Privacy Policy

This policy explains how Scully Physio Ltd collects, uses, and protects your personal information. It applies whether you are visiting our website, making an enquiry, booking an appointment, or receiving care as a patient. Please read it before using our website or booking with us.

Who we are

Scully Physio Ltd is the data controller for the information we hold about you. This means we are responsible for deciding how your personal information is used and for keeping it safe.

  • Registered company: Scully Physio Ltd

  • Company number: 17242658

  • ICO registration number: ZC184244

  • Data protection contact: Tim Scully, tim@scullyphysio.com

  • Practitioner: Tim Scully, Chartered Physiotherapist, HCPC registered PH139885, member of the Chartered Society of Physiotherapy

What this policy covers

This policy covers three overlapping groups of people: visitors who browse our website, people who contact us or book an appointment, and patients who receive care from us. The information we collect, and our reasons for holding it, depend on how you interact with us, and each is set out below.

Information we collect

When you visit our website —
Our website is hosted on Squarespace. When you browse it, limited technical information is collected automatically, including your device type, browser, approximate location, pages viewed, and how you arrived at the site. This is used to keep the site secure and to understand how it is used. See the Cookies and analytics section below.

When you contact us or make an enquiry —
If you use a contact form, email us, or message us through WhatsApp, we collect your name, contact details, and whatever information you choose to share about your enquiry. We use this only to respond to you.

When you book an appointment —
Online booking is provided through Cliniko. When you book, you provide your name, contact details, date of birth, and appointment preferences, along with any information the booking form asks for.

When you become a patient —
As part of your care we collect:

  • Identity and contact details: name, date of birth, address, phone number, email address, emergency contact

  • Health information: your medical history, medications, symptoms, our assessment findings, measurements and test results, treatment provided, your progress, and correspondence about your care

  • Images and recordings: clinical photographs, video of movement, and ultrasound images, where you have agreed to these

  • Financial information: payment records, invoices, and insurance details

Health information is a special category of personal data under UK data protection law and is given additional protection.

When you make a payment —
Card payments are processed securely by Stripe. We never see or store your full card details. Stripe handles your card data as a PCI DSS compliant payment processor.

Cookies and analytics

Our website uses cookies and similar technologies, which fall into the following categories:

  • Essential cookies, needed for the website and booking system to function. These cannot be switched off.

  • Analytics cookies, which help us understand how visitors use the site so we can improve it.

  • Functional cookies, which support embedded content such as our reviews and social media feeds.

When you first visit the site you will be asked to accept or decline non essential cookies. You can change your choice at any time through the cookie settings on the site or through your browser. Declining non essential cookies will not affect your ability to book an appointment.

Why we collect it and our legal basis

We collect and use your information so that we can assess you, treat you safely and effectively, keep accurate clinical records, respond to enquiries, manage bookings and payments, and run the practice.

Under UK GDPR, our legal bases are:

  • Article 6(1)(b) performance of a contract, that is, to provide the physiotherapy you have asked for and to manage your booking

  • Article 6(1)(c) compliance with a legal obligation, such as tax and company law

  • Article 6(1)(f) legitimate interests, for website security, analytics, and responding to enquiries

  • Article 9(2)(h) provision of health care and treatment by a health professional subject to a duty of confidentiality, for your health information

  • Article 6(1)(a) consent, for marketing communications and non essential cookies

An important point: we do not rely on your consent as our legal basis for holding your clinical records. This is deliberate. Health professionals are required to keep accurate and complete records of the care they provide, and those records must be retained for a set period even if you stop treatment. Where we do rely on your consent for something specific, such as sharing your information with a third party or using a photograph on social media, we will always ask you separately, and you can withdraw that consent at any time.

Who we share your information with

We only share your information where there is a proper reason to do so, and with organisations bound by confidentiality and data protection obligations.

