Privacy Policy

We are committed to protecting your privacy and processing your personal information fairly, lawfully and transparently. All personal data is processed in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and all other applicable UK data protection legislation.

This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

By accessing and using the Advance Physiotherapy website, contacting us, booking an appointment, or using any of our services, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use and processing of your personal information as described herein.

If you do not agree with the terms of this Privacy Policy, please refrain from using our website or services.

Who We Are

Advance Physiotherapy Limited is the data controller responsible for your personal information. If you have any questions about this Privacy Policy or how we process your personal information, please contact us using the clinic and correspondence details provided above.

Company Name: Advance Physiotherapy Limited

Website: www.advance-physiotherapy.com

Registered Office:
1–3 High Street
Great Dunmow
Essex
CM6 1UU

Clinic and Correspondence Address:
Advance Physiotherapy Limited
3 The Manor House
Elsham Drive

The Information We May Collect

We may collect and process the following personal information:

Personal Information

• Name
• Address
• Telephone number(s)
• Email address
• Date of birth
• Employment details
• Emergency contact and next of kin information
• GP and consultant details
• Private medical insurance information
• Appointment and attendance records
• Correspondence between you and Advance Physiotherapy

Financial Information

• Payment records
• Invoices and receipts
• Transaction information relating to services provided

Special Category Data (Health Information)

As a healthcare provider, we process information relating to your health, including:

• Medical history
• Current medical conditions
• Medications
• Symptoms and diagnosis
• Clinical assessment findings
• Treatment plans
• Progress notes and outcomes

Health information is classified as Special Category Data under UK GDPR and receives additional legal protection.

How We Collect Your Information

We may collect information directly from you when:

• You contact us by phone, email, website or social media
• You complete registration, consent or medical history forms
• You attend appointments
• You make payments for services

We may also receive information from:

• Your GP
• Consultants or other healthcare professionals
• Employers (where relevant and with appropriate authority)
• Private medical insurers
• Family members acting on your behalf
• Other healthcare providers involved in your care

Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal information.

Personal Data

We process personal data under the following lawful bases:

Contractual Necessity (Article 6(1)(b))
To provide physiotherapy services, manage appointments, communicate with you and administer payments.

Legal Obligation (Article 6(1)(c))
To comply with legal, regulatory and professional obligations, including those imposed by the Health and Care Professions Council (HCPC), tax authorities and healthcare regulations.

Legitimate Interests (Article 6(1)(f))
To manage and improve our services, maintain records, conduct audits, prevent fraud and ensure the efficient operation of our business.

Consent (Article 6(1)(a))
Where we ask for your permission, such as for marketing communications or sharing information with third parties at your request.

Special Category Health Data

We process health information under:

Article 9(2)(h) UK GDPR
Processing is necessary for the provision of healthcare, treatment and health management services.

Schedule 1, Part 1, Paragraph 2 of the Data Protection Act 2018
Processing for health or social care purposes by a health professional.

Where required, we may also rely on your explicit consent.

How We Use Your Information

We use your information to:

• Assess,  diagnose and treat your condition
• Maintain  accurate clinical records
• Manage  appointments and communicate with you
• Process payments and maintain financial records
• Liaise with healthcare professionals involved in your care
• Produce reports requested by you
• Meet legal, regulatory and professional obligations
• Improve our services and patient experience
• Defend legal claims where necessary
• Send marketing communications where you have consented.

AI-Assisted Clinical Documentation

Advance Physiotherapy may use AI-assisted clinical documentation tools such as 'Heidi' or 'PatientNotes' to support note-taking and transcription during consultations.

These systems may process personal and health information discussed during your appointment for the sole purpose of producing accurate clinical records.

We ensure that any AI-supported systems used are subject to appropriate contractual, technical and organisational safeguards and comply with applicable data protection requirements.

If you would prefer AI-assisted documentation not to be used during your consultation, please inform your physiotherapist at the beginning of your appointment.

