Privacy Notice – Thrive Physiotherapy and Recovery Clinic

Last updated: Oct 26, 2026

1. Who we are

Thrive Physiotherapy and Recovery Clinic ("we", "us") is the data controller for the personal information described in this notice, which means we decide how and why it is used. This notice explains what we do with your information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

•         Legal name of business: [full legal name or sole trader name], trading as Thrive Physiotherapy and Recovery Clinic

•         Address: [clinic address]

•         Email: [privacy email address]

•         Phone: [clinic phone number]

•         ICO registration number: [ICO data protection fee reference]

•         Person responsible for data protection: [name and role]

2. What information we collect

We collect only what we need to assess, treat and look after you, and to run the clinic.

•         Identity and contact details: name, date of birth, address, phone, email, emergency contact.

•         Health information (special category data): medical history, symptoms, medications, referral letters, assessment findings, treatment notes, exercise programmes, outcome measures, imaging or test results you share with us.

•         Other sensitive details you choose to tell us, where relevant to your care, such as lifestyle, work, sport or physical activity.

•         Payment and insurance details: invoices, payment records, insurer name, policy and claim numbers. We do not store full card numbers.

•         Communications: emails, texts, call notes and appointment records.

•         Website and online booking data: IP address, device and browser information, and booking details if you book online.

•         Photos or video: only with your clear permission, for example to record posture or movement for your treatment.

We mostly collect this information from you directly. We may also receive it from your GP or other healthcare professional, your insurer, your employer (if they fund your care) or a person who referred you.

3. How we use your information and our legal basis

The law requires us to have a lawful basis for using your information. Because health information is special category data, we also need an additional condition.

Why we use your information

Lawful basis (UK GDPR Art. 6)

Condition for health data (Art. 9)

Assessing and treating you, and keeping clinical records

Contract (6(1)(b))

Provision of health care (9(2)(h))

Booking, appointment reminders and clinic administration

Contract (6(1)(b)) or legitimate interests (6(1)(f))

Provision of health care (9(2)(h)) where health details are involved

Invoicing, taking payment and dealing with insurers

Contract (6(1)(b))

Provision of health care (9(2)(h)), or your explicit consent where an insurer or employer requires it (9(2)(a))

Meeting legal duties (tax and accounting, safeguarding, regulator or court requests)

Legal obligation (6(1)(c))

Legal duties or substantial public interest (9(2)(b), 9(2)(g)) as applicable

Handling complaints, claims and professional indemnity matters

Legitimate interests (6(1)(f))

Legal claims (9(2)(f))

Audit, quality checks and measuring treatment outcomes

Legitimate interests (6(1)(f))

Provision of health care (9(2)(h))

Photos or video of you

Consent (6(1)(a))

Explicit consent (9(2)(a))

Marketing emails or texts

Consent, or the "soft opt-in" for existing patients (PECR)

We never use health information for marketing

Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent will not affect the lawfulness of what we did before, and it will not affect your treatment unless the treatment depends on that consent.

4. Who we share your information with

We do not sell your information. We share it only when needed, and only the minimum necessary.

•         Your GP or other healthcare professionals involved in your care, usually with your agreement. If you do not want us to write to your GP, tell us.

•         The person or organisation that referred you, to report back on your treatment.

•         Your insurer or employer, if they are paying for your care and you have agreed to it.

•         Our service providers (processors), who act on our instructions under a written contract, such as: [clinic management or booking software], [cloud storage or email provider], [payment provider], [accountant], [IT support], [text reminder service].

•         Our professional advisers and insurers, such as solicitors and our indemnity insurer, if there is a complaint or claim.

•         Regulators, courts, police or other authorities, where the law requires it or where there is a serious risk to you or others.

All our clinicians are bound by a duty of confidentiality and by the standards of their professional body.

5. How long we keep your information

We keep information only as long as we need it, in line with professional guidance on clinical records.

Type of record

How long we keep it

Adult clinical records

8 years after your last treatment or discharge

Records of children and young people

Until their 25th birthday (26th if they were 17 when treatment ended), or 8 years after discharge if longer

Invoices and payment records

6 years after the end of the financial year, for tax purposes

Marketing preferences

Until you opt out or ask us to delete them

Enquiries that did not become treatment

[12 months]

When the period ends, we securely delete or destroy the records.

6. Keeping your information safe

We protect your information with measures such as password-protected and encrypted devices, secure cloud systems with access limited to staff who need it, locked storage for any paper records, and contracts with our service providers. Staff receive data protection training. If a data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires.

We aim to keep your information in the UK. If a provider processes it outside the UK, we make sure a lawful transfer mechanism is in place, such as an adequacy decision or the UK International Data Transfer Agreement or Addendum.

7. Your rights

You have the right to:

•         Be informed about how we use your information (this notice).

•         Access a copy of your information, usually free and within one month.

•         Rectification: ask us to correct inaccurate or incomplete information.

•         Erasure: ask us to delete your information in certain circumstances. This does not apply where we must keep clinical records by law or professional guidance.

•         Restriction: ask us to limit how we use your information in certain circumstances.

•         Portability: ask for information you gave us to be sent to you or another provider, where it applies.

•         Object to uses based on legitimate interests, and to direct marketing at any time.

•         Withdraw consent where we rely on it.

To use any of these rights, contact us using the details in section 1. We may need to confirm your identity first.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

8. Marketing, cookies and changes to this notice

Marketing. We will only send you news, offers or reminders about our services if you have agreed or are an existing patient and have not opted out. Every message includes a way to unsubscribe, and you can also tell us at any time. We never use your health information for marketing.

Cookies. Our website uses [essential cookies only / essential, analytics and marketing cookies]. Non-essential cookies are used only with your consent, which you can change at any time through [cookie settings link].

Changes. We may update this notice from time to time. The latest version is always on our website and at the clinic, with the date at the top.