Privacy Policy

Privacy Policy

Last updated: 09/10/2026

1. About this Privacy Policy

This Privacy Policy explains how Natalie Richardson Physiotherapy ("we", "us" or "our") collects, uses, stores and protects your personal information when you:

visit our website;
contact us by telephone, email or through our online contact form;
request or book an appointment;
receive physiotherapy or other healthcare services from us;
provide information as part of your treatment;
communicate with us about your treatment; or
otherwise interact with our practice.

We are committed to protecting your privacy and handling your personal information lawfully, fairly and transparently.

This Privacy Policy is intended to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as applicable to our processing activities.

2. Who is responsible for your information?

The data controller responsible for your personal information is:

Natalie Richardson Physiotherapy
12 Watchouse Road
07919344774
natalie@nrphysiotherapy.co.uk

For data protection enquiries, please contact:

Natalie Richardson

07919344774
natalie@nrphysiotherapy.co.uk

3. What personal information do we collect?

Depending on how you interact with us, we may collect:

Identity and contact information

name;
date of birth;
address;
telephone number;
email address;
emergency contact details; and
other information necessary to identify or communicate with you.

Appointment and administrative information

appointment dates and times;
appointment history;
referral information;
payment and invoicing information;
insurance or funding information; and
correspondence with you.

Health and treatment information

As a physiotherapy practice, we may process information concerning your physical or mental health, including:

medical history;
symptoms and presenting condition;
previous injuries or illnesses;
diagnoses;
treatment history;
medications where relevant to your treatment;
clinical assessments;
examination findings;
treatment plans;
progress and outcomes;
information received from other healthcare professionals; and
other information necessary to provide safe and appropriate physiotherapy care.

Health information is special category data under UK data protection law and receives additional protection.

Website and technical information

When you use our website, we may collect information such as:

IP address;
browser and device information;
pages visited;
approximate location derived from IP address;
website usage information; and
information collected through cookies or similar technologies.

Please see our Cookie Policy for further information about cookies and similar technologies.

4. How and why we use your information

We only use personal information where we have a lawful basis to do so.

We may use your information to:

Purpose

Personal information

Lawful basis

Respond to enquiries

Name, contact details and enquiry information

Legitimate interests and/or steps at your request before entering into a contract

Arrange and manage appointments

Identity, contact and appointment information

Contract and/or legitimate interests

Provide physiotherapy and healthcare

Identity, health and treatment information

Article 6 lawful basis applicable to the service, together with Article 9(2)(h) health or social care condition where applicable

Maintain clinical records

Health and treatment information

Legal/healthcare obligations and/or Article 9(2)(h), as applicable

Communicate with you about your care

Contact and treatment information

Contract, legitimate interests and/or healthcare purposes

Process payments

Identity, payment and transaction information

Contract and legal obligations

Manage accounts and financial records

Identity and financial information

Legal obligations and legitimate interests

Respond to complaints or legal matters

Relevant personal and clinical information

Legal obligations and legitimate interests

Improve our services

Relevant service and usage information

Legitimate interests, where applicable

Meet professional, regulatory and legal requirements

Relevant personal and clinical information

Legal obligations and/or legitimate interests

Protect the security of our website and systems

Technical and usage information

Legitimate interests and legal obligations

Send marketing communications, where applicable

Contact information

Consent and/or another lawful basis permitted by applicable electronic marketing rules

The exact lawful basis may depend on the circumstances and the particular processing activity.

The ICO requires privacy information to explain the purposes for processing and the relevant lawful basis.

5. Health information and special category data

Because we provide physiotherapy services, some of the information we process is information concerning health.

Health information is special category data. Processing it requires both an appropriate Article 6 lawful basis and an Article 9 condition under the UK GDPR. For healthcare providers, the health or social care condition under Article 9(2)(h) may apply where its requirements are met.

We only collect and use health information where it is necessary and appropriate for purposes such as providing healthcare, maintaining clinical records, complying with legal or professional requirements, managing your care and protecting patients.

We aim to follow the principles of data minimisation and only collect information that is relevant and necessary for the purpose for which it is being processed.

6. Where we obtain your information

We may obtain personal information:

directly from you;
when you complete a website or appointment form;
during consultations;
by telephone, email or other communication;
from another healthcare professional or organisation involved in your care;
from an insurer, employer or other organisation where appropriate;
from a person acting on your behalf; or
automatically through your use of our website, including through cookies where applicable.

Where we receive personal information from another source, we will provide the privacy information required by applicable data protection law unless an exemption applies.

7. Who we may share your information with

We may share relevant personal information where necessary and lawful with:

healthcare professionals involved in your care;
your GP or other healthcare providers, where appropriate;
insurers or organisations funding your treatment;
organisations that have referred you to us;
professional advisers, such as accountants, solicitors or insurers;
IT, website hosting, booking, clinical-record or other service providers acting on our behalf;
payment service providers;
regulators or professional bodies where required;
government authorities, courts or law enforcement agencies where legally required; and
other persons where you have provided appropriate consent or disclosure is otherwise lawful.

We will only share information that is relevant and necessary for the particular purpose.

