Privacy policy

SteadyMotion Clinical Ltd (Company No. 17168626) is a private physiotherapy practice providing specialist physiotherapy to older adults, including falls prevention, mobility and rehabilitation.

We are registered with the Information Commissioner's Office (ICO) under registration number C1914166.

Our registered office is 124 City Road, London, EC1V 2NX.

General contact: hello@steadymotionclinical.co.uk

Data protection contact: dataprotection@steadymotionclinical.co.uk

Our Data Protection Lead is the Director. You can reach them at the data protection address above.

We are the "data controller" for your personal data. This means we decide how and why we hold and use it, and we are responsible for it.

If we provide services in a care home, the care home is a separate data controller of the information it holds about you. We each remain responsible for our own records. We are not responsible for how your care home uses information after we have shared it with them, and they are not responsible for our clinical records.

Categories of data we hold:

Identity data. Name, date of birth, address, contact details, and next of kin or representative details.
Health data. Medical history, diagnosis, treatment notes, assessment results, outcome measures, mobility and balance test scores, falls history, including any falls diary you keep for us, rehabilitation progress, medication lists, and relevant family history. Where clinically relevant we may also record photographs or video of posture, gait or exercise technique. If your physiotherapist prescribes a home exercise programme, the programme and any progress you choose to record through it are also part of your health data.

Health data is "special category data" under Article 9 of the UK GDPR and gets extra protection.

Financial data. Payment details. These are handled by a secure third-party payment provider. We do not store full card numbers or security codes on our systems.

Technical data. IP address, browser type, operating system and device information, collected through website cookies.

Correspondence data. Records of communication between us, including emails and call logs.

Enquiry and booking data. When you get in touch by website form, phone, email, WhatsApp or social media, or book a call online: your name, contact details, organisation and role if you are contacting us for an organisation, what you are asking about, your borough and the first half of your postcode (for example E8), how you heard of us, and the outcome of your enquiry. We keep this whether or not you go on to book. Please do not include health details in a website form or message. We will ask for what we need when we speak to you.

Where we get it from:
Directly from you, or from a family member or other person acting for you, including someone you have appointed under a Lasting Power of Attorney.

From your care home, where we are engaged by a care home to provide services to its residents. A home will usually give us your care plan, falls history, mobility status, medication list, and next of kin details, so that we can assess you safely. If we have assessed you, the home also tells us 6 and 12 months later how many falls it has recorded, usually as a total for the group rather than for you by name.

From your GP, consultant or another healthcare professional, where you have asked us to obtain it or have agreed to a referral.

From the place where you live, where we run classes there and you have asked to take part. The venue passes us your name and contact details only with your agreement. Your health information comes from you, at your assessment.

We must have a lawful basis under Article 6 of the UK GDPR for everything we do with your personal data, and an additional condition under Article 9 for health data.

Where you engage us directly as a private patient:
Article 6(1)(b), contract. We need your data to perform our agreement with you to assess and treat you.

Where we provide services in a care home you live in:
Article 6(1)(f), legitimate interests. Our contract is with the care home rather than with you, so we rely instead on our legitimate interest in delivering a safe, effective and properly recorded clinical service to the residents we are asked to see, and on the care home's legitimate interest in receiving the clinical information it needs to look after you safely. We have assessed this and concluded it does not override your rights and freedoms, because the processing is what you would reasonably expect from a physiotherapist treating you, is limited to what is clinically necessary, and is subject to the professional confidentiality duties we describe below. You can object to this processing at any time. See section 10.

Where you take part in one of our classes where you live and it is not a care home:
Article 6(1)(f), legitimate interests, for the same reasons as for care home residents. Our contract is with the venue, not with you. If you agree to the venue knowing that you are taking part, or seeing your own results, we rely on your consent for that sharing (Article 6(1)(a) and Article 9(2)(a)), and you can withdraw it at any time.

Where you contact us (by website form, phone, email, WhatsApp or social media) or book a call:
If you are asking about treatment for yourself or someone you act for, Article 6(1)(b), taking steps at your request before entering into a contract. If you are contacting us for an organisation, Article 6(1)(f), our legitimate interest in replying to enquiries and running our business. If you do not go on to book, we keep a short record of your enquiry under Article 6(1)(f), our legitimate interest in dealing with any follow-up and in understanding where our enquiries come from and how people hear about us.

In all cases:
Article 6(1)(c), legal obligation. To meet statutory and professional record-keeping requirements, including Health and Care Professions Council standards and tax law.

Article 6(1)(f), legitimate interests. To run and administer our business, prevent fraud, and carry out internal quality assurance, including checking how well our treatment and classes work using assessment results, falls diaries and falls counts.

Article 6(1)(a), consent. For marketing communications, and where we want to share your data with a third party who is not involved in your care.

For health data, we rely on Article 9(2)(h) of the UK GDPR: processing is necessary for the provision of health or social care or treatment, carried out by a health professional who is subject to a duty of professional confidentiality, in accordance with the Data Protection Act 2018. This includes checking how well our service works, which is part of managing a health service. Where we need to use your data to establish, exercise or defend a legal claim, we rely on Article 9(2)(f).

