Privacy of your data is very important to us.
Any personal data collected will only be used as permitted by law and our privacy policy is based on the General Data Protection Regulation and The Data Protection Act.
This notice explains how we collect, use, store and share personal information – whether you are visiting our website, making an enquiry, or receiving treatment as a patient.
Contents
- Who we are and how to contact us
- Website visitors and enquiries
- Patients – information about your care
- CCTV
- Who we share information with
- How long we keep information
- How we keep information secure
- Your rights
- Complaints
- Changes to this notice
1. Who we are and how to contact us
This website and practice are owned and run by Elite Sporting Performance Company number: SC00065. Registered address: ESP Physio, 5 Station Road, Grangemouth, FK3 8DG
Elite Sporting Performance is the data controller for all the personal information described in this notice.
For any question about privacy or your personal information, contact:
Data Protection Lead: Mark McKenzie Email: mark@espphysio.com Telephone: 01324 227370 Post: ESP Physio, 5 Station Road, Grangemouth, FK3 8DG
2. Website visitors and enquiries
What we collect
If you complete our contact form, we collect your name, company name (if given), email address and telephone number.
We also use cookies to collect analytics data: how you arrived at our site, which pages you visited, how long you spent on them and where you left.
Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry | Legitimate interests — answering a request you have made to us |
| Sending marketing emails to prospective and existing customers | Consent, or the soft opt-in for existing customers |
| Website analytics | Consent, given through our cookie banner |
You can unsubscribe from marketing at any time using the link in any email, or by contacting us. If you are a patient, withdrawing marketing consent has no effect on your care.
How long we keep it
We keep enquiry correspondence while your enquiry is live and delete it once the enquiry is closed. If you become a patient, relevant correspondence is kept as part of your record (see section 6).
3. Patients — information about your care
What we hold
Depending on your care, we may hold:
- Name, date of birth, address, telephone number and email address
- Emergency contact details
- Details of your GP and, where relevant, other clinicians involved in your care
- Your presenting condition, symptoms, medical history and relevant lifestyle information
- Clinical assessment findings, treatment plans, progress notes and outcome measures
- Referral letters, and correspondence and reports from consultants, GPs and other healthcare professionals
- Imaging and test results provided to us
- Consent records
- Appointment and attendance history
- Payment and invoicing records, and where applicable your insurer and policy details
Information about your health is special category data under data protection law and is subject to additional protections.
Why we use it, and our legal basis
| Purpose | Article 6 basis | Article 9 condition (health data) |
|---|---|---|
| Providing and managing your physiotherapy care, including assessment, treatment, record-keeping and clinical correspondence | Contract | Art 9(2)(h) — health care and treatment, and management of health care services |
| Communicating with you about appointments | Contract | Art 9(2)(h) |
| Liaising with your GP, consultant, insurer or other clinicians involved in your care | Contract / Legitimate interests | Art 9(2)(h), or Art 9(2)(a) explicit consent where the disclosure is not necessary for your care |
| Invoicing, payment and accounts | Contract / Legal obligation | Not applicable — no health data used |
| Meeting our legal and regulatory obligations, including professional record-keeping standards | Legal obligation | Art 9(2)(h) |
| Handling complaints, and establishing or defending legal claims | Legitimate interests | Art 9(2)(f) — legal claims |
| Service improvement and internal audit | Legitimate interests | Art 9(2)(h) |
Where we rely on Article 9(2)(h), the processing is carried out by, or under the responsibility of, people who owe a duty of confidentiality.
Our processing of special category data under Article 9(2)(h) and Schedule 1 of the Data Protection Act 2018 is governed by our Appropriate Policy Document, which is available on request.
Who within the practice can see your record
Access is limited to those who need it to do their job, and our practice management system applies role-based access controls.
- Clinical staff access your full record for the purpose of assessing and treating you.
- Administrative staff access your record in order to book and manage appointments, take payments and invoice, and to receive, check, file and action clinical correspondence. This includes referral letters and letters and reports from consultants, which necessarily contain information about your condition. This administrative work cannot be carried out without the person doing it being able to see these documents.
All staff, clinical and administrative, are bound by a contractual duty of confidentiality, receive data protection training, and may only access records where it is necessary for their role. Access is logged. Misuse of patient information is a disciplinary matter.
Records of patients who are no longer in active treatment are archived so that they are not routinely visible in day-to-day use of the system.
4. CCTV
We operate CCTV at our Grangemouth and Stirling clinic reception and gym areas for the safety and security of patients, staff and property. Our legal basis is legitimate interests.
There is no CCTV in treatment rooms or changing areas. Footage is held for 14 days on a secure system and then automatically deleted. Our full CCTV Policy is available on request.
5. Who we share information with
We share personal information only where it is necessary and lawful:
- Your GP, consultant or other healthcare professionals involved in your care — where necessary for your treatment, or with your consent
- Your insurer or the third party funding your treatment — where you have asked us to invoice them or they have requested a report, with your knowledge
- Our practice management software provider, Cliniko — acting as our processor, hosting your record on our behalf.
- Our accounts and invoicing system provider — invoicing data only
- Our IT support provider — where necessary to resolve a technical issue, under confidentiality obligations
- Our email marketing provider, and the company that requests reviews on our behalf — contact details only; no health information is shared
- Analytics providers — website usage data only
- Our insurers and legal advisers — in the event of a claim or complaint
- Regulators, courts or other bodies — where we are required to do so by law
- A purchaser — if the practice is sold or transferred, on the same basis as set out here
All our processors are bound by written contracts requiring them to keep information secure and to use it only on our instructions.
We do not sell your information, and we do not share it with third parties for their own marketing purposes.
6. How long we keep information
[All clinical retention periods must be confirmed against current Chartered Society of Physiotherapy record-keeping guidance and Scottish Government retention schedules before this notice is published. The figures below are placeholders.]
| Record type | Retention period |
|---|---|
| Adult clinical records | Indefinitely but archived |
| Clinical records, patients under 18 | Indefinitely but archived |
| Financial and invoicing records | 6 years from the end of the relevant financial year |
| Enquiry correspondence where no treatment follows | 12 months |
| Complaint records | 2 years from resolution |
| CCTV footage | 14 days |
| Marketing contact details | Until you withdraw consent |
7. How we keep information secure
Records are held on a secure, access-controlled practice management platform. Measures include individual user accounts, role-based permissions, access logging, encryption in transit and at rest, and regular backups. All paper documents are scanned into the digital system and then shredded where appropriate. Staff receive data protection and confidentiality training.
8. Your rights
You have the right to:
- Be informed about how we use your information — this notice
- Access the information we hold about you (a “subject access request”)
- Rectification of inaccurate or incomplete information. Note that clinical records are a contemporaneous account; where we disagree that an entry is inaccurate, we will record your view alongside it rather than delete it
- Erasure in certain circumstances. This right is limited where we must retain records for healthcare and legal purposes
- Restrict processing in certain circumstances
- Object to processing carried out on the basis of legitimate interests, and to object to direct marketing at any time
- Data portability for information you provided to us, where processing is based on consent or contract and carried out by automated means
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, contact Mark McKenzie using the details in section 1. We will respond within one month. In limited cases this may be extended by up to two further months, and we will tell you if that applies. Requests are free of charge, though we may charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive.
9. Complaints
If you are unhappy with how we have handled your information, please contact Mark McKenzie in the first instance so that we have the opportunity to put things right.
You also have the right to complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk
10. Changes to this notice
We review this notice at least annually and update it when our practices or the law change. Where changes are significant, we will bring them to your attention.
