privacy policy

1. Introduction

Your privacy is of the utmost importance to us. This policy explains what personal data Firebird Physiotherapy collects from you, how we use it, and what your rights are. We are committed to processing your information in accordance with the UK’s data protection laws, including the Data Protection Act 2018 and UK GDPR.

2. Who We Are (The Data Controller)

For the purpose of data protection law, the “Data Controller” is Firebird Physiotherapy.

I, Dominick McAleenan, am the registered Data Controller and am responsible for all data protection and privacy matters at the practice. We are registered with the Information Commissioner’s Office (ICO).

• ICO Registration Number: ZB741446
• Address: 11 Livingstone Gardens, Woodley, RG5 3LT
• Phone: 07879 783 558
• Email: info@firebirdphysio.com
• Website: http://www.firebirdphysio.com

3. What Information We Collect

We collect personal information to provide our physiotherapy services. This includes:

• Personal Identification Information: Your name, title, date of birth, and gender.
• Contact Information: Your address, postcode, email address, and phone number(s).
• Next of Kin / Emergency Contact: Name, relationship to you, and phone number.
• GP & Referral Information: Your GP’s name and practice details, and details of any referring specialist.
• Sensitive Health Information: This is called “Special Category Data,” and we have a special duty to protect it. It includes:
  • Your current and past medical history (including your Injury/PMH form).
  • Details of your current injury, symptoms, and lifestyle.
  • Clinical notes, treatment plans, and assessment findings from our appointments.
  • Video or images of your movement/condition (taken with your explicit consent).
  • Exercise programmes prescribed to you.
• Insurance & Financial Information: Your health insurance provider, policy number, and authorisation code (if applicable). We also use a secure third-party provider to process and store payment card details.

4. How We Collect Your Information

We collect this information directly from you when you:

• Visit our website, hosted on WordPress.
• Complete our digital registration and medical history forms.
• Speak to us on the phone or in person.
• Correspond with us by email.
• During your assessment and treatment sessions.

We may also receive information from third parties, such as your GP, a hospital, a specialist, or your health insurance provider, but we will always inform you of this.

5. Our Lawful Basis for Processing Your Data

We are required to have a specific legal reason to process your data.

• We process your Personal Identification, Contact, and Financial Data to fulfil our Contract with you (i.e., to book your appointments, provide treatment, and process your payments).
• We process your Sensitive Health Information because it is necessary for the “purposes of preventative or occupational medicine… or the provision of health or social care or treatment” (UK GDPR Article 9(2)(h)). In simple terms, we cannot assess you or provide safe and effective physiotherapy without it. This includes:
  • Using services like Heidi AI to assist in creating accurate and efficient clinical documentation for your healthcare record.
  • Using services like PhysiTrack to create and send your prescribed exercise plan.
• We also have a Legal Obligation as healthcare professionals to maintain accurate and complete clinical records, as required by our regulator (the Health and Care Professions Council – HCPC), our professional body (the Chartered Society of Physiotherapy – CSP), and the terms of our professional indemnity insurer.
• We also process data under our Legitimate Interest to ensure high standards of care. This may include seeking guidance from trusted colleagues, specialists, or professional bodies for the purpose of clinical supervision or to discuss complex cases. When doing so, all personal information that could identify you (such as your name, date of birth, or address) is removed to ensure your case is discussed on a fully anonymised basis.
• Where we send you marketing newsletters or practice updates, we do so based on your Consent (which you provide on your registration form) or our Legitimate Interest to keep you informed as a past client. You can withdraw this consent at any time by clicking the “unsubscribe” link in any marketing email or by contacting us directly at info@firebirdphysio.com.

6. Who We Share Your Information With (Data Processors)

We will never sell your personal information. We only share your data with trusted third-party services (“Data Processors”) who are essential for us to run our practice and provide your care. They are all contractually bound to protect your data and are fully compliant with UK data protection laws.

