Privacy Policy

Dr PM Christmas’s Children’s physiotherapy

Privacy Notice

Personal data or personal information is any information about an individual from which that person can be identified. We respect your privacy and are determined to protect your personal information .

You can find out more about personal data from the Information Commissioners Office) http://ico.org/

1.The purpose of this Privacy Notice

This privacy notice tells you what to expect us to do with your personal data when you make contact with us or use one of our services. You must read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

2.The data controller

Children’s Physiotherapy is the data controller and Dr PM Christmas is responsible for your personal data. The contact details are: 31, Long Compton Drive, Hagley, West Midlands DY9 0PD. Email: pmchristmas@googlemail.com. Mobile: 07854831486. www.cpkids-physio.co.uk. Please contact if you have any queries about the policy or your rights regarding your personal data or, if you would like to update your contact preferences.

3.How the personal data is collected

We collect personal data in a variety of ways. This includes: when you enquire about our activities and services; ask questions about our services; send an email to us or receive an email from us; or otherwise provide us with your personal data. For example, if you are applying for our services or correspond with us you may give us your identity, contact and health data by filling in an application form and communicating by post, phone, email, our website or otherwise. We may receive your data from other health professionals via similar correspondence but only with your consent.

4.What personal data do we collect?

The personal data we may collect includes your first name/last name/ title/date of birth/gender and contact details including address/email address/ telephone numbers and bank account details for payment. We collect data about our service users that is more sensitive or considered “special category” and encompasses: medical and health data including diagnosis, medical history, medication and other specific medical needs.

4.1 If you fail to provide personal data

If we need to collect your personal information for example, under the terms of a contract we have with you and, you fail to provide that data when requested, we may not be able to perform the contract we have or, are trying to enter into with you. In this case, we may have to cancel a service you have with us. If this is the case we will notify you at the time.

5.The amount of personal data we collect

Personal data is collected for a specific reason. and only the minimal amount required will be collected.

6.Reasons for collecting and holding your personal data.

6.1Lawful basis Whenever personal information is collected there must be a valid reason for doing so. This is known as a ‘lawful basis’. Children’s Physiotherapy considers there are four specific reasons for us to collect your data. These are: performance of contract; legitimate interests. consent and legal obligation.

6.2.Performance of Contract. This means collecting and using your information to deliver a contractual service to which you are a party or, because you’ve asked us to do something before entering into a contract. For example, if as a prospective client you have asked for a quote for our services, we will need to handle a certain amount of your information to provide this information.

6.3.Legitimate Interest means that when it is in our legitimate interest we undertake data processing that supports our legitimate interest. But, the data processing will not infringe your interest or rights as the data subject. It relates to the interest of our business in managing and conducting ourselves to enable us to give you the best service and the most secure experience. We consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). Examples of legitimate interest are: processing your referral to ensure there is adequate data regarding appropriate and safe care; updating data on you, (your child) and family and updating digital/paper records of care; sharing data with other medical professionals to promote continuity of care; taking photographs and video footage to support multidisciplinary care provision or as a record of you/ your child's activities. You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting using the contact details provided.

6.3.1.Right to object. You have the right to object to the processing of your personal data on the grounds of legitimate interests in certain circumstances. This is absolutely the case with direct marketing. In other circumstances you can make an objection using the contact details included and we will respond within one-month.

6.4.Consent. Consent is only appropriate when you can be offered a real choice and control over how your data is used. This means that you are fully aware of what you are consenting to and we will only use your data for that purpose. You can withdraw your consent at any time using the contact details included in this document. We ask for your consent in the following way: only on a basis of it being freely given and not as a precondition of a service; given in a specific and informed way that involves a positive action to opt-in. You are asked to read and sign a consent form which is separate from your other terms and conditions.

Accessing yours, or your child’s medical data to ensure continuity of care and promote best practice
Using photographs and videos to promote our work and for teaching purposes
When you contact us for training purposes we ask if we can keep your details to inform you about future training.

6.5.Complying with a legal or regulatory obligation. This means processing your personal data where it is necessary for compliance with a legal or regulatory obligation in order to comply with the law. For example, to comply with a legal obligation such as to fulfil contractual requirements.

7.Who do we share the data with?

Your data will not be shared or rented to a third party for marketing purposes.In order to fulfil the purposes identified for personal data collection we may have to share your personal data with the parties set out below.

Internal third parties: Including for example with administrative support.
External third parties: Physiotherapy associates based in the UK who provide Physiotherapy services.
Professional services including lawyers, auditors, accountants and insurers based in the UK who process data to provide consultancy, legal, insurance and accounting services.
Multi-disciplinary team members including NHS, physiotherapy services, general practitioners, medical consultants, case managers, treating therapists, medical insurance companies, health visitors and social care acting as processors or joint controllers based in the UK.
HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers based in the UK who require reporting of processing activities in certain circumstances.
Suppliers of Physiotherapy equipment or orthotics for quoting and assessment/supply of patient specific devices acting as processors or joint controllers based in the UK.
Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. All external third parties reside in the UK If it was necessary to transfer your personal data internationally, we ensure a similar degree of protection is afforded as when transfer of data is undertaken in the UK including secure encryption on electronic data transfer. For further data please contact us by using the contact details provided.

