Privacy Notice

Last updated: 9 September 2026

At All Out Physiotherapy, we take your privacy and the confidentiality of your information seriously.

To provide physiotherapy, rehabilitation, physical assessment and related healthcare services, we need to collect and use personal information about you. This includes health information, which receives additional protection under UK data protection law.

This Privacy Notice explains what information we collect, why we use it, how we protect it, who we may share it with and the rights you have in relation to your personal information.

1. Who we are

All Out Physiotherapy Ltd provides private physiotherapy, rehabilitation, physical assessment and related healthcare services.

For the purposes of UK data protection law, All Out Physiotherapy Ltd is the data controller for the personal information we collect and process about our patients and prospective patients. This means that we determine why and how your personal information is processed.

Dylan Doherty is responsible for data protection matters within All Out Physiotherapy Ltd.

For questions about this Privacy Notice, your personal information or your data protection rights, please contact:

All Out Physiotherapy Ltd
Data Protection Contact: Dylan Doherty
Email: alloutphysiotherapy93@gmail.com

Our clinic postal address is available on our website and may also be used to contact us regarding data protection matters.

2. What information we collect

The information we collect depends on how you interact with us and the services you receive.

We may collect and process:

  • your name;

  • date of birth;

  • address;

  • email address;

  • telephone number;

  • emergency contact details;

  • appointment and booking information;

  • information you provide when contacting or enquiring with us;

  • relevant health and medical information;

  • details about injuries, symptoms, pain and physical function;

  • relevant past medical history;

  • medication and allergy information where relevant;

  • previous injuries and treatment;

  • your rehabilitation, activity and treatment goals;

  • assessment findings;

  • clinical notes;

  • treatment and rehabilitation plans;

  • exercise programmes;

  • outcome measures;

  • strength, movement and physical-performance testing information;

  • correspondence relating to your care;

  • referral letters and reports;

  • information received from or provided to other healthcare professionals where appropriate;

  • payment and transaction information; and

  • technical information relating to your use of our website.

We aim to collect only information that is relevant and reasonably necessary for the purpose for which it is being used.

3. Health and clinical information

Information concerning your physical or mental health is classed as special category personal data under UK data protection law and receives additional protection.

We process health information where necessary to assess your condition, provide physiotherapy and rehabilitation, plan and monitor your treatment, communicate appropriately about your care and maintain appropriate clinical records.

Our physiotherapists are regulated healthcare professionals and are subject to professional duties of confidentiality.

4. Why we use your information

We may use your personal information to:

  • respond to enquiries;

  • arrange and manage appointments;

  • provide physiotherapy assessment and treatment;

  • develop and monitor rehabilitation programmes;

  • record your clinical history, assessment, treatment and progress;

  • communicate with you regarding your appointments and care;

  • send appointment confirmations and reminders;

  • provide exercise and rehabilitation programmes;

  • perform relevant physical assessment and performance testing;

  • process payments and maintain appropriate financial records;

  • communicate with other healthcare professionals where appropriate;

  • prepare referrals, reports and clinical correspondence;

  • maintain records required for clinical, regulatory, insurance, accounting or legal purposes;

  • manage complaints or concerns;

  • protect patients, staff and the clinic;

  • operate, secure and improve our website and services; and

  • comply with our legal and professional obligations.

We will not use your clinical information for unrelated purposes without an appropriate lawful basis.

5. Our lawful basis for processing your information

UK data protection law requires us to have a lawful basis for processing personal information.

Depending on the purpose and circumstances, we may process your personal information because:

  • Contract: processing is necessary to take steps at your request before providing our services or to perform our contract with you;

  • Legal obligation: processing is necessary for us to comply with a legal obligation;

  • Legitimate interests: processing is necessary for our legitimate interests in operating and administering a safe and effective healthcare practice, where those interests are not overridden by your rights and interests;

  • Vital interests: in limited circumstances, processing may be necessary to protect someone’s life or vital interests; or

  • Consent: for specific activities where consent is the appropriate lawful basis.

Health information is special category personal data and requires an additional condition for processing.

Where we process health information for physiotherapy assessment, treatment, rehabilitation and associated healthcare purposes, we generally rely on Article 9(2)(h) of the UK GDPR, which permits processing necessary for the provision or management of health care or treatment, together with the applicable requirements of the Data Protection Act 2018.

