Privacy Policy

Last updated: 19 September 2026

Shrewsbury Physiotherapy & Orthotics respects your privacy and is committed to protecting your personal information. This notice explains what we collect, why we use it, who we may share it with, how long we keep it and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Shrewsbury Physiotherapy & Orthotics is the data controller for personal information used to provide our clinical and administrative services.

Address: Portelet House, Wem Road, Harmer Hill, Shrewsbury, SY4 3EA
Email: info@shrewsburyphysio.co.uk
Telephone: 01743 612022

Information we collect

Depending on how you use our services, we may collect:

• your name, date of birth and contact details;
• appointment, referral, treatment and rehabilitation information;
• health information, clinical notes, relevant medical history and correspondence;
• payment, invoice, insurance and authorisation information;
• messages, enquiries, feedback and complaint information; and
• technical website information, including cookie and analytics data where permitted.

We normally collect information directly from you. We may also receive relevant information from a parent or guardian, referrer, insurer, GP, consultant or other healthcare professional where this is appropriate and lawful.

Why we use your information

We use personal information to:

• arrange and manage appointments;
• assess, treat and support patients;
• maintain accurate clinical records and communicate about care;
• process payments and insurance claims;
• respond to enquiries, feedback and complaints;
• meet professional, safeguarding, legal, tax and regulatory responsibilities;
• maintain the security and effective operation of our website and systems; and
• send marketing communications only where you have consented or where otherwise permitted by law.

Our lawful bases

Depending on the purpose, we rely on one or more of the following lawful bases: performance of a contract, compliance with a legal obligation, our legitimate interests in operating and improving the clinic, and consent where required.

Health information is special-category data. We process it where necessary for the provision and management of health treatment by healthcare professionals who are subject to duties of confidentiality, and where another lawful condition applies.

You may withdraw consent at any time where consent is the basis used. Withdrawal does not affect processing already carried out lawfully.

Who we share information with

We only share information where necessary and appropriate. Recipients may include:

• clinicians and authorised clinic staff working under confidentiality obligations;
• our practice-management and online-booking provider, WriteUpp and SelectAndBook;
• secure IT, website, communications, payment and administrative service providers;
• insurers, accountants and professional advisers;
• GPs, consultants and other healthcare professionals where you have agreed or where sharing is otherwise lawful; and
• regulators, safeguarding bodies, law-enforcement agencies or courts where required or permitted by law.

We do not sell personal information.

International transfers

Where a service provider processes information outside the United Kingdom, we require an appropriate UK adequacy arrangement or legally recognised safeguards to protect that information.

How long we keep information

We keep information only for as long as it is needed for the purpose for which it was collected, and in accordance with legal, tax, insurance and professional record-keeping requirements.

• Clinical records are retained in accordance with applicable professional guidance and our clinical-record retention schedule. A record may be kept longer where necessary for ongoing care, safeguarding, a complaint, insurance or legal proceedings.
• Financial and accounting records are generally retained for six years after the relevant financial period.
• General enquiries and correspondence are reviewed and deleted when no longer required.
• Marketing information is retained until consent is withdrawn or the information is no longer needed.

Retention is reviewed periodically. Information that is no longer required is securely deleted or anonymised.

Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. Access to clinical information is restricted to people who need it for their work.

Your rights

Depending on the circumstances, you may have the right to:

• request a copy of your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase or restrict use of information;
• object to certain processing;
• receive information you provided in a portable format; and
• withdraw consent where processing is based on consent.

Some rights are subject to legal and professional record-keeping requirements. To exercise a right, contact us using the details above. We may need to verify your identity.

Cookies and website analytics

Our website uses necessary cookies for basic functions and may use optional analytics or preference cookies where you permit them through the cookie controls. You can change your cookie choices at any time using the cookie settings on the website.

Automated decision-making

We do not use personal information to make solely automated decisions that have legal or similarly significant effects on patients.

Complaints

Please contact us first if you have a concern about how we use your information. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or telephone 0303 123 1113.

Changes to this notice

We review this notice regularly and will update the date above when changes are made.