Privacy notice

This notice explains what we do with information about you. It covers both the ordinary details you give us when you book, and the clinical information we record when we treat you. We have tried to write it in plain language rather than the usual wall of legal text, because a privacy notice nobody reads protects nobody.

Healthflex Ltd is the data controller. We are at The Edge, Woolmer Hill, Haslemere, Surrey GU27 1QB. You can reach us on 01428 642577 or at reception@healthflex.co.uk.

What we collect

When you make an appointment we collect your name, date of birth, address, telephone number and email address, along with your GP practice and, if you are claiming on private medical insurance, your insurer, policy number and authorisation code.

When we treat you we record clinical information. That means the history you give us, our examination findings, what we think is going on, the treatment we provide, the exercises we set and how you progress. It also includes anything relevant about your general health and medication, and any correspondence from your GP, a consultant or another therapist. Health information of this kind is what the law calls special category data, and it is held to a higher standard than ordinary personal information.

If you contact us through this website or by email we keep that correspondence. If you visit the website we may collect limited technical information about the visit, which is covered in our cookie policy.

Why we are allowed to hold it

For your clinical records, our lawful basis is that processing is necessary for the provision of health care and treatment, and that we do so under the obligation of professional secrecy that binds registered clinicians. In practical terms, we hold your records because we cannot treat you safely without them.

For appointment administration, invoicing and insurance claims, our basis is the performance of our contract with you and our own legitimate interests in running the clinic. Where we are required to keep records for tax or professional purposes, our basis is compliance with a legal obligation. Where we ask you for consent, for example before writing to your GP or before sending you anything by way of marketing, you are free to refuse and free to change your mind later.

Who we share it with

We do not sell your information and we do not pass it to anybody for marketing.

We will write to your GP or to a consultant involved in your care where that is in your interest, and we will ask you first. If you are claiming on private medical insurance we share what the insurer needs to process the claim, which usually means confirming that you attended, what was treated and the cost, and sometimes a short report. We use suppliers who handle information on our behalf, including our practice management and online booking provider, our accountants and our IT support. They act on our instructions and are not permitted to use your information for their own purposes.

There are rare situations where we may share information without asking you first. Those are where the law requires it, or where there is a serious risk to your safety or to somebody else's. If that ever happens we will tell you unless doing so would create further risk.

How long we keep it

Clinical records are kept for the periods set by the professional and legal requirements that apply to health records, which are considerably longer than most people expect and which differ for adults and for children. Financial records are kept for as long as tax law requires. Enquiries that do not lead to an appointment are kept for a short period and then deleted. If you want to know how long we will hold your particular records, ask and we will tell you.

Keeping it safe

Records are held on access controlled systems, and only the people who need to see your record in order to treat you or to administer your appointment can do so. Paper records, where we hold any, are kept locked. Our clinicians are bound by professional duties of confidentiality on top of anything data protection law requires.

Your rights

You can ask for a copy of what we hold about you, and you are entitled to it free of charge in most circumstances. You can ask us to correct anything that is factually wrong. You can ask us to restrict how we use your information, and you can object to processing we carry out on the basis of our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

You can ask us to delete information, though for clinical records we are usually obliged to keep them for the retention periods described above, and we will explain if that is why we cannot agree. A note about correcting records is worth making: where you disagree with a clinical opinion we have recorded, we can add your comment to the record, but we cannot remove the fact that the opinion was formed at the time, because an altered clinical record is an unsafe one.

To exercise any of these rights, email reception@healthflex.co.uk or ring 01428 642577. We will respond within one month.

If you are unhappy

Please tell us first, because most concerns are quicker to resolve directly. If you are not satisfied with how we have handled your information you have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113. Complaining to us does not affect that right.