Privacy Policy

1. Introduction

Blissful Physiotherapy ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are the data controller responsible for your personal data. If you have any questions about this policy, please contact us using the details provided at the end of this document.

2. Information We Collect

2.1 Personal Information

We may collect the following personal information:

• Name, date of birth, and gender
• Contact details (email address, phone number, postal address)
• Emergency contact information
• Insurance information
• Payment and billing information

2.2 Medical Information

As a healthcare provider, we collect sensitive medical information including:

• Medical history and current health conditions
• Treatment records and progress notes
• Medication information
• Test results and assessments
• GP and other healthcare provider details

2.3 Website Usage Data

When you visit our website, we may automatically collect:

• IP address and device information
• Browser type and version
• Pages visited and time spent on site
• Referring website
• Cookie data

3. How We Use Your Information

We use your personal information for the following purposes:

3.1 Healthcare Provision

• To provide physiotherapy treatment and care
• To maintain accurate medical records
• To coordinate care with other healthcare providers
• To monitor and improve treatment outcomes

3.2 Administrative Purposes

• To manage appointments and bookings
• To process payments and insurance claims
• To send appointment reminders and updates
• To respond to inquiries and requests

3.3 Legal and Compliance

• To comply with legal and regulatory requirements
• To defend or exercise our legal rights
• To investigate and prevent fraud

3.4 Communication

• To send service-related communications
• To provide health and wellness information (with consent)
• To conduct patient satisfaction surveys

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: For processing sensitive medical data and marketing communications
• Contract: To fulfill our contractual obligations to provide services
• Legal obligation: To comply with healthcare regulations and legal requirements
• Legitimate interests: For administrative purposes and service improvement
• Vital interests: To protect your health and safety in emergency situations

5. Data Sharing and Disclosure

We may share your information with:

• Your GP and other healthcare providers (with your consent)
• Insurance companies for claims processing
• Legal and regulatory authorities when required by law
• Professional advisors (accountants, lawyers, auditors)
• Service providers who assist with our operations (subject to confidentiality agreements)

We will never sell your personal data to third parties.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Secure IT systems with encryption and firewalls
• Restricted access to personal data on a need-to-know basis
• Staff training on data protection and confidentiality
• Regular security assessments and updates
• Secure physical storage of paper records

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal requirements:

• Medical records: 8 years after last treatment (or until age 25 for children)
• Billing and payment records: 6 years for tax purposes
• Marketing consent records: Until consent is withdrawn
• Website analytics: 26 months

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request copies of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data (subject to legal requirements)
• Right to restrict processing: Request limitation on how we use your data
• Right to data portability: Request transfer of your data to another provider
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time

To exercise any of these rights, please contact us using the details provided below.

9. Cookies and Tracking

We use cookies and similar technologies to enhance your experience on our website. For detailed information about the cookies we use, please see our Cookie Policy.

• Essential cookies: Required for website functionality
• Analytics cookies: Help us understand how visitors use our site
• Marketing cookies: Used to deliver relevant advertisements

You can manage your cookie preferences through our cookie consent banner or your browser settings.

10. Children's Privacy

When providing treatment to children under 16, we obtain consent from parents or guardians for processing their personal data. We retain pediatric medical records until the patient reaches age 25 in accordance with healthcare regulations.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the updated policy on our website with a new "Last Updated" date.

12. Complaints

If you have concerns about how we handle your personal data, please contact us first. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):