Our key processors include:

• Zanda: Our secure clinic management system for storing your patient records, clinical notes, and appointments.
• PhysiTrack: Our platform for creating and sending your digital exercise programmes. This involves processing your name, email, and exercise prescription.
• Heidi AI: An artificial intelligence service that assists in transcribing and summarising our consultation notes to create an accurate, comprehensive clinical record.
• Stripe: Our secure payment provider for processing card payments. We do not store or have access to your full card details.
• Titan Mail & Google Workspace: Our secure, encrypted email and business operations providers. We use Google Calendar to manage our diary. (Appointment data synced to this calendar is anonymised).
• WordPress: Our website platform, which may collect data via cookies or contact forms.

We may also share information with:

• Other Healthcare Professionals:
  • For your Direct Care: With your explicit consent, we may send identifiable reports to your GP, a specialist, or another healthcare provider involved in your care.
  • For Clinical Supervision: As stated in Section 5, we may discuss anonymised case details with trusted colleagues or specialists to ensure we are providing the best possible treatment. Your identity is always protected.
• Your Health Insurer: To process your claim and authorise payment, we are contractually required to share the information requested by your insurance provider. This will be limited to the minimum necessary to fulfil their request, but may include your diagnosis, treatment codes, invoices, and, if required by them, copies of your clinical reports or assessment notes.
• Legal Authorities: If required to do so by law.

7. How We Protect Your Data

We take data security seriously. Your information is stored on secure, encrypted, cloud-based servers via our practice management software and service providers. We use multi-factor authentication where available, and all data is protected by strict physical, electronic, and procedural safeguards.

In the unlikely event of a data breach that is likely to result in a high risk to your rights and freedoms, we have procedures in place to notify you and the Information Commissioner’s Office (ICO) without undue delay, as required by law.

8. How Long We Keep Your Data (Data Retention)

In line with legal requirements and best practice from the Chartered Society of Physiotherapy (CSP), we are legally required to retain your patient records for a minimum of 8 years after the date of your last treatment.

For clients under the age of 18, records must be kept until their 25th birthday. After this period, your records will be securely and permanently deleted.

9. International Data Transfers

To provide our services, we use third-party software providers (as listed in Section 6) that may be based outside the UK. This means that your personal data may be transferred and stored on servers in other countries, such as the United States, Australia, or within the European Union.

We have taken steps to ensure your data is protected and that these transfers are lawful. We only use providers that are compliant with UK GDPR and who protect your data using legally-approved safeguards, such as “Standard Contractual Clauses” or “Adequacy Regulations,” which ensure your data has the same level of protection as it would in the UK.

10. Processing Data for Children

We can only process data for children under the age of 18 with the valid consent of a parent or legal guardian. As such, all registration forms, consent forms, and correspondence will be directed to the parent or guardian, who will be responsible for providing and safeguarding the child’s information.

11. Your Data Protection Rights

You have specific rights over your information:

• The right to be informed: This Privacy Policy is intended to meet this right.
• The right of access: You can request a copy of the information we hold about you.
• The right to rectification: You can ask us to correct any information you believe is inaccurate.
• The right to erasure (“to be forgotten”): You can request that we delete your data. Please note: We may be unable to delete your clinical records before the 8-year retention period due to our legal and professional obligations.
• The right to restrict processing: You can ask us to stop processing your data in certain circumstances.
• The right to object: You have the right to object to us processing your data, for example, for marketing purposes.

To exercise any of these rights, please contact Dominick McAleenan at info@firebirdphysio.com.

12. Website Use, Cookies & Links

Our website, which is hosted on WordPress, uses “cookies“. Cookies are small text files placed on your computer to collect standard internet log information and visitor behaviour information. We use this to track visitor use of the website and to compile statistical reports on website activity. You can set your browser not to accept cookies, but this may affect the functionality of our website.

If you use a “contact us” form on our website, the information you provide (such as your name and email) will be used to respond to your enquiry.

Our website may contain links to other websites. This privacy policy only applies to this practice’s website, so when you link to other websites, you should read their own privacy policies.

13. How to Complain

If you are unhappy with any aspect of how we handle your data, we would like to hear from you first so we can try to resolve it.

However, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO).

• Website: http://www.ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

14. Changes to This Policy

This Privacy Policy may be updated from time to time. We will post any changes on our website and, where appropriate, notify you by email. This policy was last updated on the date at the top of this document.