Privacy policy

1. Who is responsible for your information?

Richard Jones Physio is the practice named in this notice. The controller is the person or organisation that decides why and how personal information is used. Richard Jones is the practice contact for privacy questions and requests.

Contact: info@richardjonesphysio.co.uk
Practice address: 16 Blackthorn Road, Stratford-upon-Avon.

This notice covers people enquiring about treatment, patients, people acting for them and visitors to this website. It explains the practice’s handling of information under the UK GDPR, Data Protection Act 2018 and applicable amendments, including the Data (Use and Access) Act 2025. It is separate from consent to examination or treatment.

2. The information we use and where it comes from

We use information that is relevant to your enquiry, care or our administration. Depending on your circumstances, this may include:

Identity and contact details, such as your name, date of birth, address, telephone number, email address and communication or access needs.
Information about the problem bringing you to physiotherapy: symptoms, medical history, medicines, allergies, relevant operations, examination findings, care plans, progress and consent decisions. Health information receives additional protection under data protection law.
GP, referrer, emergency-contact and representative details; an NHS number if supplied and necessary; and relevant letters or reports from professionals involved in your care.
Appointment records, correspondence, invoices, payment status, insurer details where applicable, complaints and records of your privacy or communication choices.
Technical information processed by the live hosting provider, such as IP address, device/browser information, request time and security logs.

Most information comes directly from you. It may also come from a parent or authorised representative, a healthcare professional, an insurer or someone making a referral. We will explain the relevant source where information comes from another person and provide this notice within the applicable legal timeframe. Please give an emergency contact only the information they need to understand why their details are provided to us.

We ask for relevant information, not your whole medical history without a reason. Optional items on the onboarding form remain optional. Without information needed to assess safety, verify identity or arrange treatment, we may be unable to proceed; we will explain why and discuss alternatives.

3. Why we use information and our lawful bases

Ordinary personal information needs an Article 6 lawful basis. Using health information also needs a separate Article 9 condition. A signature accepting treatment or acknowledging this notice is not blanket consent to every use of data.

Purpose	Article 6 basis	Health-data condition, where needed
Responding to a request for an appointment, arranging care and delivering the service agreed with you.	Article 6(1)(b): steps you request before a contract and performance of that contract.	Article 9(2)(h): healthcare, with Article 9(3) confidentiality safeguards and DPA 2018 Schedule 1, Part 1, paragraph 2.
Providing appropriate private care where the patient is not personally party to the contract; maintaining clinical continuity and records beyond an appointment.	Article 6(1)(f): legitimate interests in safe care, reliable records and the responsible operation of the practice, balanced against individual rights.	Article 9(2)(h), with the same confidentiality safeguards.
Administering the practice, answering complaints, protecting information and managing or defending legal claims.	Article 6(1)(f): legitimate interests in resolving concerns, protecting the practice and establishing facts.	Article 9(2)(h) for relevant healthcare administration; Article 9(2)(f) where necessary for legal claims.
Keeping required financial records or complying with a binding legal demand.	Article 6(1)(c): a specific applicable legal obligation, recorded when relied on.	Only a condition that actually applies to the disclosure, such as Article 9(2)(f) for legal claims; health details are not included in routine financial records unnecessarily.
Sending optional practice news by email.	Article 6(1)(a): your separate consent, alongside the electronic-marketing rules.	We do not use health information to target marketing. Any future proposal to do so would require a separate lawful assessment and, normally, explicit consent.

Where an emergency makes necessary processing essential to protect a life and the person cannot consent, Article 6(1)(d) and, where its conditions are met, Article 9(2)(c) may apply. A safeguarding disclosure requires an appropriate documented lawful basis, health-data condition and confidentiality justification; we do not treat all safeguarding situations as a single blanket exception.

We use the basis that genuinely applies to the particular purpose, rather than selecting an alternative retrospectively to avoid your rights. Professional confidentiality continues to apply alongside data protection law.

5. Information processed outside the UK

Some service providers may process information outside the UK. Before a restricted transfer takes place, the practice must establish a valid transfer route: relevant UK adequacy regulations, or appropriate safeguards such as a UK International Data Transfer Agreement or UK Addendum together with the required data-protection assessment. Exceptions are considered only where their legal conditions are met.

You can ask for information about applicable safeguards and a copy, subject to necessary redactions. We do not claim that every record is kept only in the UK.