  • Your GP, consultant, or another clinician, only where you have given us permission, or in the rare circumstance where we have a serious concern about your health or safety

  • Your insurer, if you are funding treatment through private medical insurance, we will share the information your insurer requires to process your claim, which is a condition of your policy with them

  • Software providers who process data on our behalf: Cliniko (practice management and clinical records), Stripe (payments), and Heidi Health (AI clinical documentation)

  • WhatsApp (Meta), if you choose to contact us by WhatsApp, your messages are handled through their platform under their own terms

  • Regulators, insurers, or courts, where we are legally required to disclose

All of our software providers are bound by written contracts requiring them to keep your data secure and to use it only on our instructions. We do not sell your data. We do not use it for advertising.

AI assisted note taking

We use a tool called Heidi Health to help write up clinical notes. With your agreement, it listens to the consultation and produces a draft note which is read, reviewed, corrected, and approved by the clinician. Heidi health’s compliance and privacy notices can be found here.

The final record is the clinician's judgement, with no input from the software.

You can decline this at any time and it will not affect your care in any way. If you decline, notes are written manually. Recordings are not retained beyond the production of the note.

Third party content on our website

Our website displays content from third parties, including a Google Reviews widget and an Instagram feed. When this content loads, the relevant provider may collect technical information about your visit under their own privacy policies. We do not control that processing.

Marketing communications

We will only send you marketing communications, such as a newsletter or clinic updates, if you have opted in. You can withdraw your consent and unsubscribe at any time using the link in any message or by contacting us. Appointment reminders and information directly related to your care are not marketing and are sent as part of providing your treatment.

Where your data is held

Some of our providers, including Stripe, Google, and certain cloud services, may process data outside the UK. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK approved transfer mechanisms, to keep your information protected to the same standard.

How long we keep it

We follow the retention periods set out in the Records Management Code of Practice:

  • Adults: eight years after the date of your last appointment

  • Children and young people: until their 25th birthday, or their 26th birthday if they were 17 at the time of their last appointment

  • If a patient dies: eight years from the date of death

  • Financial records: six years, as required by HMRC

Enquiry and website data is kept only as long as needed for the purpose it was collected. After these periods, records are securely and permanently deleted.

How we keep your information secure

We use appropriate technical and organisational measures to protect your information, including access controls, encryption where applicable, secure backups, and multi factor authentication on our systems. We limit access to those who have a genuine need, and our processors are contractually required to maintain equivalent standards. We have procedures in place to deal with any suspected data breach and will notify you and the ICO where we are legally required to do so.

If you do not provide information

Where we need to collect personal data by law, or to provide your care under our agreement with you, and you do not provide it when asked, we may not be able to treat you safely or provide the service you have requested. We will explain this to you at the time if it applies.

Keeping your information accurate

It is important that the information we hold about you is accurate and up to date. Please let us know if any of your details change during your care.

Change of purpose

We will only use your information for the purposes for which we collected it, unless we reasonably consider that we need to use it for a compatible reason. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis for doing so.

Your rights

You have the right to:

  • Be informed about how we use your data, which is what this notice is for

  • Access a copy of the information we hold about you. This is a subject access request. It is free, and we will respond within one month. We may ask you to verify your identity first

  • Rectification, to have inaccurate information corrected. Note that we cannot delete a clinical opinion you disagree with, but we can add your comments to the record

  • Erasure in some circumstances. This right is limited where we have a legal obligation to retain records

  • Restrict or object to processing in some circumstances

  • Data portability in some circumstances

  • Withdraw consent at any time, where we relied on consent for something specific

To exercise any of these, email tim@scullyphysio.com. There is normally no fee, though we may charge a reasonable fee or decline to act if a request is clearly unfounded, repetitive, or excessive.

Complaints

If you are unhappy with how we have handled your information, please tell us in the first instance at tim@scullyphysio.com and we will do our best to put it right.

You also have the right to complain to the Information Commissioner's Office at any time:

  • Website: ico.org.uk

  • Helpline: 0303 123 1113

Changes to this policy

If we change this policy we will publish the updated version at www.scullyphysio.com and, where the change is significant, tell you directly.

Version:

Last updated: 18 July 2026
Version: 2.0