We rely on vital interests only in a genuine emergency where your life or someone else's is at risk and consent cannot be obtained.

Some of the people we treat are not able, at the time, to make or communicate a particular decision for themselves.

If that applies to you, we follow the Mental Capacity Act 2005. We start from the assumption that you can make your own decisions, and we take practical steps to help you do so, including explaining things simply and at the right time. Capacity is assessed for each specific decision, not once and for all.

If you are assessed as lacking capacity for a particular decision, we act in your best interests, and we involve the people who should be involved. That may be someone you appointed under a Lasting Power of Attorney, a deputy appointed by the Court of Protection, a family member or friend, or care home staff who know you well.

This policy is also available to your representative on request, and we will explain it to them if that is more useful than giving it to you directly. Being unable to make a decision about treatment does not remove your rights over your data. Those rights can be exercised on your behalf.

Clinical records: All clinical notes, assessments and treatment plans are held in a specialist electronic clinical records system, hosted on UK-based infrastructure and independently certified to the ISO 27001 information security standard. Data is encrypted in transit and at rest, access is role-based, and access is logged.

Exercise programmes: Where your physiotherapist prescribes a home exercise programme, it is created and delivered through a specialist exercise platform that acts as our data processor under a written contract. The platform is provided by a UK-registered company and your data is hosted in the United Kingdom. You may receive your programme through a secure link sent by email or text message, or through the provider's mobile app if you choose to use it. If you use the app, the provider may also process information about your exercise progress and any messages you send through it. The provider processes your data only on our instructions and is not permitted to use it for any other purpose.

Communications: Administrative correspondence goes through secure email. We do not store clinical records in personal email accounts.

Enquiries and business contacts: When you contact us by website form, phone, email, WhatsApp or social media, we keep a short record of your enquiry in a customer relationship management system: your name, how to contact you, your borough and the first half of your postcode, how you heard of us, and the outcome of your enquiry. We do not record health details there. Messages sent through our website forms also reach us by email and are held by our website platform. The contact details of people we work with at care homes and other organisations are held in the same customer relationship management system. These providers act as our data processors under written contracts, and none is used for clinical records. Online booking of a free call goes through our clinical records system.

Payments: Handled by a third-party provider that complies with the PCI-DSS payment security standard. We do not hold card details.

Backups: Encrypted backups are maintained by our systems provider.

Physical security: Any paper notes or equipment are kept secure when not in use, and paper is kept to a minimum.

Access control: Access is limited to those who need it to do their job. Where a self-employed associate clinician treats you, they have access to your record for that purpose and are bound by the same confidentiality and data protection obligations we are.

Your clinical records are stored in the United Kingdom.

Our clinical records provider is based outside the UK. In limited circumstances, such as technical support outside UK working hours, its staff outside the UK may need access to the systems your data sits in.

Some supporting services, such as email delivery, payment processing, our website platform, website analytics, our customer relationship management system and the messaging and social media services you contact us through, may also involve processing outside the UK.

Where personal data is accessed or processed outside the UK, we make sure a lawful transfer mechanism is in place. Depending on the provider and the country, that is either the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional safeguards a transfer risk assessment identifies as necessary.

You can ask us for more detail about where your data is held and who has access to it, and we will tell you.

We use AI tools in two limited ways.

Administrative AI. We may use general-purpose AI tools to help with internal administration, for example drafting correspondence or summarising information. Any patient information used for these purposes is anonymised or pseudonymised first.

Clinical documentation AI. Our clinical records system includes AI features that can transcribe a consultation in real time (only where you have agreed), and help draft or tidy clinical notes and correspondence.

Important points about this clinical use:

- Audio is processed in real time only and is never stored.

- Any temporary transcript is permanently deleted after 7 days.

- Every AI-generated draft is reviewed, edited and approved by a qualified Chartered Physiotherapist before it becomes part of your clinical record. An AI draft is never the final record.

- You can refuse the use of these features at any time. Refusing does not affect the care you receive; we will simply take notes manually.

- The AI processing takes place on servers in the UK, and nothing is kept by the AI service after processing. Your information is never used to train AI models. Our clinical records provider's support staff may occasionally need access from outside the UK; section 6 explains the safeguards.

- We do not use AI to make diagnoses, treatment decisions, or any other decisions that produce legal or similarly significant effects about you. There is always a qualified clinician in the loop.

We have carried out a Data Protection Impact Assessment for these AI features and keep it under review.

We never sell your data. We share it only as set out here.

Your care home, where we are engaged by the home to provide services to its residents. We share assessment findings, treatment recommendations, risk information, session records and progress reports. The home needs this so its staff can support you safely between our visits and can follow the plan we recommend. Where we provide reports about the service as a whole, for example falls rates across the home, we present that information so that individual residents cannot be identified from it, unless the report is specifically about your care.

