1. Who we are
Pro-Form Physio is the trading name of Pro-Form Physio & Fitness Ltd, company number 09808752. Our registered address is 58 Cumberland Drive, Bexleyheath, DA7 5LB. We operate physiotherapy services in Bexleyheath and Blackheath and are the data controller for the personal information covered by this notice. Contact: info@proformphysiofitness.co.uk. Website: www.proformphysiofitness.co.uk.
2. The law and who this notice covers
We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended including by relevant provisions of the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended, where applicable. Patient information is also protected by the common law duty of confidentiality and applicable professional obligations.
This notice covers patients, prospective patients, website visitors, people making enquiries, subscribers, referrers and applicants for roles at our clinics. A separate workforce notice should be provided to staff and self-employed clinicians.
3. Information we collect and where it comes from
We may collect identity and contact details, date of birth, emergency contact, appointment and correspondence records, invoices and payment status, insurer and authorisation details, and information needed to provide care. Clinical records may include medical history, symptoms, assessments, examination findings, treatment, rehabilitation plans, reports and correspondence with other healthcare professionals.
We receive information from you and, where relevant, referring clinicians, healthcare providers and insurers.
Website use may provide enquiry details, IP address, device and browser information and cookie preferences. For recruitment we receive CVs through Indeed, responses through Google Forms, qualifications, HCPC registration details, availability, interview assessments and references where appropriate. Payment providers process card transactions; we do not normally hold complete card numbers ourselves.
4. Why we use information and our legal bases
Bookings, care administration and payments: to arrange appointments, deliver the service, communicate about care and administer fees. Depending on the activity, we rely on performance of a contract, legitimate interests or a legal obligation under UK GDPR Article 6.
Clinical care: to assess, treat, document care, support safe continuity and communicate with relevant professionals or insurers where appropriate. We identify an Article 6 lawful basis for each purpose, commonly contract, legitimate interests or legal obligation. Health information also requires a separate special category condition, generally Article 9(2)(h) UK GDPR for healthcare, together with Article 9(3) confidentiality safeguards and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Other bases or conditions, including legal claims, may apply to particular circumstances. Consent to treatment or to share confidential information is distinct from data protection consent.
Recruitment: to review applications, assess suitability, arrange interviews, check professional registration and make hiring decisions. Relevant Article 6 bases may include legitimate interests, steps before entering a contract and legal obligations. Where an applicant provides health information to request reasonable adjustments, we restrict its use and identify the appropriate Article 9 condition, which may include employment law obligations under Article 9(2)(b) and the applicable Schedule 1 condition. We do not ask applicants to provide unnecessary health information.
Other purposes: to respond to enquiries, address complaints, manage legal claims, meet tax and professional duties, protect clinic premises and systems, and send permitted marketing. We do not sell personal information.
5. Sharing and service providers
Access is limited to those who need information for their role. Where appropriate and lawful, we may share relevant information with treating or referring healthcare professionals, consultants, insurers and claims administrators, emergency services, regulators, professional advisers and debt recovery providers. Confidential patient information is shared in accordance with professional confidentiality requirements and consent or another appropriate justification.
Providers supporting our operations include Jane App for practice management, Mailchimp for marketing, Indeed and Google Forms for recruitment, payment and banking providers, website and email hosting, communications providers and Tapo CCTV services. These providers have access only as relevant to their services, subject to appropriate arrangements. The list may change as our systems change.
6. Communications and marketing
We send necessary appointment reminders, booking information and care-related communications separately from promotional messages. Marketing emails are sent through Mailchimp where permitted by PECR and data protection law, using consent or the applicable existing customer rules. Marketing messages include an unsubscribe option. Jane App may synchronise eligible subscriber details and preferences with Mailchimp; you may unsubscribe at any time. We keep minimal suppression information where needed to honour opt-outs.
Where appropriate, patients can contact us by email, telephone or WhatsApp, including questions about treatment between appointments. Please avoid sending sensitive or urgent information through general messaging channels. Relevant clinical advice or decisions received through these channels should be added to the clinical record. WhatsApp is not an emergency service.
7. Recruitment applicants
To apply for a physiotherapy role, applicants may be asked to submit both a CV through Indeed and a separate Google application form. We use this information, interview notes and any checks to assess suitability and contact candidates. Access is restricted to people involved in recruitment and relevant platform providers. Application data is not used for patient marketing. Unsuccessful applications are normally deleted six months after the recruitment decision, unless there is a legitimate reason to retain them longer, such as a dispute, or the applicant agrees to be considered for future vacancies. Successful candidates receive separate workforce privacy information.
8. CCTV at our clinics
Tapo cameras are used in designated clinic areas for premises security, prevention and investigation of incidents, and protection of staff, visitors and property. Our usual Article 6 basis is legitimate interests. CCTV signs are displayed. Footage is accessible only to authorised persons and is normally retained for up to 30 days, unless needed for an incident, complaint, investigation or legal matter. CCTV should not be used in treatment rooms, toilets or changing areas. We may share relevant footage with police, insurers or other parties where lawful and necessary.
9. How long we retain information
We use the following clinic retention schedule, subject to any longer period reasonably required by an ongoing claim, safeguarding matter, professional duty or other legal requirement:
| Record category | Retention approach |
|---|---|
| Adult clinical records | At least 8 years after the last treatment or contact. |
| Children’s clinical records | Until the patient’s 25th birthday, or 8 years after the last treatment or contact, whichever is later. Review exceptional cases individually. |
| Accounting and tax records | Normally 6 years after the end of the relevant financial year, or longer if required by applicable rules or an active dispute. |
| General enquiries without treatment | Normally 12 months after the last meaningful contact. |
| Unsuccessful recruitment applications | Normally 6 months after the recruitment decision. |
| Routine CCTV footage | Up to 30 days unless required for an incident or investigation. |
| Marketing subscriber records | While subscribed; retain limited suppression records as needed to respect an opt-out. |
| Complaints and legal matters | For the period necessary to resolve the matter and address applicable limitation or regulatory requirements. |
We securely delete, anonymise or archive information with restricted access when its retention period expires. These are our clinic’s adopted periods; particular statutory or professional requirements may require a different period in individual cases.
10. Security and international processing
We apply proportionate measures including restricted access, account security, confidentiality requirements and appropriate service provider controls. Some cloud services may store or allow access to information outside the UK even where our clinics operate only in the UK. Where restricted international transfers occur, we rely on applicable UK adequacy regulations or other appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, as relevant. We review provider arrangements rather than assuming that using a UK clinic means all processing stays in the UK.
11. Cookies and website technology
Our website may use strictly necessary cookies and, depending on its live configuration, analytics, advertising or other optional technologies. Where PECR requires consent for non-essential cookies or similar technologies, we will seek that consent before using them and provide a way to change preferences. Details of the cookies actually in use should be shown in the website cookie information and consent settings.
12. Your data protection rights
Subject to applicable conditions and exemptions, you may request access, correction, erasure, restriction, portability or object to certain processing. Where consent is the lawful basis, you may withdraw it without affecting earlier lawful use. Clinical records cannot always be erased on request because of our continuing duties. Contact info@proformphysiofitness.co.uk. We may verify identity before responding. You can complain to the Information Commissioner’s Office at www.ico.org.uk; we welcome the opportunity to address your concern first.
13. Changes to this notice
We review this notice when our services, technology or legal obligations change. The current version will be published on our website.