Patient Privacy Policy

UK General Data Protection Regulation (UK GDPR)

O'Shea Physiotherapy

1. Who I am

This Privacy Notice explains how O'Shea Physiotherapy collects, uses and protects your personal information.

Data Controller: Lauren O'Shea trading as O'Shea Physiotherapy

Practitioner: Lauren O'Shea
Practice Name: O'Shea Physiotherapy
Website: www.osheaphysio.co.uk
Email: lauren@osheaphysio.co.uk
Phone: 07587 068 768

I am registered with the Health and Care Professions Council (HCPC) (Registration Number: PH114113) and I am a member of the Chartered Society of Physiotherapy.

2. What information I collect

I collect and process personal information necessary to provide safe and effective physiotherapy care. This may include:

  • Name, date of birth, address and contact details.

  • Gender and relevant demographic information (including ethnicity where clinically relevant)

  • Medical history, disability status and current symptoms.

  • Clinical notes from assessment and treatment sessions.

  • Appointment and payment information.

  • Communication records (including emails, telephone calls and messages)

3. How your information is collected

Your information may be collected when you:

  • Contact the practice by telephone, email, social media or through the website.

  • Book an appointment using Squarespace Scheduling (Acuity)

  • Attend an assessment or treatment appointment.

  • Complete forms or questionnaires provided by the practice

4. Why I collect your data

Your personal information is used to:

  • Provide safe and effective physiotherapy care.

  • Assess, diagnose and treat your condition.

  • Maintain accurate clinical records.

  • Manage appointments and payments.

  • Communicate with you regarding your care.

5. Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR), I process your personal data using one or more of the following lawful bases:

  • Performance of a contract for the provision of healthcare services.

  • Compliance with legal obligations (including accounting, safeguarding and regulatory requirements where applicable)

  • Legitimate interests in maintaining accurate clinical records and ensuring safe, effective professional practice.

  • Where special category health information is processed, this is done in accordance with Article 9 of the UK GDPR for the provision of health or social care.

6. How your information is stored

Your personal information is stored securely using password-protected electronic systems with appropriate technical and organisational security measures.

Where third-party service providers are used, such as Squarespace Scheduling (Acuity) for appointment bookings, they process information securely on my behalf in accordance with applicable data protection legislation.

Access to your records is strictly limited to the treating clinician unless disclosure is required by law or with your consent.

7. Sharing your information

Your information is treated as confidential and will only be shared when necessary, including:

  • With your explicit consent (for example, your GP, consultant or insurance provider)

  • Where required by law.

  • Where there are safeguarding concerns.

  • Where sharing is necessary to ensure safe and appropriate care.

  • The practice may also receive enquiries through third-party services such as Facebook, Google Business Profile or email.

  • Any personal information received through these services is handled in accordance with this Privacy Notice.

8. How long I keep your records

Clinical records are normally retained for 8 years after your treatment has ended, or longer where required by law or professional guidance, for example for children or where legal proceedings apply.

9. Your rights

Under UK data protection law, you have the right to:

  • Access your personal information.

  • Request correction of inaccurate information.

  • Request erasure where legally applicable.

  • Request restriction of processing.

  • Object to processing in certain circumstances.

  • Lodge a complaint with the Information Commissioner's Office (ICO)If you are unhappy with how your personal information has been handled, you have the right to complain to the Information Commissioner's Office (ICO).I am registered with the Information Commissioner's Office under registration reference ZC183295.

10. Website cookies

The practice website may use cookies and similar technologies to improve website functionality and user experience. Where applicable, further information is provided within the website's Cookie Policy.

11. Contact

If you have any questions about this Privacy Notice or how your personal information is handled, please contact:

Lauren O'Shea
Email: lauren@osheaphysio.co.uk
Phone: 07587 068 768

12. Updates

This Privacy Notice is reviewed regularly and may be updated from time to time. The most recent version will always be available on the practice website. Version: 1.0
Last Reviewed: July 2026