Sharing Your Information

We will only share your information where necessary, lawful and proportionate.

Recipients may include:

• Your GP
• Consultants and other healthcare professionals involved in your care
• Private medical insurers
• Employers where you have provided authority
• Professional advisers such as accountants or legal advisers
• Regulatory bodies including the HCPC
• IT and software providers who process data on our behalf
• Government authorities, courts or law enforcement agencies where required by law

All third-party providers are required to maintain appropriate confidentiality and security standards.

We do not sell personal information to third parties.

International Data Transfers

Some of our software providers, cloud-based systems or technology partners may process information outside the United Kingdom. Where personal information is transferred internationally, we will ensure appropriate safeguards are in place, including:

• Adequacy Regulations approved by the UK Government
• International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses approved for UK use
• Other legally recognised safeguards

We take reasonable steps to ensure your information receives an equivalent level of protection wherever it is processed.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory and professional requirements.

As a general guide:

• Adult clinical records are typically retained for a minimum of eight years after the conclusion of treatment.
• Records relating to children are typically retained until the patient's 25th birthday (or longer where required by law or professional guidance).
• Financial records may be retained for up to seven years to comply with tax and accounting obligations.
• Marketing consent records are retained until consent is withdrawn.

Retention periods may be extended where there is an ongoing legal claim, complaint or regulatory investigation.

Data Security

We take appropriate technical and organisational measures to protect personal information from accidental loss, unauthorised access, disclosure, alteration or destruction.

These measures include:

• Secure electronic record systems
• Password  protection and access controls
• Encrypted communications where appropriate
• Staff confidentiality obligations
• Regular security reviews and updates

While we take reasonable steps to protect your information, no system can be guaranteed to be completely secure.

Website Cookies and Analytics

Cookies

Our website may use cookies and similar technologies to improve functionality and user experience.

Cookies are small text files stored on your device that help websites operate effectively and remember preferences.

Cookies may be used to:

• Enable website functionality
• Improve website performance
• Remember user preferences
• Analyse website traffic and usage

You can manage or disable cookies through your browser settings. Please note that some website features may not function correctly if cookies are disabled.

Analytics

We may use website analytics services to understand how visitors use our website.

Analytics information may include:

• Pages visited
• Time spent on the website
• Browser and device information
• General geographic location
• Referral sources

This information is generally aggregated and anonymised and is used to improve website performance and user experience. Where required by law, analytics cookies will only be used with your consent.

Third-Party Websites and Links

Our website may contain links to third-party websites, social media platforms or external services for your convenience and information.

Please note that this Privacy Policy applies solely to Advance Physiotherapy and does not extend to any third-party websites, services or organisations. We have no control over, and accept no responsibility for, the privacy practices, content or security of external websites.

We encourage you to review the privacy policies of any third-party websites you visit before providing them with your personal information.

Marketing Communications

We will only send marketing communications where:

• You have provided consent; or
• We are otherwise permitted to do so under applicable laws.

You may opt out of marketing communications at any time by contacting us or using the unsubscribe facility provided in communications.

Your Rights

Under UK GDPR, you have the right to:

• Access  your personal information
• Request correction of inaccurate data
• Request deletion of personal information in certain circumstances
• Request restriction of processing
• Object to processing based on legitimate interests
• Request data portability where applicable
• Withdraw consent at any time
• Lodge a complaint with the Information Commissioner's Office (ICO)

To exercise any of these rights, please contact us using the details below.

Complaints and Keeping Your Information Up to Date

If you have any concerns about how we process your personal information, please contact us first and we will do our best to resolve them.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection. Advance Physiotherapy is registered with the ICO (Registration No. ZB928082).

Please let us know if your personal information changes during your relationship with us so that we can keep our records accurate and up to date.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in legislation, guidance or our services.

The most recent version will always be available on our website.

Last Updated: July 2026