Privacy policy | Biddulph Physiotherapy

The following privacy policy outlines how Biddulph Physiotherapy and Sports Injury Clinic (trading name of M & J Chadwick Ltd) uses personal and confidential information to provide a physiotherapy service.

What is a privacy policy?

A privacy policy is a statement that describes how we use, retain and disclose your personal information. We may amend this privacy policy to keep it accurate and to comply with any legal changes.

To ensure that we process your personal data fairly and lawfully, we are required to tell you: who we are; how to contact us; what information we collect; why we need it; how we use it; how long we keep it; who we share it with; how it is kept; how we dispose of it; the choices and rights you have over it; and how to withdraw your consent. Each of those is covered below.

All patients are required to consent to their personal information being used under these privacy policy guidelines. Biddulph Physiotherapy and Sports Injury Clinic recognises the importance of protecting personal and confidential information in all that we do, and takes care of its legal duties. This policy has been written in accordance with the rights of the individual under the General Data Protection Regulation (GDPR).

Who we are

Biddulph Physiotherapy and Sports Injury Clinic is the trading name of M & J Chadwick Ltd. We are a private physiotherapy clinic focused on providing a physiotherapy service to the general public.

Biddulph Physiotherapy and Sports Injury Clinic is registered with the Information Commissioner's Office, registration number Z3039599.

In this policy, “we”, “us” and “our” refer to Biddulph Physiotherapy and Sports Injury Clinic. Within the practice, Mark Chadwick has been appointed data processor.

How to contact us

Biddulph Physiotherapy & Sports Injury Clinic
Well Street, Biddulph, Stoke-on-Trent, ST8 6HY

If you have any queries regarding this privacy policy, or any other points, please call 01782 519800 or email info@biddulph-physio.co.uk.

The latest copy of this policy can always be found on our website at www.biddulph-physio.co.uk.

What information we collect

We can use and process personal information only where we have an appropriate and lawful reason to do so. GDPR requires that information is managed lawfully, fairly and in a transparent manner.

We collect both personal information and sensitive personal data.

Patients

Appointment enquiry: name and telephone number.
Registration: name, date of birth, address, marital status, employment status and hobbies.
Consent: your signature.
Assessment: sensitive information from a subjective assessment of your symptoms, and from an objective assessment of your physical state.
Medical co-ordination: previous medical appointments, medical history, companies and alternative contact details.
Insurance: membership number, authorisation number and patient financial details.
Email: your email and email address.

Suppliers, insurers and co-ordination companies

Suppliers, insurance companies and medical co-ordination companies will have their company name, address, telephone number and email address stored.

How we obtain it

We collect information about you by phone, email, by post, or face to face. We also collect information about you through third parties — GPs, consultants, other clinicians and healthcare professionals or providers, medical insurance companies, medical co-ordination companies acting on your behalf, and those paying for your treatment.

We may collect information from your parent or guardian if you are under 18 years old, or from a family member acting on your behalf.

We also use, collect and store your financial details from cheque payments and third-party payments.

Why we need your information

Voicemail

When you first contact the clinic to arrange a physiotherapy appointment, it is within our legitimate interest to record your name and contact telephone number so that we can contact you to make or reschedule an appointment.

Registration (personal details)

Before we can assess you, it is our legal obligation to complete a registration form recording your name, date of birth, address, telephone number, occupation and hobbies. Your personal details are held in case we need to contact you. Your age, occupation and hobbies are used to formulate a clinical diagnosis and guide the choice of treatment.

Consent

It is our legal obligation to gain written consent before proceeding with an assessment and treatment. It also signifies that you have been given the opportunity to read this privacy policy and understand your right to refuse treatment, and your rights with regard to your personal data.

Assessment and treatment (sensitive information)

In order to make a diagnosis of your condition and to determine whether treatment is appropriate, it is our legitimate interest and legal obligation to undertake a subjective assessment. This includes documenting the history of your presenting condition, your past medical history, drug history, aggravating factors, easing factors and diurnal pattern.

Following your subjective examination an objective examination will be undertaken. This will require you to get suitably undressed so that we can see the affected body part. This information needs to be stored and referred to in order to provide ongoing treatment. The treatment used will be recorded along with a treatment plan.

Medical co-ordination companies

Patients who have been referred via a third party, or who have their physiotherapy funded by an insurance company, may be required to provide additional documentation such as a referral letter, authorisation letter or payment details. It is our legitimate interest to gain this information. It is stored with your medical notes and used in correspondence with the third party or insurance company.

Cookies

Our website does not use cookies, and therefore no tracking data is recorded.

How we use your information

We process your personal information for the purposes set out in this privacy notice. By law we must have a lawful reason for processing your information. We process both standard and specialist information in order to undertake a course of treatment, for preventive or occupational medicine, for insurance purposes, and to defend legal claims.

Appointment details

Your name and contact number are stored following your initial telephone call to the clinic, within a paper diary. When not in use, this is locked within a filing cabinet in the locked clinic room within the building.

