PRIVACY NOTICE
The Preparatory Physio
Last updated: August 2026
1. About this Privacy Notice
The Preparatory Physio respects your privacy and is committed to protecting the personal information you provide to me.
This Privacy Notice explains what personal information I collect, why I collect it, how I use and protect it, who I may share it with, how long I keep it and what rights you have in relation to your information.
This notice applies to information collected when you:
• visit The Preparatory Physio website;
• contact me with an enquiry;
• book or attend a physiotherapy appointment;
• receive physiotherapy treatment or rehabilitation;
• make a payment; or
• communicate with me in relation to your care.
I aim to handle your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, applicable healthcare and professional requirements, and guidance issued by the Information Commissioner's Office (ICO), the Health and Care Professions Council (HCPC) and the Chartered Society of Physiotherapy (CSP).
2. Who I am
The Preparatory Physio is the private physiotherapy practice of Sorcha Callaghan, a registered physiotherapist regulated by the Health and Care Professions Council (HCPC).
For the purposes of UK data protection legislation, I am the data controller responsible for the personal information I collect and process in connection with The Preparatory Physio.
If you have any questions about how your information is handled, you can contact me at:
The Preparatory Physio
Email: thepreparatoryphysiotherapist@outlook.com
3. What information do I collect?
I only collect information that is relevant and necessary for the purposes described in this Privacy Notice.
Personal and contact information
This may include:
• your name;
• date of birth;
• address;
• telephone number;
• email address;
• emergency contact information, where relevant; and
• information you provide when contacting me or making an enquiry.
Physiotherapy and health information
When you receive physiotherapy, I need to collect information relevant to assessing, treating and managing your condition.
This may include:
• your presenting symptoms and reason for seeking treatment;
• relevant medical history;
• previous injuries and treatment;
• relevant medical conditions;
• medication;
• relevant surgical history;
• information about your physical activity, occupation, sport or performance where relevant to your treatment;
• assessment findings;
• clinical observations;
• clinical reasoning and professional judgement;
• treatment provided;
• rehabilitation and exercise programmes;
• your progress and response to treatment; and
• information provided by you or, where appropriate, another healthcare professional involved in your care.
Health information is special category data under the UK GDPR and therefore receives additional protection.
Appointment and administrative information
I may also collect information relating to:
• appointment dates and times;
• appointment history;
• cancellations and missed appointments;
• invoices;
• payment status; and
• other information necessary to administer your care.
Website and technical information
When you visit my website, certain technical information may be collected automatically by the website provider, such as your IP address, browser type, device information and information about how the website is accessed.
The Preparatory Physio does not use Google Analytics, Meta Pixel or advertising/marketing tracking technologies.
4. How do I collect your information?
I may collect information:
• directly from you when you contact me;
• when you complete a booking or patient information form;
• during your physiotherapy consultation;
• through communications with you by email or telephone;
• through my online booking system;
• when you make a payment;
• from another healthcare professional where information is appropriately provided as part of your care; or
• automatically when you use my website, through necessary website technologies such as cookies.
If information about you is obtained from another source, I will provide appropriate privacy information in accordance with data protection requirements.
5. Why do I collect and use your information?
I use your personal information primarily to provide safe, effective and individualised physiotherapy care.
Assess and manage your physiotherapy needs
I use your health information to:
• understand your symptoms and relevant medical history;
• carry out an appropriate physiotherapy assessment;
• use clinical reasoning to identify your physiotherapy needs;
• develop an appropriate treatment and rehabilitation plan;
• provide physiotherapy treatment;
• prescribe and monitor exercise and rehabilitation;
• review your progress; and
• modify your treatment where clinically appropriate.
Maintain your clinical record
I maintain an accurate record of your assessment, treatment and progress as part of my professional responsibilities.
Clinical records are legal documents and are maintained securely in accordance with professional and legal requirements.
Communicate with you about your care
I may use your contact information to:
• confirm or remind you about appointments;
• respond to enquiries;
• discuss your treatment;
• send information relevant to your care;
• send exercise or rehabilitation programmes;
• send invoices; and
• communicate other necessary administrative information.
I do not use your information to send general marketing, newsletters or promotional communications.
Manage appointments and payments
I use your information to arrange and manage appointments, process invoices and administer payments.