We will not sell your personal or health information.

8. Confidentiality

We understand the importance of confidentiality in healthcare.

Access to clinical information is restricted to people who need the information to provide care, administer our services or fulfil another lawful function.

We use appropriate technical and organisational measures to protect health information because of its sensitivity. The ICO specifically highlights the need for appropriate security measures and access controls when handling health information.

9. Service providers and data processors

We may use third-party organisations to provide services such as:

website hosting;
appointment booking;
clinical record management;
secure communication;
payment processing;
IT support;
email services; and
data storage.

Where a third party processes personal information on our behalf, we will take appropriate steps to ensure that the processing is governed by appropriate contractual and data protection requirements.

10. Transfers outside the UK

Some of our service providers may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable UK data protection law and that appropriate safeguards are in place where required.

These safeguards may include an adequacy regulation or appropriate contractual safeguards.

11. How we protect your information

We use appropriate technical and organisational measures to protect personal information against:

unauthorised access;
accidental loss;
destruction;
alteration;
disclosure; and
other unlawful or unauthorised processing.

Measures may include access controls, passwords, encryption where appropriate, secure systems, staff confidentiality requirements, backups and appropriate policies and procedures.

Because clinical information is particularly sensitive, access is limited on a need-to-know basis.

12. How long we keep your information

We retain personal information only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, professional, accounting and reporting requirements.

Clinical records may need to be retained for longer than ordinary website or enquiry information.

Our retention periods are determined by the nature of the information, the purpose for which it is processed, applicable legal and professional requirements, and our records retention policy.

Examples include:

Website enquiries: [0 days]
Appointment/admin records: [10 years]
Clinical records: [8 years]
Financial records: [6 years]
Marketing information: until you withdraw consent or otherwise in accordance with our marketing retention procedures.

When information is no longer required, we will securely delete it or anonymise it where appropriate.

The ICO expects organisations to tell individuals how long information will be kept, or the criteria used to determine the retention period.

13. Your data protection rights

Subject to certain legal conditions and exemptions, you may have the right to:

request access to your personal information;
request correction of inaccurate or incomplete information;
request erasure of your personal information;
request restriction of processing;
object to certain processing;
request transfer of certain information to you or another organisation; and
withdraw consent where processing is based on consent.

Some rights are not absolute and may not apply in every circumstance.

For example, the right to erasure does not necessarily mean that a healthcare provider must delete clinical records where there is a continuing legal or professional reason to retain them.

The ICO confirms that individuals generally have a right to obtain a copy of their personal information and supplementary information about how it is processed.

14. How to exercise your rights

To exercise your rights, please contact:

Natalie Richardson
natalie@nrphysiotherapy.co.uk

You do not normally have to pay a fee to exercise your data protection rights.

We may need to verify your identity before providing personal information or making changes to your records.

We will respond within the timeframe required by applicable data protection law.

15. Access to your health records

You have rights of access to your health information, subject to applicable legal provisions and exemptions.

If you ask us for a copy of your records, we will deal with your request in accordance with applicable subject access requirements.

The ICO's guidance confirms that health information falls within the right of access, subject to specific rules and exemptions.

16. Accuracy of your information

We aim to keep personal information accurate and up to date.

If you believe that information we hold about you is inaccurate or incomplete, please contact us so that we can investigate and, where appropriate, correct the information.

17. Cookies and website analytics

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function. Other cookies, such as analytics or advertising cookies, may require your consent depending on how they operate and the applicable rules.

Please see our Cookie Policy for information about:

the cookies we use;
their purposes;
who places them;
how long they remain on your device; and
how you can manage your preferences.

18. Marketing

We may occasionally wish to send information about our services, news or relevant updates.

Where consent is required, we will ask for consent before sending marketing communications.

You can unsubscribe or withdraw your consent at any time by contacting us or using the unsubscribe mechanism included in the communication.

Withdrawing consent will not affect processing that took place before consent was withdrawn.

19. Automated decision-making and profiling

We do not currently make decisions about patients based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will update this Privacy Policy and provide any information required by applicable data protection law.

20. Children

Our services may be provided to children or young people.

Where we process information about a child, we will apply appropriate safeguards and take account of the child's age, understanding and circumstances.

Where appropriate, we may communicate with a parent, guardian or other person with lawful authority to act on the child's behalf.

21. Data breaches

We have procedures for identifying, managing and responding to personal data breaches.

Where a breach is likely to result in a risk to individuals' rights and freedoms, we will assess whether it must be reported to the Information Commissioner's Office and whether affected individuals need to be informed.

22. Complaints

If you have concerns about how we have used your personal information, please contact us first so that we can investigate and attempt to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

You can find information about making a complaint on the ICO's website:

Information Commissioner's Office (ICO)

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or data protection practices.

The latest version will always be published on our website, together with the date on which it was last updated.

24. Contact us

If you have any questions about this Privacy Policy or how we process your personal information, please contact:

Natalie Richardson Physiotherapy
07938 401606
natalie@nrphysiotherapy.co.uk
www.nrphysiotherapy.co.uk

Data protection contact: Natalie Richardson - Owner

Last updated: 09/10/2026