8. How do we protect personal data?

Appropriate, physical and electronic measures are taken to ensure we keep your data secure, accurate and up-to-date and that we only keep it for as long as is reasonable and necessary. Paper based data is kept in a locked cupboard and electronic data on a password protected laptop. Photos and video footage are encrypted. Security measures are in place to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way. Access to your personal data by third party services, employees and associates is limited to those who have a need to know. They are bound to a duty of confidentiality. Processing of your personal data will be strictly on our instructions. Procedures to deal with a suspected personal data breach are in place and you will be notified. Where we are legally required to contact regulators, we will do so.

9.How long do we keep personal data?

We will only retain your personal information for as long as is necessary to fulfil the original purposes we collected it for or, to fulfil any contractual obligations. We review our retention periods for personal information on a regular basis. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements following national guidance on NHS records management. In some circumstances you can ask us to delete your data for further information please refer to the section below about your rights regarding your personal data. If it has been deemed necessary to delate patient records this will be done in a way that patient confidentiality is protected.and advice will be sought where necessary.

10.What are your rights regarding your personal data?

Two important pieces of legislation underpin your rights. They are the Data Protection Act (1998) and The General Data Protection Regulations (GDPR; 2018).

10.1.The right to access your personal data

You can obtain a copy of the personal data we hold about you by submitting your request to the contact details provided. We will reply within one-month from the date the request was received unless there are compelling reasons to extend this time frame. We may refuse this request but in these circumstances a reason for refusal will be provided.

10.2.The right to be informed

You have the right to be informed about the collection and use of your personal data. The details of the types of data we collect, the purposes for which it is collected, who we share it with and how long we retain it for are detailed in the privacy policy and always accessible via the CP-Kids website. The privacy policy is periodically updated.

10.3.The right to rectification

If any inaccurate or incomplete data is included in your personal data you have the right to have it corrected (rectified) and completed. A request for correction and completion can be made by submitting your request to the contact details provided. We will reply within one-month from the date the request was received.

10.4.The right to erasure

You can request that the data we hold about you be deleted. A request for deletion can be made by submitting your request to the contact details provided. We will reply within one-month from the date the request was received. The right to erasure exists if:

We no longer need your data for the purpose for which it was collected.

Our processing of your data was based on consent and you withdraw that consent

Processing of your data is based on legitimate interests, and you successfully object

Your personal data’s been processed unlawfully

We have a legal obligation to remove your personal data

You object to the use of your personal data for direct marketing purposes.

In certain circumstances we may turn down a request for erasure. This would be associated with the request being unfounded or excessively repetitive or, if any of the provisions of the current data legislation apply.

10.5.The right to restrict processing

A request to restrict or suppress processing of the personal data we hold can be made. This would mean the data is stored but not used. A request for suppression can be made by submitting your request to the contact details provided. We will reply within one-month from the date the request was received. There are a number of situations this could relate to such as, you have objected to our processing of your data and we are investigating.

10.6.The right to data portability

This gives you the right to receive the personal data you have provided to us in a structured , commonly used and machine-readable format. This means it can be transferred to another data controller. It only applies to electronic data that you have directly provided and which we have processed based on your consent.

10.7 Right to object

You have the right to object to the processing of your personal data in certain circumstances. This is an absolute right in relation to marketing but there may be other circumstances in which we continue with the processing when there is a specific reason to do so or we consider the request unfounded. A request to object can be made by submitting your request to the contact details provided. We will reply within one-month from the date the request was received.

11.How to complain. If you want to make a general complaint you can lodge this with Children’s Physiotherapy using the contact information provided. If you have a complaint about how Children’s Physiotherapy has handled your personal data you have the right to complain to the Information Commissioner’s Office which is a supervisory body. The address is: Data Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113

12.Using our website.

12.1 Use of Cookies: Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Table-1 explains the cookies we use and why.

A cookie banner has been added to our site.This gives you the opportunity to accept or decline non-essential cookies on our site.

12.2 Links to other websites Our website may contain links to other external websites.Please note that once you have clicked onto these links and left our website we do not have any control over these external websites. We cannot be held responsible for the protection and privacy which you provide whilst visiting these external links. These sites are not governed by this privacy notice. We would suggest you exercise caution and also request information about cookies that these third party links use.

13. Updates of the privacy policy

We reserve the rights to modify this privacy policy at any time, so please review it frequently. Changes and clarifications will take effect immediately upon posting on the website. If we make material changes to this policy, we will notify you here that it has been updated, so that you are aware of what data we collect, how we use it and under what circumstances, if any, we use and/or disclose it.