Personal details

The personal details you disclose during registration are used to contact you by telephone, email, letter or SMS. This information may also be used to contact third parties such as other health practitioners, third-party referrers and insurance companies.

Assessment documentation

The notes written to document your assessment are used to undertake a course of treatment. This information may also be used to inform third parties such as other health practitioners, third-party referrers and insurance companies.

Marketing

We will not use your information to send marketing information to you or to any third party, in any format.

Continued professional development

Your information may be used anonymously to enable continued professional development to be undertaken.

Research

Your information may be used anonymously for data analysis for research purposes.

Letters

Following an examination it may be deemed necessary to contact your GP. In most cases this will be by letter and posted. In more serious cases your GP may be contacted by telephone. On rare occasions patient information may have to be passed to the emergency services.

Suppliers

Suppliers of medical equipment have their contact details (name, address and telephone number) stored as digital information, held on file for future reference so that orders can be placed. This is held on an external storage device kept within a locked cabinet in a locked room.

Third-party medical co-ordination companies

Medical co-ordination companies that refer patients for physiotherapy have their contact details (company name, address and telephone number) stored as digital information, held on file so that correspondence can be made. This is held on an external storage device kept within a locked cabinet in a locked room.

Medical insurance companies

Medical insurance companies that fund the payment of physiotherapy services for their clients have their contact details (company name, address and telephone number) stored as digital information, held on file so that correspondence can be made. This is held on an external storage device kept within a locked cabinet in a locked room.

Security

We are committed to keeping your information secure. Computer access is password protected. Computer hardware and software is stored in a locked cabinet in a locked room. Emails are sent via Egress Switch secure email.

How long we keep your information

Voicemail

Personal details left via voicemail are kept until an appointment has been arranged, or deleted after 7 days.

Patient consent, registration and assessment information

Patients' consent, registration information, assessment and treatment notes are kept for the period during which you are receiving physiotherapy treatment. After that they are stored as described in this policy and kept for the length of time set out in GDPR and in current clinical guidelines from the Chartered Society of Physiotherapy (CSP).

Current CSP guidelines state that notes of patients aged 18 or over at the time of treatment are to be kept for 8 years. Notes of patients under 18 at the time of treatment are to be kept until they are 25, or 8 years after death.

Your records may be kept indefinitely if you return for another episode of treatment.

Emails are kept for the length of time set out in GDPR legislation. Supplier company, medical co-ordination company and insurance company data is retained in accordance with GDPR legislation.

Who we share your information with

Your personal information will not be shared except in the following circumstances.

Other medical practitioners. On occasion your personal information will have to be shared with other medical practitioners.
Medical co-ordination companies. Patients who have been referred via a medical co-ordination company working on their behalf will require their personal information, consent and assessment findings to be shared in order to process their recovery.
Insurance companies. Patients who receive funding for their physiotherapy treatment from an insurance company will have their personal information included within the invoice sent to the insurer in order to process payment for the treatment received.
Outside the EU. At no point will your personal information be transferred outside of the EU.

How your information is kept

Physiotherapy notes

Your information is kept in the form of medical (paper) notes. Medical notes are kept within a locked filing cabinet in a locked room within the building.

Email

Patients referred by email from a third party should have had their personal information sent through a secure method requiring password access. All outgoing emails containing personal information are sent using Egress Switch, a secure method requiring password access by the recipient.

All historic emails are stored and deleted in accordance with GDPR guidelines.

Digital information

All digital information is stored on external memory storage and kept securely within a locked filing cabinet in a locked room. The information is destroyed after the recommended length of time in accordance with GDPR and CSP guidelines.

Patients receiving funding through a medical insurance company may have email correspondence, depending on the company. All outgoing emails are sent securely via Egress Switch.

Invoices and receipt books

All copies of patient paper invoices and all receipt books are stored securely within a locked filing cabinet in a locked room.

How we dispose of your information

Following storage of your personal information for the legally stipulated period of time stated in this privacy policy, medical notes containing personal and sensitive information are destroyed securely and confidentially, in accordance with Chartered Society of Physiotherapy guidelines.

Your rights and choices over your information

You have legal rights under GDPR, summarised as follows.

The right to be informed about our information processing activities, including through privacy notices such as this one.
The right of access to the personal information we hold about you. To request a copy, you must make a subject access request to us in writing.
The right of rectification. You may ask us to correct any inaccurate or incomplete information within one month.
The right to erasure and to restrict processing. You have the right to have your personal information erased and to prevent processing, except where we have a legal obligation to process it. Please bear in mind that exercising this right may hinder or prevent our ability to provide treatment.
The right to data portability. On request, we will provide you with your personal information in a structured format.

If you want to invoke any of these rights, please write to us at the address above.

Withdrawal of consent

Where you have provided your specific consent to the use of personal information, you may withdraw that consent by contacting us at the address above.

How to make a complaint

If you wish to make a complaint about how we hold or use your data, please contact us at the address above.

If you are dissatisfied with how we deal with your complaint, you may contact the Information Commissioner's Office:

The Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Last updated: May 2018.