Privacy Policy
Effective Date: 18 August 2026
SpineAlign Physio & Wellness Ltd ("we", "us", "our") respects your privacy and is committed to protecting your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Company: SpineAlign Physio & Wellness Ltd
Treatment Location: 162 Finchley Road, London NW3 5HE
Email: info@spinealignphysio.co.uk
Information We Collect
- Name
- Phone number
- Email address
- Date of birth
- Health information, including medical history, symptoms, and treatment notes
- Appointment details
- Payment information (where necessary)
Our Legal Basis for Processing
We process your general contact and appointment details on the basis of contract (to provide the service you've booked) and legitimate interest (to run our clinic effectively).
Health information is "special category data" under UK GDPR Article 9. We only process it with your explicit consent, given when you attend your first appointment, or where necessary for the provision of healthcare by a registered health professional.
Why We Collect It
We use your information to:
- provide physiotherapy treatment and clinical assessment
- manage appointments
- create and maintain treatment records
- send appointment reminders
- process payments
- comply with legal and professional obligations (including HCPC and CSP requirements)
Clinical Records
Health information is treated as confidential and stored securely using Zanda, our practice management system. Access is limited to your treating clinician and, where necessary, authorised administrative staff bound by confidentiality obligations.
Sharing Information
We do not sell or rent your personal information. We only share it:
- with your GP or another healthcare provider, if you request or consent to this, or where necessary for your continuity of care
- with our booking and payment processors (Zanda), acting as data processors under contract
- where required by law, court order, or to protect the vital interests of you or another person
How Long We Keep Records
Clinical records are retained in line with UK legal requirements and CSP (Chartered Society of Physiotherapy) professional guidance, which generally recommends a minimum retention period of 8 years from the end of treatment for adult patients (longer for children, typically until age 25). We will confirm our exact internal retention schedule on request. Enquiry and booking data not leading to treatment is retained only as long as reasonably necessary.
International Transfers
We do not knowingly transfer your personal data outside the UK. Where a third-party processor we use (such as Zanda) may store or process data outside the UK, this would be subject to appropriate UK GDPR safeguards. We recommend confirming Zanda's current data processing and storage location terms directly, as these are set by Zanda and outside our direct control.
Data Security
We use appropriate technical and organisational measures to protect your personal and health information, including secure storage via Zanda, restricted access to clinical records, and confidentiality obligations for all staff.
Your Rights
Under UK GDPR, you have the right to:
- access the personal information we hold about you
- have inaccurate information corrected
- request erasure, where this does not conflict with our legal or professional record-keeping obligations
- request restriction of processing in certain circumstances
- object to processing based on legitimate interest
- withdraw consent for special category (health) data processing at any time, without affecting the lawfulness of processing before withdrawal
- lodge a complaint with the Information Commissioner's Office (ICO)
Subject Access Requests
You have the right to request a copy of the personal and clinical information we hold about you (a "Subject Access Request"). To make a request, email us using the details below. We will respond within one month, as required by UK GDPR. We may need to verify your identity before releasing clinical records.
Contact
To exercise any of these rights, or to make a Subject Access Request, email: info@spinealignphysio.co.uk
You may also complain directly to the Information Commissioner's Office (ICO) at any time.