6. How long we keep information

We retain information for a defined purpose, not indefinitely. The following clinical record-retention schedule applies, subject to any longer justified requirement described below:

Adult clinical records: normally eight years after the last treatment.
Children’s clinical records: normally until their 25th birthday, or 26th birthday if the patient was 17 when treatment ended, with any longer justified requirement checked individually.
Other records: financial records follow the statutory period applicable to the legal entity and type of record. Enquiries that do not lead to care, website/security logs and general administration are kept only while needed for the relevant purpose and a documented, proportionate follow-up period.
Marketing choices: until consent is withdrawn or no longer valid; a minimal suppression record may be retained to ensure an unsubscribe request continues to be respected.

Relevant information may need to be held longer for an ongoing complaint, legal claim, safeguarding matter or binding preservation requirement. The reason and review date should be recorded. At the end of retention, information is securely destroyed or irreversibly anonymised. Backup deletion follows a controlled cycle rather than a promise of immediate deletion from every copy.

7. Keeping information safe

The practice must use proportionate physical, organisational and technical safeguards, restrict access to people who need it and protect records against loss, misuse and unauthorised access. Controls and provider agreements must reflect the systems actually used. No email or online system can be described as completely risk-free.

Please keep your completed patient form private. Bring it to the appointment or ask Richard for an agreed secure return method. The website has no patient-record upload facility. Do not send detailed medical information in an initial enquiry or through social-media comments.

Suspected incidents should be reported to the practice email address. Where a personal-data breach meets the statutory reporting threshold, the practice must notify the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it; affected people must be informed without undue delay where the law requires this.

8. Website enquiries, downloads and browser storage

The current enquiry helper composes a draft in your own email application. It does not submit the form to a practice web server, record your answers in browser storage or confirm an appointment. Information reaches the practice only if you send the email or contact Richard another way; email-provider processing then applies.

Downloading the blank onboarding form or an exercise PDF does not send us completed answers. A live host may log the request, but no completed form is collected by this website.

The supplied site has no analytics, advertising pixels, embedded social feeds or remote video players. It uses a session-storage preference called rjp-motion-paused only when you choose to pause or resume decorative movement. See the Cookies & website storage notice for the exact behaviour and live-hosting checks.

9. Reminders and optional marketing

Appointment-related messages are service communications, not permission to send marketing. We respect the reminder-channel choice on your form; please tell us when it changes.

Optional email news requires a separate, positive opt-in. It is not a condition of treatment. You can withdraw consent using an unsubscribe route in a message or by emailing the practice. Withdrawal stops future marketing and does not affect lawful processing already carried out. We will not add clinical details to marketing lists or use your diagnosis to select advertising audiences.

The present website does not collect newsletter subscriptions. A future sign-up feature must explain what will be sent and provide an effective opt-out before it is introduced.

10. Your information rights

Depending on the purpose and lawful basis, you may ask to access your personal information, correct inaccuracies, erase information, restrict its use, object to processing based on legitimate interests or receive certain information in a portable format. You can object to direct marketing at any time and withdraw any data-processing consent you have given.

These rights are not all absolute. For example, withdrawing consent to treatment or marketing does not normally require deletion of clinical records we have a lawful reason to retain. A factual error can be corrected while preserving an appropriate audit trail; an accurate record of a clinical opinion is not automatically erased because it is disputed. We will explain any limit we apply.

Email the practice to make a request; there is no mandatory form. We may ask for proportionate identity or authority checks. We normally respond without undue delay and within one calendar month of the applicable starting point. The law may allow extra time for complex or numerous requests or necessary clarification; we will explain any extension or lawful pause. Requests are normally free. Any exception, fee or refusal must have a lawful reason and will be explained with your complaint options.

Parents and other representatives do not automatically have unrestricted access to someone else’s information. We consider the patient’s capacity, wishes, confidentiality and the representative’s authority. The current site does not make solely automated decisions about your treatment or eligibility and does not profile you for advertising.

11. Questions and data protection complaints

Contact info@richardjonesphysio.co.uk, write to the confirmed practice address or raise a concern with Richard. You do not need to use legal language or a particular form. Explain what happened and the outcome you are seeking, and ask for communication support if needed.

We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome. The 30-day acknowledgement period is not a licence to postpone investigation. A request to exercise your information rights follows its own statutory response times, even when made alongside a complaint.

You also have the right to complain to the Information Commissioner’s Office (ICO). Visit the ICO complaints service. Raising a concern with us does not remove your right to contact the regulator or seek a court remedy.

12. Changes to this notice

We will update this notice when our services, systems or legal responsibilities change and explain significant changes where appropriate. A new notice does not retrospectively authorise a new use of information or replace consent where consent is needed.

Last updated: 10 November 2026.

Sources & further reading

References checked 10 November 2026. External guidance supports the information; it does not endorse the practice or replace individual assessment.