Who we are

Physio Goals is an independent MSK physiotherapy clinic based in Shavington, Cheshire, run by Alexandra Eeles-Lee trading as Physio Goals (sole trader). We are the "data controller" for the personal information described in this policy.

  • Address: Physio Goals, 282 Crewe Road, Shavington, Cheshire, CW2 5AQ

  • Email: info@physiogoals.co.uk

  • ICO registration reference: ZA557321

If you have any question about how we handle your information, contact us using the details above before contacting anyone else.

The information we collect

Depending on how you use our services, we may collect:

  • Contact and booking details — name, date of birth, address, phone number, email address, and (where relevant) GP details or referral information.

  • Health information — the details you share with us for assessment and treatment. This is "special category data" under UK GDPR; see our Patient Privacy Notice for how we specifically handle it.

  • Insurance and funding details — policy numbers and authorisation details where your treatment is funded by an insurer or scheme such as Bupa, AXA, WPA, Simplyhealth, or a referral pathway.

  • Payment information — handled by our payment provider; we do not store full card details ourselves.

  • Website and enquiry data — anything you submit through a contact or booking form, and basic usage data collected via cookies (see our Cookie Policy).

Why we use your information, and our legal basis

Booking, assessing, and treating you | Performance of a contract (UK GDPR Art. 6(1)(b)) and, for health data, provision of health care by a registered professional (Art. 9(2)(h))

Keeping clinical records | Legal obligation and legitimate interests — our professional and indemnity obligations require accurate, retained records

Processing insurance-funded treatmentPerformance of a contract, and your explicit consent to share relevant details with your insurer

Replying to enquiries, running the website, basic analytics | Legitimate interests in running our business

Sending you marketing (only if you've opted in) | Consent, which you can withdraw at any time

Where we rely on consent — for example, sharing information with an insurer, using a testimonial, or taking clinical photographs — we ask for it separately and specifically, and you can withdraw it at any time.

Patients aged 13–17

Our clinical scope covers patients aged 13 and over. Where a patient is under 18, we obtain consent from a parent or guardian in addition to assessing the young person's own understanding of their treatment (sometimes called Gillick competence), and we exercise professional judgement about who else needs to be involved in decisions about their care.

Who we share your information with

We don't sell your data, and we only share it where it's necessary to run the clinic or where the law requires it:

  • Insurers and funding bodies (e.g. Bupa, AXA, WPA, Simplyhealth), where your treatment is funded through them, and only the details needed to process your claim.

  • IT and software providers who host our website, booking system, and clinical records on our behalf — including Squarespace (website hosting) and [name your clinic/booking software, if any]. These providers only process data on our instructions.

  • Other healthcare professionals, where we refer you on or need to coordinate your care, and with your knowledge.

  • Regulators and professional bodies (such as the Health and Care Professions Council) or law enforcement, where we're legally required to.

Some of our service providers may store data outside the UK (for example, Squarespace's servers are based in the US). Where this happens, we rely on safeguards such as Standard Contractual Clauses or the provider's own UK/EU data protection certifications.

How long we keep your information

  • Clinical records for adult patients: a minimum of 8 years from your last treatment, in line with professional and indemnity guidance.

  • Clinical records for patients treated under 18: until their 25th birthday (or 26th, if they were 17 at their last appointment).

  • Financial records: 6 years, to meet HMRC requirements.

  • General enquiries that don't lead to treatment: typically deleted after 12 months.

After these periods, we securely delete or anonymise your information.

Your rights

Under UK GDPR, you have the right to:

  • Ask for a copy of the information we hold about you

  • Ask us to correct anything inaccurate or incomplete

  • Ask us to delete your information (subject to our legal and professional record-keeping obligations)

  • Restrict or object to certain processing

  • Ask for your information in a portable format

  • Withdraw consent at any time, where we rely on consent

  • Complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113 — though we'd appreciate the chance to put things right first

To exercise any of these rights, email info@physiogoals.co.uk.

Keeping your information secure

We use appropriate technical and organisational measures — including secure storage, access controls, and staff training — to protect your information against loss, misuse, or unauthorised access.

Cookies

Our website uses cookies. See our separate Cookie Policy for full details and how to manage your preferences.

Changes to this policy

We may update this policy from time to time; the version on our website is always the current one. Last updated: OCTOBER 2026.


Privacy Policy