Privacy Policy

1. Introduction

I take your privacy seriously. This policy explains what personal information I collect when you visit my website, enquire about my services, or become a patient, how I use it, who I share it with, and what rights you have over it.

I am registered with the Information Commissioner's Office (ICO), registration reference ZB047279.

2. Who I Am

I'm Chris Tiley, the data controller for Chris Tiley Physiotherapy. If you have any questions about this policy or how your information is used, you can contact me directly using the details above.

3. What Information I Collect

Depending on how you interact with me, I may collect:

• Contact details:name, address, phone number, email address, date of birth
• Health information:medical history, current symptoms, treatment notes, and other clinical information relevant to your care
• Appointment and booking information:via my booking system, Cliniko
• Payment and insurance information:if you're claiming through an insurer such as AXA, this may include policy details and invoicing information
• Photographs or video:only where you've given specific consent, for example for clinical assessment purposes, or for use in marketing (such as testimonials or social media)
• Website usage information:such as pages visited and how you found the site, via analytics tools (see Section 8, Cookies)

4. How I Collect Your Information

• Directly from you, for example when you book an appointment, complete a form, or speak with my reception team
• From referrers, insurers, or case managers, where relevant (for example in medico-legal assessments)
• Automatically through my website, via cookies and analytics tools

5. Why I Use Your Information, and My Legal Basis

6. Who Has Access to Your Information

• Chris Tiley and Kate Evans, as the clinicians providing your care, have access to your clinical records as needed to treat you.
• My virtual reception team have access to my info@ email address and an administrative login to Cliniko, to manage bookings and general enquiries. They do not have access to clinical notes or treatment records.
• Self-employed clinicians who rent rooms at the clinic operate independently, hold their own separate patient records, and do not have access to your records with me unless you are formally referred between us with your consent.
• AXA, if you are claiming treatment costs through your insurance policy, for the purposes of authorisation and invoicing.
• Healthcode, used to view remittance information relating to insurance claims.
• Specialists, GPs, or case managers, where I need to coordinate your care or provide medico-legal reporting, and only with your knowledge and consent.
• Cliniko, my practice management software, which stores and processes your booking and clinical information on my behalf. Cliniko accounts registered in the UK have their data stored within the UK.
• Professional indemnity insurer (Balens/Zurich), only in the event of a claim or complaint requiring their involvement.

I do not sell your personal information, and I do not share it with any other third party without your consent, unless required by law.

7. How Long I Keep Your Information

I keep clinical records for as long as necessary to provide your care and to meet my legal and professional obligations. As general guidance:

• Adult patient records are typically retained for 8 years from your last treatment or contact.
• Records for patients under 18 are typically retained for longer, in line with professional guidance from the Chartered Society of Physiotherapy, generally until the patient's 25th birthday (or 26th, if they were 17 at the end of treatment).

Where I have a legal obligation to retain information for longer (for example, for insurance, tax, or medico-legal reasons), I will do so, and will securely dispose of records once no longer required.

8. Cookies and Website Analytics

My website uses cookies and similar technologies, including Google Analytics and Google Ads, to understand how visitors use the site and to measure the effectiveness of my advertising. These tools may collect information such as your IP address, browser type, and pages visited.

When you first visit the site, you'll see a cookie banner allowing you to choose which categories of cookies you're happy for me to use: Necessary, Preferences, Statistics, and Marketing. You can allow all, allow a selection, or deny non-essential cookies entirely.

You can change your preferences at any time using the Cookiebot icon shown in the corner of the page.

You can also control cookies through your browser settings, though disabling them may affect how the website functions.

9. Under-18s

If you are under 18, a parent or guardian must provide consent for your treatment and for the processing of your personal information. Parents or guardians may exercise data protection rights on behalf of a child where appropriate.

10. International Transfers

Where any of the tools or services I use process data outside the UK, appropriate safeguards (such as Standard Contractual Clauses) are put in place by those providers to protect your information, in line with UK GDPR requirements.

11. Your Rights

Under UK data protection law, you have the right to:

• Request access to the personal information I hold about you
• Request correction of inaccurate information
• Request deletion of your information, in certain circumstances
• Object to certain types of processing
• Request restriction of processing
• Request that your information be transferred to another organisation
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact me using the details at the top of this policy. I will normally respond within one month.

12. Complaints

If you have any concerns about how I handle your personal information, please contact me directly in the first instance. You also have the right to complain to the Information Commissioner's Office (ICO):

13. Changes to This Policy

I may update this policy from time to time to reflect changes in my practice or legal requirements. The most recent version will always be available on this page.