Our physiotherapists are regulated health professionals who are subject to duties of professional confidentiality.

Where a different lawful basis or special-category condition is appropriate for a particular activity, we will use that basis.

Consent to physiotherapy assessment or treatment is separate from the legal basis on which we process your personal information.

6. How we collect your information

We may collect information:

  • directly from you;

  • when you use our website;

  • when you contact us by telephone, email, online form or other communication;

  • when you book an appointment;

  • when you complete forms or questionnaires;

  • during physiotherapy assessment and treatment;

  • through outcome measures and rehabilitation programmes;

  • through physical assessment and performance-testing technology used as part of your care; and

  • from another healthcare professional or organisation where they are entitled to provide the information to us.

7. Systems and service providers we use

We use a limited number of specialist systems and service providers to deliver and administer our services.

Where another organisation processes personal information on our behalf, we take appropriate steps to ensure that the information is handled securely and in accordance with applicable data protection requirements.

Cliniko

We use Cliniko as our practice-management and clinical-record system.

Cliniko may be used to manage:

  • patient contact and identifying information;

  • appointments and bookings;

  • forms and questionnaires;

  • clinical records;

  • assessment and treatment information;

  • correspondence; and

  • other information required to administer and provide your care.

CliniqApps

We use CliniqApps to support patient communications and practice administration, including appointment-related communications, reminders and other patient communication services.

Information processed through CliniqApps may include identifying and contact information, appointment information and other information necessary to provide the communication services we use.

CliniqApps is operated by Exiron (Aust) Pty Ltd, an Australian company. CliniqApps states that it collects, uses, discloses and stores patient information in accordance with applicable data protection and privacy laws and uses security measures designed to protect information processed through its services.

Information processed through CliniqApps may be stored on servers located in Australia. Where personal information is transferred or processed outside the United Kingdom, we take appropriate steps to ensure that the processing and transfer are carried out in accordance with applicable UK data protection requirements.

Physitrack / PhysiApp

We use Physitrack and PhysiApp to provide and manage rehabilitation and exercise programmes.

Where these services are used as part of your care, relevant identifying information, rehabilitation information, exercise programmes and information about your progress may be processed through the platform.

Meloq Force Plates

We use Meloq force-plate technology, supplied through Gait and Motion Technology, as part of our physical assessment, rehabilitation and performance-testing services.

Where force-plate testing is associated with an identifiable patient, relevant identifying information and physical assessment or performance data may be processed through the system.

We use this information to assess physical performance, assist clinical decision-making, inform rehabilitation, monitor progress and provide relevant assessment results.

Stripe

We use Stripe to process certain payments.

Stripe may process personal and financial information necessary to complete and administer those transactions.

We do not need to retain your complete payment-card details within your clinical record in order for Stripe to process a payment.

Square

We use Square to process certain card payments.

Square may process personal and financial information necessary to complete and administer those transactions.

WordPress and our website

Our website is built using WordPress.

Information submitted through our website may be processed through our website infrastructure and relevant hosting or technical services.

We aim to limit personal information collected through our website to what is reasonably necessary for the relevant purpose.

Google Analytics

We use Google Analytics to help us understand how visitors use our website and to improve its performance, content and user experience.

Analytics technologies may collect information about your device, browser and use of our website.

Where analytics cookies or similar non-essential technologies require consent, they will only be used in accordance with your choices through our website’s cookie controls.

Further information about cookies used on our website is available in our Cookie Policy.

8. Sharing information with other healthcare professionals

There may be circumstances where it is appropriate to share relevant information with another healthcare professional involved in your care, such as your GP, consultant or another treating professional.

We will only share information that is relevant and appropriate in the circumstances and will respect our professional duties of confidentiality.

Where appropriate, we will discuss such communication with you.

There may be exceptional circumstances where information needs to be disclosed without your agreement, for example where disclosure is required by law or where an appropriate legal basis exists relating to serious safety or safeguarding concerns.

