Privacy Policy

This version is dated July 2026.

1. Who We Are

Women’s Health Physio Ealing is a specialist women’s health physiotherapy practice operated by Vicky Carey, a registered physiotherapist. For the purposes of data protection law, Vicky Carey is the Data Controller.

Contact details:

Practice name: Women’s Health Physio Ealing
Data Controller: Vicky Carey
Address: Pinches Yard, r/o 18-20 The Grove, Ealing, London W5 5LH
Email: vicky@whpe.co.uk
Phone: 07767 948 496

2. What This Notice Covers

This Privacy Notice explains how we collect, use, store and protect your personal information when you use our physiotherapy services, visit our website, or contact us. Please read it carefully. If you have any questions, please contact us using the details above.

3. The Information We Collect

3.1 Health and clinical information

As a healthcare provider, we collect and process special category health data. This includes:

Your name, date of birth, address, and contact details
GP and other healthcare provider details
Medical history, current symptoms, diagnoses, and medication
Clinical assessment findings, treatment notes, and progress records
Information about your reproductive health, pregnancy, or gynaecological history where relevant to your treatment
Any other health information you share with us in the course of your care

3.2 Administrative information

Appointment booking and attendance records
Billing, invoicing, and payment information
Insurance or GP referral details
Communication records (emails, messages, phone calls)

3.3 Website information

Enquiry or contact form submissions
Basic analytics data (pages visited, browser type) — collected anonymously

4. Why We Use Your Information and Our Legal Basis

We only process your personal data when we have a lawful basis to do so. The table below sets out how and why we use your information:

Purpose & Legal Basis for Processing

Purpose: Providing physiotherapy treatment and clinical care

Legal basis: Contract + Legitimate interests + Health care (Art.9(2)(h) UK GDPR)

Purpose: Maintaining clinical records as required by professional standards

Legal basis: Legal obligation + Health care

Purpose: Processing payments and managing billing

Legal basis: Contract

Purpose: Communicating with you about appointments and care

Legal basis: Contract + Legitimate interests

Purpose: Sharing information with your GP or other healthcare providers (with your consent)

Legal basis: Consent + Health care

Purpose: Complying with legal, regulatory, or professional body obligations

Legal basis: Legal obligation

Purpose: Responding to complaints or legal claims

Legal basis: Legal obligation + Legitimate interests

5. Special Category Data

Health information is ‘special category’ data under UK GDPR, which means it attracts a higher level of protection. We process your health data on the basis of Article 9(2)(h) — for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, and treatment.

We take our obligations in relation to this data very seriously and apply appropriate technical and organisational safeguards at all times.

6. How Long We Keep Your Information

We retain clinical records in accordance with the guidance issued by the Chartered Society of Physiotherapy (CSP) and relevant NHS and professional body standards. Different retention periods apply for different types of data:

Adult patient records: 8 years from the end of treatment
Records relating to children: Until the patient’s 25th birthday (or 26th if treatment ended when the patient was 17)
Records relating to mental health: 20 years, or 8 years after death
Deceased adults: 8 years from the date of death
Financial and billing records are kept for 6 years in line with HMRC requirements. After the relevant retention period, records are securely destroyed.

We will not retain your data for longer than necessary for the purposes set out in this policy.

We will securely destroy your personal information in accordance with our data

obligations. All digital data (including emails and electronic copies of

documents) may be retained on our servers.

7. Who We Share Your Information With

We do not sell your personal data. We may share your information only in the following circumstances:

With your GP or other treating healthcare professionals, where clinically necessary and with your knowledge
With your insurance provider, where you have asked us to process a claim on your behalf
With a locum or covering physiotherapist, to ensure continuity of your care
With our software or administrative service providers (e.g. practice management software), who process data on our behalf under strict data processing agreements
Where required by law, regulation, or a court order
With regulatory or professional bodies (e.g. HCPC, CSP) in the event of a complaint or investigation
With our bank and accounting services

Any third parties we share data with are required to keep it confidential and use it only for the specific purpose for which it was shared.

8. Data Security

We take the security of your personal information seriously. We use a combination of technical and organisational measures to protect your data, including:

Secure, password-protected practice management software with encrypted data storage
Encrypted email where sensitive information is being communicated electronically
Physical security of paper records (locked filing, restricted access)
Regular review of our data handling practices

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will inform you directly where required.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you
Right to rectification — to ask us to correct inaccurate or incomplete data
Right to erasure — to ask us to delete your data (subject to our legal obligations to retain clinical records)
Right to restrict processing — to ask us to limit how we use your data in certain circumstances
Right to data portability — to receive your data in a commonly used, machine-readable format
Right to object — to object to processing based on legitimate interests
Rights related to automated decision-making — we do not use automated decision-making or profiling

To exercise any of these rights, please contact us in writing at the address or email above. We will respond within one month. You will not be charged for making a request, though we may charge a reasonable fee if requests are manifestly unfounded or excessive. Please note that the rights may be subject to exemptions under the Data Protection Act 2018

10. Consent

Where we rely on your consent to process your personal data (for example, when sharing information with a third party not involved in your direct care), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

11. Complaints

If you are unhappy with how we have handled your personal data, please contact us in the first instance so we can try to resolve the matter.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ICO registration number for Women’s Health Physio Ealing is ZC185231

12. Cookies and Website Data

Our website may use cookies to improve your experience. We use analytics tools to understand how visitors use the site — this data is collected anonymously and does not identify you personally. You can manage cookie preferences through your browser settings.

13. Changes to This Notice

We may update this Privacy Notice from time to time. The most current version will always be available on our website and in the practice. The version date is shown at the top of this document.