Privacy Policy

We may collect and process the following categories of personal data: Identity information: name, date of birth, gender. Contact information: postal address, phone number, email. Health information (special category data): medical history, treatment notes, referral letters, test results, and other details necessary to provide physiotherapy services. Financial information: billing details and payment records (we do not store full card details). Technical and website usage data: IP address, browser type, and cookie data (if applicable).

We process your personal data for the following purposes: To provide physiotherapy treatment and healthcare services. To arrange and confirm appointments. To maintain accurate medical records. To process payments and manage accounts. To meet our legal, professional, and regulatory obligations. To improve the quality of our services.

Under the UK GDPR, we rely on the following lawful bases to process your personal data: Consent – when you give explicit permission (e.g., sharing information with another healthcare professional). Contract – where processing is necessary for providing our services. Legal obligation – to comply with healthcare, tax, or regulatory requirements. Legitimate interests – to run our business effectively, provided your rights are not overridden. For special category health data, we process this under: Article 9(2)(h) UK GDPR – necessary for medical diagnosis, provision of health or social care, or treatment by a health professional bound by confidentiality.

We keep your personal data only as long as necessary: Medical records are retained in line with NHS and Chartered Society of Physiotherapy (CSP) guidance — typically at least 8 years after your last treatment, or until the patient is 25 years old (if treated as a child), whichever is longer. Financial records are retained for 6 years for tax and accounting purposes.

We take appropriate technical and organisational measures to protect your data, including: Secure electronic record systems with password protection. Encrypted storage where appropriate. Limited access to authorised personnel only. Confidentiality obligations for all staff and contractors.

We will not sell or rent your data. We may share your information with: Other healthcare professionals directly involved in your care (with your consent). Insurance companies, health schemes, or funding bodies (if applicable). Regulators, auditors, or legal authorities when required by law. IT and system providers who support our clinic operations (bound by strict confidentiality agreements).

Under the UK GDPR, you have the right to: Access the data we hold about you. Request correction of inaccurate or incomplete information. Request erasure of your data, where legally possible. Restrict processing in certain circumstances. Object to processing where it is based on legitimate interests. Request data portability (transfer to another provider). Withdraw consent at any time (where processing is based on consent). To exercise these rights, please contact us using the details below.

If our website uses cookies, these may collect limited information to improve your browsing experience. You can manage or block cookies through your browser settings.

If you have concerns about how we handle your data, please contact us first. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk

For questions about this Privacy Policy or your data rights, please contact:

Snježana Škorić Trading as SDM Physio
149 Carslake Road, Putney, London
+44 7380414299
hello@sdmphysio.co.uk