Privacy Policy
Purpose of this Privacy Notice
This notice explains how Dudley Physiotherapy Clinic Limited collects, uses, stores, protects and shares your personal information, and outlines your rights under UK data protection law.
What Information We Collect
We collect basic personal information including your name, address, telephone number, email address, date of birth and GP practice details. During assessment and treatment we also collect clinical information, including medical history, symptoms, examination findings, treatment records and correspondence relevant to your care.
Clinical Records and AI-Assisted Note Taking
We use Cliniko as our secure practice management system. We may also use AI-assisted transcription (Patientnotes) and note-generation tools to help create draft clinical records from consultations. These tools are used solely to assist clinicians with documentation and administration under human supervision. They do not make automated decisions regarding diagnosis, treatment, care or eligibility for services. Recordings, transcripts and generated notes are encrypted, stored within the UK, are not used to train AI models and are deleted within 30 days or sooner.
How and Where Your Information Is Stored
Personal and medical information is stored securely within Cliniko, an encrypted electronic medical records system. Access is restricted to authorised staff through password protection and, where applicable, two-factor authentication. Temporary clinical note storage and secure cloud services are encrypted using industry-standard security measures including AES-256 encryption. Paper records are stored in locked cabinets when the clinic is closed. Computer systems are backed up securely and access is restricted to authorised personnel only.
Why We Collect Information
We collect and maintain records to provide healthcare services, ensure patient safety, manage appointments, communicate with patients, process payments and insurance claims, monitor service quality, maintain clinical records and comply with legal, regulatory and professional obligations.
Legal Basis for Processing
We process personal data in accordance with UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, health and social care legislation, the Common Law Duty of Confidentiality and other applicable legal and regulatory requirements. Processing may be based on consent, provision of healthcare, legal obligations and legitimate interests where appropriate.
Who We Share Information With
We may share information where necessary and lawful with your GP, NHS organisations, healthcare professionals involved in your care, imaging providers, insurers, regulators, safeguarding authorities, local authorities, police and approved service providers acting on our behalf. Information is only shared where there is a lawful basis to do so and appropriate safeguards are in place.
Who Has Access to Your Information
Physiotherapists and authorised clinical staff have access to information necessary to provide treatment. Reception and administrative staff have access to information required to perform their duties and are bound by confidentiality obligations. All staff receive appropriate training regarding confidentiality and data protection.
How Your Information Is Used
Your information is used to provide treatment, maintain clinical records, communicate with you regarding appointments, send invoices and receipts, process payments, manage referrals, liaise with healthcare professionals involved in your care and comply with legal and professional obligations.
Data Retention
We retain records in accordance with the NHS Records Management Code of Practice for Health and Social Care and other applicable legal and professional requirements. Records are retained only for as long as necessary to fulfil these obligations.
Your Data Protection Rights
You have the right to request access to your personal information, request correction of inaccurate information, request restriction of processing, object to certain processing activities, request data portability where applicable, withdraw consent where consent is relied upon and lodge a complaint with the Information Commissioner's Office (ICO).
Access Requests
You may exercise your rights in writing, by email, by telephone or in person. We do not normally charge a fee unless a request is manifestly unfounded or excessive as permitted by law.
Marketing
We will only send marketing communications where appropriate consent has been obtained or another lawful basis applies. You may withdraw consent at any time.
Complaints
If you have concerns about how your personal information is handled, please contact Dudley Physiotherapy Clinic Limited. We will investigate appropriately and respond without undue delay. If you remain dissatisfied, you may complain to the Information Commissioner's Office.
Contact Details
Stuart Elwell
Dudley Physiotherapy Clinic Limited
1A Parsons Street, Dudley, DY1 1JJ
Telephone: 01384 233306
Information Commissioner's Office: https://ico.org.uk