9. Other circumstances where information may be shared

We may also disclose personal information where reasonably necessary:

  • to organisations processing information on our behalf;

  • to professional advisers where necessary;

  • to regulatory or professional bodies;

  • to insurers where relevant and lawful;

  • in connection with legal proceedings or the establishment, exercise or defence of legal claims;

  • where required by law, court order or another lawful authority;

  • in relation to safeguarding obligations; or

  • where necessary to protect the vital interests of an individual.

We do not sell patient personal or clinical information.

10. International transfers

Some technology providers we use may process or store information outside the United Kingdom.

For example, information processed through CliniqApps may be stored in Australia.

Other service providers may also use international infrastructure or subprocessors.

Where personal information is transferred outside the United Kingdom, we take appropriate steps to ensure that the transfer complies with applicable UK data protection law and that an appropriate transfer mechanism or safeguard is in place where required.

11. How we protect your information

We take the security and confidentiality of patient information seriously.

We use appropriate technical and organisational measures designed to protect personal information against:

  • unauthorised access;

  • accidental loss;

  • inappropriate disclosure;

  • alteration;

  • destruction; and

  • misuse.

Access to clinical and patient information is limited to people who require it to perform their role.

Our staff and clinicians are expected to maintain confidentiality and handle patient information appropriately.

Where third-party systems process information on our behalf, we take reasonable steps to use providers with appropriate security and data-protection arrangements.

12. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to our clinical, professional, regulatory, insurance, accounting and legal obligations.

Clinical records may need to be retained for a significant period after your treatment has ended. We maintain clinical records in accordance with applicable professional, legal and insurance requirements.

Different retention periods or criteria may apply to different types of information, including:

  • clinical records;

  • children’s clinical records;

  • financial and accounting records;

  • enquiries;

  • website and analytics information; and

  • administrative correspondence.

When information no longer needs to be retained, we will securely delete, destroy or anonymise it as appropriate.

13. Your data protection rights

Depending on the circumstances and the lawful basis on which information is processed, UK data protection law gives you a number of rights.

These may include the right to:

  • be informed about how your information is collected and used;

  • request access to personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • request deletion of your information in certain circumstances;

  • request restriction of processing in certain circumstances;

  • object to certain types of processing;

  • request transfer of certain information in a portable format where the right to data portability applies; and

  • withdraw your consent at any time where a particular processing activity relies upon consent.

These rights are not absolute and some apply only in particular circumstances.

For example, the right to erasure does not necessarily mean that we can delete your clinical record when your treatment ends. We may be required or otherwise entitled to retain clinical information for professional, regulatory, insurance or legal reasons.

We will explain the position to you if we cannot fulfil a request in full.

14. Accessing or correcting your information

If you would like to access information we hold about you, believe that information is inaccurate, or would like to exercise another data protection right, please contact:

Dylan Doherty
All Out Physiotherapy Ltd
Email: alloutphysiotherapy93@gmail.com

We may need to confirm your identity before releasing or changing personal information.

We will respond to requests within the timescales required by applicable data protection law.

You will not normally be charged for exercising your data protection rights.

15. Complaints

If you have concerns about how we have collected, used, stored or shared your personal information, please contact us so that we can investigate your concern.

Data Protection Contact: Dylan Doherty
Email: alloutphysiotherapy93@gmail.com

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information about making a data protection complaint and the ICO’s current contact details are available on the ICO website.

16. Cookies

Our website uses cookies and similar technologies.

Some cookies are necessary for the website to function. Others, such as analytics cookies, may help us understand how visitors use the website and improve our services.

Where required by law, non-essential cookies such as analytics cookies will only be used after you have made the relevant choice through our cookie controls.

More information about the cookies used on our website and how you can manage your choices is available in our Cookie Policy.

17. Third-party websites

Our website may contain links to websites operated by other organisations.

Those organisations are responsible for their own privacy practices. We recommend reviewing their privacy information before providing personal information through an external website.

18. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, systems, service providers, business operations or legal obligations.

The current version will be published on our website together with the date on which it was last updated.

19. Contact us

For questions about this Privacy Notice, how All Out Physiotherapy Ltd uses your information, or to exercise your data protection rights, please contact:

All Out Physiotherapy Ltd
Data Protection Contact: Dylan Doherty
Email: alloutphysiotherapy93@gmail.com

Book now
Book now