The place where you live, if we run classes there and it is not a care home. With your agreement, the venue knows that you are taking part and whether you attend, so its staff can help you get to the class. It receives a summary of how the group did as a whole, with no names. It sees your own results only if you tell us it can.

Self-employed associate clinicians engaged by us to deliver your treatment. They are bound by written confidentiality and data protection obligations.

Your GP, consultant or referrer, and other healthcare professionals involved in your care, with your agreement.

Regulators, courts and legal bodies, including the Health and Care Professions Council, the Information Commissioner's Office and the courts, where the law requires it, where we have a safeguarding duty, or to protect someone's vital interests.

Safeguarding authorities, where we have a concern that an adult at risk is being harmed or is at risk of harm. We do not need your consent to raise a safeguarding concern, and we may not always be able to tell you that we have.

Our service providers, including our website platform, our website analytics service, our clinical records and online booking system, our exercise programme platform, our customer relationship management system, our email provider, IT support, and payment processing. These act on our written instructions under contracts that require them to protect your data.

The messaging and social media services you choose to contact us through, such as WhatsApp, Instagram, Facebook, TikTok or LinkedIn. They carry your messages to us and handle them under their own terms and privacy policies.

Our card payment provider also uses your payment details for its own purposes, such as preventing fraud and meeting its legal obligations. For that it acts as a separate controller, under its own privacy notice.

We may use information that has been anonymised, so that no one can be identified from it, to improve our services, for research, or for service reporting.

We keep your data only as long as we need it, or as long as the law requires.

Adult clinical records: at least 8 years after your last contact with us, in line with health records retention standards.

Records of a person who has died: at least 8 years after death.

Records of a patient under 18: until their 25th birthday, or their 26th if they were 17 when last treated.

Falls diary photos you email to us: saved to your clinical record, and the email deleted within 7 days.

Website analytics data: up to 12 months.

Marketing data: until you unsubscribe or withdraw consent.

Enquiries that do not lead to treatment or a contract: up to 2 years after our last contact, or up to 12 months if you did not reply to us.

Enquiry details of people who go on to become patients: up to 2 years after our last contact. Your clinical record is kept separately, as above.

Financial and tax records: 6 years, as required by tax law.

Once we have shared information with your care home, the home holds its own copy and applies its own retention rules to it. We cannot delete the home's copy, and a request to us to delete your data does not delete theirs. You can ask the home directly about its records.

Under UK data protection law you have the right to:

- Access: Ask for a copy of the personal data we hold about you.

- Rectification: Ask us to correct data that is wrong or incomplete. We cannot delete a clinical observation that was accurate when it was recorded, but we can record that you disagree with it, and we will.

- Erasure: Ask us to delete your data. This right is limited where we have a legal or professional duty to keep clinical records.

- Restriction: Ask us to limit how we use your data in certain circumstances.

- Portability: Ask for the data you gave us in a structured, commonly used, machine-readable format.

- Object: Object to processing we carry out on the basis of legitimate interests, including the care home processing described in section 3, and object at any time to direct marketing.

- Withdraw consent: Where we relied on your consent, withdraw it at any time. This does not affect anything we did before you withdrew it.

To exercise any of these, contact: dataprotection@steadymotionclinical.co.uk.

We will respond within one month. If your request is complex, or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we do. We may need to verify your identity first. There is no charge, unless a request is manifestly unfounded or excessive.

These rights can be exercised on your behalf by someone with authority to act for you.

Our website uses cookies.

Essential cookies are needed for the site to work, including security and remembering your cookie choice. They are set by our website platform, Squarespace, and do not need your consent.

Analytics cookies help us understand how visitors use the site, so we can improve it. They are set by Google Analytics, and only if you accept them.

We do not use advertising cookies.

You can change your choice at any time with the "Cookie Preferences" button that appears on our website once you have made a choice, or through your browser settings. Declining does not stop you using our forms or booking a call.

If you are unhappy with how we have handled your data, please tell us first at dataprotection@steadymotionclinical.co.uk. We would rather put it right ourselves.

You can also complain to the Information Commissioner's Office at any time. You do not have to come to us first.

Website: www.ico.org.uk

Helpline: 0303 123 1113

Address: Information Commissioner's Office, Wycliffe House, Water Lane,

Wilmslow, Cheshire, SK9 5AF

If your complaint is about our clinical service rather than your data, contact hello@steadymotionclinical.co.uk and we will deal with it under our complaints procedure. If you remain unhappy, you can raise concerns about a registered physiotherapist with the Health and Care Professions Council at www.hcpc-uk.org.

We may update this policy to reflect changes in what we do or in the law. The current version is always on our website. If we make a significant change, we will tell you where we hold your contact details.

We review this policy at least once a year.

Data protection: dataprotection@steadymotionclinical.co.uk

General enquiries: hello@steadymotionclinical.co.uk

Address: SteadyMotion Clinical Ltd, 124 City Road, London, EC1V 2NX

Company No. 17168626. ICO registration No. C1914166.