Meet legal and professional obligations
I may process and retain information where this is necessary to meet my legal, regulatory, professional, insurance or accounting obligations.
6. What is my lawful basis for processing your information?
Under UK data protection law, I must have a lawful basis for processing personal information.
For the purposes described in this Privacy Notice, the relevant lawful bases may include:
Contract
Where processing is necessary to provide the physiotherapy services you have requested, including arranging and managing your appointments and providing your treatment.
Legitimate interests
Where processing is necessary for the effective administration, management and security of the practice, provided that these interests are not overridden by your rights and interests.
Legal obligation
Where I am required to process or retain information to comply with a legal or regulatory obligation.
Health information
Health information is special category data and therefore requires an additional condition for processing.
For the provision and management of physiotherapy and healthcare, I may rely on the applicable UK GDPR condition relating to the provision of health or social care or treatment.
Consent to physiotherapy treatment is separate from the lawful basis used under data protection law to process your personal and health information.
7. Confidentiality
As a registered physiotherapist, I have a professional responsibility to maintain the confidentiality of information relating to my patients.
Your clinical information will only be accessed or disclosed where there is an appropriate reason to do so.
Where appropriate to your care, I may share relevant information with another healthcare professional involved in your treatment, for example:
• your GP;
• consultant;
• surgeon;
• another physiotherapist;
• another healthcare professional; or
• an insurer where this is relevant and appropriately authorised.
Where possible, I will discuss this with you beforehand.
Information may also be disclosed where I am legally required or permitted to do so, or where disclosure is necessary to protect someone's vital interests or safety.
8. Your clinical records
I maintain electronic clinical records using a secure electronic practice management system.
My clinical records may include:
• your initial assessment;
• relevant medical history;
• examination and assessment findings;
• clinical reasoning;
• diagnosis or working diagnosis where appropriate;
• treatment provided;
• advice and education;
• exercise and rehabilitation programmes;
• progress notes;
• correspondence relating to your care; and
• relevant information received from or shared with other healthcare professionals.
9. Cliniko
I use Cliniko as my electronic practice management and clinical record system.
Cliniko is used to manage appointments and maintain relevant patient and treatment information.
Information held within Cliniko may include your contact details, appointment information, clinical records and other information necessary for the administration and provision of your physiotherapy care.
I use appropriate security measures to protect information held within electronic systems.
10. Heidi Health – AI-assisted clinical documentation
I use Heidi Scribe, an AI-assisted clinical documentation tool, to help transcribe some consultations and prepare clinical notes.
Where I use Heidi during your consultation, I will let you know before using it and ask for your agreement.
Heidi converts the consultation into text and assists in preparing clinical documentation.
Heidi states that audio recordings are not retained and that it stores transcripts and notes as required by the practitioner. Heidi also states that sensitive health information processed through Scribe undergoes pseudonymisation and that patient data is not used to train, develop or improve its AI models. For UK customers, Heidi states that personal information is stored in the UK and processing takes place within the UK or European Economic Area.
Heidi recommends that clinicians seek patient consent before using the service and states that clinicians remain responsible for reviewing and verifying AI-generated notes.
Clinical responsibility
Heidi is used as a documentation aid only.
I remain responsible for your clinical assessment, clinical reasoning, diagnosis where applicable, treatment and clinical decisions.
Any notes generated with the assistance of Heidi are reviewed by me and checked for accuracy before being incorporated into your clinical record.
You can decline the use of Heidi during your consultation and this will not affect your ability to receive physiotherapy treatment.
11. Payment information and Stripe
Payments may be processed using Stripe, an external payment service provider.
Stripe processes payment information on my behalf when you make an online payment.
I do not store your full payment card details.
I may retain information about transactions, invoices and payment status where necessary for the administration of the practice and to meet accounting, tax and legal requirements.
12. Email and communication
I may communicate with you using email or telephone for purposes directly related to your care or the administration of your appointment.
This may include:
• appointment confirmations and reminders;
• responses to enquiries;
• invoices;
• treatment-related information;
• exercise or rehabilitation programmes; and
• other necessary communication relating to your care.
I do not use your email address for general marketing or promotional mailing lists.
