consent at any time by contacting us or using the unsubscribe link contained in our emails.
Should a personal data breach occur that is likely to result in a risk to your rights and freedoms, we will comply with our legal obligations, including notifying the Information Commissioner’s Office (ICO) where required.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website.
