EC Rehabilitation & Physiotherapy
Privacy Notice
Last updated: 30 October 2026
1. About this notice
EC Rehabilitation & Physiotherapy provides private physiotherapy and rehabilitation services, including home visits. This notice explains how personal information is collected, used, shared, stored and retained when you contact the practice, use its website or receive care. We process personal information in accordance with UK GDPR and the Data Protection Act 2018, and observe applicable HCPC professional standards and CSP guidance.
2. Data controller and contact details
The data controller is Mrs Eleanor Crouch, trading as EC Rehabilitation & Physiotherapy. ICO registration reference: ZC239000. Email: ecrehabphysiotherapy@outlook.com. Telephone: 07817 224758. Website: www.ecrehabandphysiotherapy.co.uk. For privacy enquiries and requests, please contact us by email or telephone. Postal correspondence can be arranged on request.
3. Information we collect
For enquiries, we may receive your name, contact details, the content of your message and any information you choose to share. For patients, we may collect contact and identification details, date of birth, relevant medical history, diagnoses, medication, referrals, assessment findings, treatment plans, progress notes, correspondence, and information about functional abilities and rehabilitation goals. We may also hold appointment, invoice and payment records, and relevant details of representatives, carers or other professionals involved in your care. Information may be supplied by you or, where appropriate, by referring clinicians, carers, case managers and other professionals involved in your care. Providing relevant clinical information is normally necessary for us to assess and treat you safely; without it, we may be unable to provide a particular service. Health information is special category personal data and receives additional protection.
4. How we use information
We use information to respond to enquiries; arrange appointments; assess, plan, provide and review physiotherapy and rehabilitation; maintain accurate clinical records; communicate with other professionals involved in care where appropriate; administer appointments and payments; and meet legal, safeguarding and professional responsibilities. We do not sell personal information or use patient health information for unrelated marketing.
5. Lawful bases
Depending on the activity, our Article 6 UK GDPR lawful bases may include performance of a contract or steps requested before a contract (Article 6(1)(b)); compliance with a legal obligation (Article 6(1)(c)); and legitimate interests in administering and securing the practice, where those interests are not overridden by individual rights (Article 6(1)(f)). Where appropriate, we may rely on consent (Article 6(1)(a)). For health information needed to provide physiotherapy and manage care, we generally rely on Article 9(2)(h), together with the relevant condition and confidentiality safeguards under the Data Protection Act 2018. Other conditions may apply where appropriate, including for legal claims or safeguarding. Consent to clinical assessment or treatment is distinct from the data-protection lawful basis for maintaining clinical records.
6. Confidentiality and information sharing
We may share relevant information, where lawful and necessary, with your GP, referring clinician, rehabilitation professionals, authorised case managers, insurers or funding organisations, and people involved in your care where you have authorised this or another lawful basis applies. We may also disclose information where legally required, for safeguarding, to address legal claims or to professional regulators. Service providers may process information on our behalf under appropriate safeguards. We limit sharing to information relevant to the purpose and apply professional confidentiality obligations.
7. Clinical record storage and security
Paper clinical records are stored in a locked, fire-resistant cabinet at the physiotherapist's home, with access restricted to the data controller. Electronic clinical records are stored in Microsoft OneDrive using an authenticated account and access controls. We take appropriate measures to protect confidentiality, including secure account access, restricted access to records and appropriate handling and disposal. No system can be guaranteed completely risk-free.
8. Retention periods
General enquiries that do not proceed to treatment are retained for 12 months after the last communication, unless a specific legal or other justified reason requires longer retention. Where an enquiry progresses to care, clinically relevant correspondence may form part of the patient record. Adult physiotherapy clinical records are generally retained for at least eight years after the last treatment or relevant contact, subject to applicable guidance and any longer retention requirement. Different rules may apply to children's records and records connected with litigation or other exceptional circumstances. Accounting and tax records are kept for the applicable statutory period. When records are no longer required, they are securely deleted or destroyed.
9. Website enquiries and email
The website's ‘Send enquiry’ function opens a pre-addressed message in your own email application; it does not transmit or store the message through a website database. Your message is sent only when you choose to send it using your email provider. Incoming enquiries are received and managed through Microsoft Outlook. Your email provider may also process your message. Telephone enquiries are handled outside the website. Please avoid including extensive or highly sensitive medical details in an initial email; we can arrange an appropriate way to collect clinical information when needed.
10. Website hosting, maps, fonts and visitor information
The website is hosted by Lovable, which may process technical information such as IP addresses and access logs to deliver and secure the website. Lovable may provide aggregate visit counts without analytics cookies or individual visitor profiles. Hosting access information is handled in accordance with the provider’s applicable policies. The website uses Google Fonts and embedded Google Maps. When these resources load, Google may receive your IP address, browser details and other technical information. Google Maps may use additional technologies when the map is active. Please see Google's privacy information for details. The map shows the geographical area covered by our services; visitors are not asked to provide their address or location. The map is supplied by Google, which may process technical information independently under its privacy policy.
11. Cookies and similar technologies
A pre-publication technical review found no website cookies or advertising trackers. The site used limited browser storage to remember page scroll position. Google Maps is a third-party embedded service and may use cookies or similar technologies when loaded; any consent requirements under applicable law remain relevant. If cookies, embedded services or other technologies are changed, we will review the applicable privacy and consent requirements and update our information or controls where necessary. This notice does not replace consent where consent is required for a non-essential technology.
12. International processing
Microsoft, Google, Lovable or other technology providers may process information outside the UK. Where the practice is responsible for a restricted international transfer, it will use an appropriate transfer mechanism and safeguards as required by UK data protection law. Relevant providers' privacy information may explain their own processing and transfer arrangements.
13. Photographs, videos and testimonials
Any clinical photographs or videos will be taken only where appropriate, with suitable explanation and permission. Identifiable patient images, stories or testimonials will not be used for marketing without separate, specific permission. You may withdraw marketing permission for future use.
14. Your data protection rights
Subject to legal conditions and exemptions, you may request access to your information, correction of inaccurate information, erasure in certain circumstances, restriction of processing, objection to certain processing, or data portability where applicable. You may withdraw consent where consent is the relevant lawful basis. Some requests, particularly requests to erase clinical records, may be limited by legal or professional retention obligations. Contact ecrehabphysiotherapy@outlook.com to exercise your rights. We will respond within the applicable legal timeframe.
15. Concerns and complaints
Please contact ecrehabphysiotherapy@outlook.com with questions or concerns about information handling. You may also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk or on 0303 123 1113.
16. Changes to this notice
We may revise this notice to reflect changes to our services, systems, professional guidance or legal requirements. The current version is available on the website and can also be provided by email on request.