How this clinic handles your personal information
Written to be read rather than to be scrolled past. If anything here is unclear, ask and it will be explained.
Last updated: Mon 14th Sep 2026.
This is a UK GDPR privacy notice, provided under the UK General Data Protection Regulation and the Data Protection Act 2018. It explains who holds your information, what is collected, why, how long it is kept, and what you can ask for.
Who we are and how to contact us
Fit Physiotherapy is a physiotherapy practice at Shop 2, 4-6 Roumelia Lane, Boscombe, Bournemouth BH5 1EU.
The data controller is Deborah, a sole trader trading as Fit Physiotherapy, at that address. The controller decides why and how your information is used, and is answerable for it.
For anything about your personal information, including any of the requests set out below, email deborah@fitphysiotherapy.co.uk. That address is also the route for a subject access request, and it reaches the controller directly.
The practice is registered with the Information Commissioner's Office as a controller of health records. The registration reference is available on request from the address above.
What this website collects
The pages of this website set no cookies of their own and run no analytics or advertising scripts. The site itself does not record what you read, and it stores nothing about you in your browser.
Some pages load content from other companies, and those companies may record the request in their own server logs, as they would for any website that embeds their content. The map on the contact page is provided by Google Maps, and the site's fonts are served by Google Fonts, both operated by Google. Their handling of that data is governed by their own privacy notices rather than by this one.
The website is hosted by Hostinger, which keeps server logs that may include your IP address, for security and for keeping the service running. Hostinger acts as a processor on the clinic's behalf.
Booking an appointment
Appointments are arranged directly with Deborah by telephone, text message, WhatsApp or email, as set out on the booking page. There is no online booking form on this website.
When you get in touch, the clinic uses what you share to arrange and provide your appointment. That information is your name, your contact details, and anything you choose to say about your symptoms or your reason for booking. A WhatsApp message is carried by WhatsApp, operated by Meta, under its own terms and privacy notice.
The clinic's email is provided by Google Workspace, so Google acts as a processor for messages between you and the clinic.
The lawful basis for handling your booking details is contract, because arranging and delivering the appointment you asked for is the contract between you and the clinic. Where the clinic contacts you about an appointment you have already made, or keeps a record of a cancelled or missed appointment, the basis is legitimate interests: running the practice, keeping the diary accurate, and being able to show what was arranged. Those interests are balanced against your own, and the information used for them is kept to the minimum.
If you tell the widget about your symptoms, that is health data. The additional condition relied on for health data is Article 9(2)(h) of the UK GDPR, processing necessary for the provision of health care and treatment, together with the corresponding condition in Schedule 1 of the Data Protection Act 2018. It is handled by a professional under an obligation of confidence.
Clinical records
If you become a patient, the clinic keeps a clinical record: your contact details, relevant medical history, what was found at assessment, what treatment was given and what plan was agreed. This is health data, which UK data protection law treats as a special category requiring extra care. The condition relied on is again Article 9(2)(h), the provision of health care.
Those records are kept because they are necessary to provide your care and because a physiotherapist has a professional obligation to keep them. They are held securely, and they are confidential.
Your records are not shared with anyone else without your consent, other than in the narrow circumstances where the law requires or permits it: for example where there is a serious risk to someone's safety, or in response to a valid court order. If a referral to a GP, a consultant or another service would help you, that is discussed with you first.
How long records are kept
Clinical records are retained in line with the records management guidance published by the Chartered Society of Physiotherapy and the Department of Health and Social Care:
- Adults: eight years after the date of your last treatment.
- Anyone treated under the age of 18: until their twenty-fifth birthday.
After that, records are disposed of securely. Booking and correspondence records that are not part of a clinical record are kept only as long as they are needed for the purpose they were collected for, and then deleted.
Your rights under UK GDPR
You have the right to be told what personal information is held about you and to be given a copy of it, normally within one month and normally free of charge. That is a subject access request, and you make it by emailing deborah@fitphysiotherapy.co.uk.
You have the right to have inaccurate information corrected. Where a clinical record states what was found or decided at the time, a correction is recorded alongside the original rather than replacing it, because the history of your care has to stay legible.
You have the right to ask for information to be deleted, to ask that its use be restricted, to object to particular uses of it, and to receive information you provided in a portable form. Those rights are not absolute: where the clinic is legally or professionally obliged to keep a clinical record, it cannot be deleted on request, and you will be told that plainly along with the reason.
Where processing is based on your consent, you can withdraw that consent at any time, and withdrawing it does not affect anything done before you withdrew it.
Decisions about your care are made by a physiotherapist. There is no automated decision-making and no profiling.
Where your information is held
The clinic's processors are Hostinger for website hosting, HighLevel, Inc. for the booking system, and Google for email, fonts and the embedded map. Some of them operate outside the United Kingdom. Where information is transferred abroad it is protected by the safeguards UK data protection law requires, such as the UK addendum to the standard contractual clauses or an adequacy decision covering the country concerned.
Complaints
If you are unhappy with how your personal information has been handled, please raise it with the clinic first, by emailing deborah@fitphysiotherapy.co.uk, because most concerns are quickest to resolve directly.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. You can complain online at ico.org.uk/make-a-complaint, or write to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to the clinic first is not a condition of complaining to the ICO.
Changes to this policy
This policy will be updated when the site or the practice changes. The date at the top shows when it was last changed.