Privacy & Data Protection (GDPR) Policy

1. Purpose

• what data Brightside collects;
  
• how the data is used;
  
• how long it is kept;
  
• whether and when it may be shared with other parties;
  
• what choices and rights people have about their data.

2. What Data Brightside Collects

• contact details, including name, title, address, email address and phone number;
  
• Gender identity and pronouns;
  
• date of birth and emergency contact information;
  
• GP, consultant or other healthcare contact details where needed;
  
• health data, including medical history, symptoms, medication, diagnosis, injury history, lifestyle factors and relevant clinical information;
  
• clinical notes, including assessment findings, treatment notes, rehabilitation plans, clinical reasoning, consent records, progress notes and discharge information;
  
• referrals, reports, letters or communications with other healthcare professionals;
  
• appointment information, attendance, payments and invoices;
  
• emails, texts, forms, phone notes and other communications;
  
• feedback, outcome information, satisfaction information, testimonials or reviews where provided;
  
• complaints, concerns, incident or service improvement records where relevant;
  
• accessibility or reasonable adjustment information where relevant to safe and appropriate care;
  
• marketing preferences and consent records where a person has opted in;
  
• testimonial, case example, image, video or media consent records where relevant;
  
• website contact form information;
  
• limited website analytics information.
  

3. How Brightside Uses Information

• assess, treat and support patients safely;
  
• provide physiotherapy, rehabilitation, education and self-management support;
  
• make clinical decisions and keep accurate patient records;
  
• manage appointments, reminders, cancellations, payments and invoices;
  
• communicate about care, referrals, reports, feedback or service information;
  
• support safeguarding, duty of care, complaints, incidents or insurance matters;
  
• review service quality, client satisfaction and client outcomes;
  
• manage feedback, concerns, complaints and service improvement;
  
• meet legal, tax, accounting, regulatory, professional and insurance duties;
  
• manage website enquiries and business administration;
  
• send email marketing only where consent has been given or where otherwise lawful;
  
• manage consent for testimonials, case examples, photography, video or other identifiable client content;
  
• improve the website and understand general website use;
  
• support summary-level impact reporting where individual clients are not identified.
  

4. Legal Basis for Using Data

• contract - to provide appointments and physiotherapy services;
  
• legal obligation - to meet legal, tax, accounting, safeguarding or regulatory duties;
  
• legitimate interests - to manage appointments, records, enquiries, service quality, feedback, complaints and business administration;
  
• vital interests - where information is needed to protect someone’s life or safety;
  
• consent - for optional uses, such as email marketing, testimonials, case examples, photography, video or other identifiable client content. Because health data is special category data, Brightside must also identify a condition under UK GDPR Article 9. Where relevant, Brightside may rely on:
  
• health or social care purposes - to provide physiotherapy assessment, treatment, rehabilitation and care;
  
• legal claims or insurance purposes -  where records are needed for legal, professional or insurance matters;
  
• explicit consent - where required for specific optional uses;
  
• vital interests - where there is serious risk and the person cannot give consent.
  
• 5. Clinical Records and Confidentiality
  
• Brightside will keep clinical records that are accurate, relevant, secure and proportionate.
  
• Patient records may include health history, clinical notes, assessment findings, treatment plans, rehabilitation advice, consent records, referrals, correspondence and outcome information.
  
• Brightside will treat patient information as confidential. Information will only be shared where there is a lawful, professional, safeguarding, insurance, legal or patient safety reason to do so.
  
• Where possible and appropriate, Brightside will discuss information sharing with the patient first. In serious risk, safeguarding or legal situations, information may need to be shared without consent.
  

6. How Data Is Stored

• Cliniko, Brightside’s secure cloud-based practice management system, used for patient records, appointments, clinical notes, outcome feedback and safe client record management where relevant;
  
• secure email and cloud-based business systems;
  
• accounting or payment systems;
  
• website enquiry systems;
  
• Mailchimp for email marketing where someone has opted in;
  
• Google Analytics for website usage information;
  
• secure folders or business records where needed;
  
• email communications via Google workspace/ gmail;
  
• files, photos, videos on iCloud Brightside account.

7. Website Analytics and Email Marketing

8. Data Sharing

• a GP, consultant or other healthcare professional, usually with patient consent;
  
• safeguarding services or statutory agencies where required or justified;
  
• professional advisers, insurers or regulators where needed;
  
• accounting, payment, booking, cloud, website, email marketing or clinical software providers;
  
• legal or regulatory bodies where required by law;
  
• emergency services where needed to protect health or safety.

9. International Data Transfers

10. Retention Period

• adult patient records: usually kept for 8 years after the last appointment;
  
• children’s records: usually kept until the patient turns 25 years old, or longer where required;
  
• records may be kept longer where needed for legal, insurance, safeguarding or professional reasons.

• secure clinical record systems;
  
• password protection and access controls;
  
• secure cloud storage where used;
  
• limiting access to personal information;
  
• secure handling of emails and documents;
  
• regular review of systems and records;
  
• secure disposal or deletion when records no longer need to be kept.

• ask what personal information Brightside holds about you;
  
• request access to your information;
  
• request a copy of your information;
  
• ask for inaccurate information to be corrected;
  
• ask for information to be deleted where legally possible;
  
• object to certain uses of your information;
  
• ask Brightside to restrict how your information is used in some circumstances;
  
• request data portability where applicable;
  
• withdraw consent where processing is based on consent;
  
• opt out of marketing communications at any time;
  
• complain to the Information Commissioner’s Office.

14. Safeguarding, Duty of Care and Legal Exceptions

15. Testimonials, Case Examples, Media and Public Reporting

16. B Corp Impact Commitment and Ethical Use of Data

• collect only information that is needed;
  
• keep patient information secure and confidential;
  
• use data honestly and proportionately;
  
• avoid unnecessary data sharing;
  
• not sell personal information or client data to third parties;
  
• not share client data with third parties for their own marketing;
  
• keep public impact and outcome reporting at summary level where possible;
  
• use outcome, feedback, satisfaction and service improvement data responsibly, and only publish or report it in a way that avoids identifying individual clients unless appropriate consent has been given;
  
• avoid using patient-identifiable information in marketing or public reporting without appropriate consent;
  
• review data practices periodically as part of wider governance and impact commitments.

18. Updates to This Policy

19. Evidence 

• this publicly available Privacy Notice & Data Protection Policy;
  
• evidence that the policy explains what data is collected, how it is used, how long it is kept, and when it may be shared;
  
• Cliniko privacy, security or UK GDPR support evidence;
  
• a saved screenshot, download or policy link showing Cliniko’s secure cloud-based record system;
  
• evidence that clinical records, client information, outcome feedback and satisfaction data are stored securely;
  
• ICO registration evidence where applicable;
  
• marketing opt-in and unsubscribe evidence where relevant;
  
• confirmation that marketing consent is not collected using pre-ticked boxes;
  
• testimonial, media or case example consent records where relevant;
  
• relevant data handling, consent, client rights, complaints or customer stewardship records where appropriate.

20. Contact Details

21. Version Control