13. Website and cookies
The Preparatory Physio website is hosted using Squarespace and uses cookies and similar technologies that are necessary for the operation, security and functionality of the website.
Non-essential cookies are restricted unless you choose to accept them through the website’s cookie banner. You can accept, decline or manage your cookie preferences at any time.
The Preparatory Physio does not use Google Analytics, Meta Pixel, advertising cookies or marketing tracking technologies.
Some third-party services or embedded content used on the website may use cookies or similar technologies. Where applicable, these providers may have their own privacy and cookie policies.
You can also manage or restrict cookies through your browser settings.
14. How I protect your information
I take reasonable and appropriate steps to protect your personal and health information against:
• unauthorised access;
• loss;
• misuse;
• accidental destruction;
• alteration; and
• unauthorised disclosure.
Electronic clinical records are protected using appropriate account security and access controls.
No electronic system or method of transmitting information over the internet can be guaranteed to be completely secure, but I take appropriate steps to minimise the risks.
15. How long do I keep your information?
I retain clinical records for as long as necessary to meet my legal, professional and insurance obligations.
In accordance with current Chartered Society of Physiotherapy record-keeping guidance:
• Adult clinical records are normally retained for eight years from the date of last treatment.
• Records relating to children are normally retained for eight years after their 18th birthday or until they reach 25 years of age.
Other information, such as appointment, payment and administrative records, will be retained for as long as necessary to fulfil the purpose for which it was collected and to meet relevant legal, accounting, tax, insurance or professional requirements.
When information is no longer required, it will be securely deleted or destroyed.
16. Your rights
Under UK data protection law, you have a number of rights in relation to your personal information.
Depending on the circumstances and the lawful basis for processing, these may include:
Right to be informed
You have the right to understand how and why your personal information is being used. This Privacy Notice provides that information.
Right of access
You can ask for a copy of the personal information I hold about you. This is commonly known as a Subject Access Request (SAR).
Right to rectification
You can ask me to correct information that is inaccurate or incomplete.
Right to erasure
In certain circumstances, you can ask for your personal information to be deleted. This right is not absolute. For example, I may have a legal or professional obligation to retain clinical records for a specified period.
Right to restrict processing
In certain circumstances, you can ask me to restrict how your personal information is processed.
Right to data portability
In certain circumstances, you may have the right to receive personal information you have provided to me in a structured, commonly used and machine-readable format.
Right to object
In certain circumstances, you have the right to object to processing based on legitimate interests.
Rights relating to automated decision-making
You have rights relating to certain forms of automated decision-making and profiling.
I do not use automated decision-making or profiling to make decisions about your physiotherapy treatment.
17. Requests for access to your records
If you would like to request access to your clinical records or exercise one of your data protection rights, please contact me at:
thepreparatoryphysiotherapist@outlook.com
I may need to request information to verify your identity before releasing personal information.
I will deal with requests in accordance with the applicable data protection requirements.
18. Information about other people
If you provide me with personal information about another person, for example an emergency contact, parent or guardian, you should ensure that you have permission to provide their information where appropriate.
Where information is provided by a parent, guardian, carer or another healthcare professional on behalf of a patient, I will handle that information in accordance with applicable confidentiality and data protection requirements.
19. Children and young people
Where physiotherapy is provided to someone under 18, information will be handled with particular care and in accordance with professional, confidentiality and data protection requirements.
Depending on the young person's age, understanding and circumstances, a parent or guardian may be involved in their care and may receive relevant information.
The young person's own rights and confidentiality will also be considered.
20. Complaints
I hope that you will be happy with the way your personal information is handled.
If you have any concerns about how I process your information, please contact me in the first instance:
Sorcha Callaghan
The Preparatory Physio
thepreparatoryphysiotherapist@outlook.com
I will do my best to address your concerns.
You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your personal information has been handled unlawfully or your data protection rights have not been respected.
21. Changes to this Privacy Notice
I may update this Privacy Notice from time to time to reflect changes to:
• the services provided by The Preparatory Physio;
• the systems or technology I use;
• the way personal information is processed;
• professional guidance; or
• data protection legislation.
The latest version will always be available on the The Preparatory Physio website.
I will review this Privacy Notice regularly and update it when necessary.
Last updated: August 2026