R3 Physiotherapy – Privacy Policy

R3 Physiotherapy Limited · Last updated: 26 October 2026

1. Who we are

1.1 This policy explains how R3 Physiotherapy collects, uses, shares and protects your personal information when you visit r3physiotherapy.com, book or receive treatment, buy a Subscription, Package or product, join our mailing list or Wellness Walking Community, or contact us.

1.2 R3 Physiotherapy Limited (company number 10165426) is the data controller for your personal information. Our registered office is Kemp House, 124 City Road, London EC1V 2NX, and our clinic is at Quaker Meeting House, Bush Road, London E11 3AU. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB160888.

1.3 Our Data Protection Lead is Ryan Johnson, Director. For any privacy question, or to exercise your rights, contact us at care@r3physiotherapy.com, by phone on 07723 559803, or by post to our registered office.

1.4 Our clinicians are registered with the Health and Care Professions Council (HCPC) and follow its standards on confidentiality, as well as UK data protection law (the UK GDPR and the Data Protection Act 2018).

2. What we collect

2.1 Identity and contact details: name, date of birth, address, email, phone number, emergency contact and GP details.

2.2 Health information: medical history, symptoms, injuries, medication, test results, treatment notes, functional scanner and posture assessments, photos or videos taken for assessment (only with your written consent), exercise programmes, and information from dietitian, personal training and psychotherapy Sessions. Health information is “special category” data and receives extra protection under the law.

2.3 Consultation audio: if you agree to AI-assisted note-taking (see 3.6), an audio recording of your Session and the draft notes produced from it.

2.4 Insurance information: insurer name, policy and membership number, and authorisation codes.

2.5 Booking and payment information: appointments, attendance, cancellations, Subscriptions and Packages bought, and payment records. Card details are handled by our payment providers (Stripe, PayPal, Klarna); we do not store your full card number.

2.6 Communications: emails, texts, calls, messages and any feedback or complaints you send us.

2.7 Call recordings: we may record phone calls for quality, training and to resolve disputes. We will tell you at the start of the call and ask for your agreement.

2.8 CCTV: where CCTV operates at our premises, images of people in the covered areas. Signs show where it is in use.

2.9 Social media messages: your public profile details and the content of any messages you send us through Facebook, Instagram, X, LinkedIn or TikTok. Please do not send health details this way.

2.10 Website and device data: IP address, browser and device type, pages visited and how you use our site, collected through cookies (see Section 8).

2.11 Marketing preferences: whether you have signed up to our mailing list, and your choices about receiving marketing.

2.12 Job applicants and contractors: if you apply to work with us, your CV, qualifications, HCPC registration, references and DBS check results.

2.13 Where it comes from. Most information comes from you directly. We may also receive information from your GP, consultant or other healthcare professionals, your health insurer, an employer or solicitor who has referred you, a parent or guardian, and our payment and booking providers.

3. How we use your information and our lawful basis

3.1 We only use your information where the law allows. For health information we also rely on an additional condition for special category data, shown in the table.

3.2 Where we rely on consent, you can withdraw it at any time by contacting us or using the unsubscribe link in any email. Withdrawing consent does not affect anything we did before.

3.3 Marketing. We will only send marketing with your consent, and we never sell your information. We will still send service messages, such as appointment reminders, renewal reminders and payment notices, because they are needed to provide your service.

3.4 If you do not give us information we need (for example, your medical history), we may not be able to treat you safely.

3.5 We do not make decisions about you by automated means alone.

3.6 AI-assisted note-taking. With your agreement, your clinician may use Heidi (provided by Heidi Health Pty Ltd), an AI tool that transcribes the audio of your Session and drafts clinical notes. Your clinician reviews, corrects and approves every note before it is saved to your record; the AI does not make any decision about your care. We have completed a Data Protection Impact Assessment for this tool and review it every 6 months. The audio is deleted within 30 days. You can decline, or withdraw your agreement at any time, by telling your clinician or contacting us, and your care will not be affected.

4. Who we share your information with

4.1 We share only what is needed, and never sell your personal information. We may share it with:

• Clinicians working with R3 Physiotherapy involved in your care, including employed and self-employed physiotherapists, personal trainers, dietitians and psychotherapists. All are bound by confidentiality.
• Your GP, consultant or other healthcare professionals, with your consent, or without it where clinically necessary (for example, if you have symptoms needing urgent medical attention).
• Your health insurer (such as Bupa, WPA, Simplyhealth, Medicash or Proclaim Care), if you are claiming through them, to obtain authorisation and payment.
• Whoever referred you (for example, an employer), only with your consent.
• Your solicitor or a court, for medico-legal reports or litigation, only with your signed authority or a court order.
• Our service providers, who process data only on our instructions under a written data processing agreement: Carepatron (clinical records and online booking), Heidi Health (AI transcription, only if you agree), GoHighLevel (appointment reminders, messages and marketing emails), Microsoft 365 (email), Xero and our accountants (finance), Stripe, PayPal and Klarna (payments), our website host, and Google Analytics (website statistics, only if you accept cookies).
• Social media platforms (Meta, X, LinkedIn, TikTok), only for messages you send us there.
• Safeguarding authorities, including the London Borough of Waltham Forest Multi-Agency Safeguarding Hub and the Local Authority Designated Officer, where there is a concern about a child or adult at risk.
• Regulators and authorities: the HCPC (fitness to practise), the ICO (data protection), HMRC (tax; financial records only, no clinical information), and the police or courts where the law requires it or there is a serious risk of harm.
• Our insurer (Hiscox), solicitors and professional advisers, where needed for claims, complaints or legal advice.
• Debt recovery agents, if amounts owed under our Terms and Conditions are not paid.

4.2 If our business is sold or restructured, your information may transfer to the new owner, who must continue to protect it under this policy.

Transfers outside the UK

4.3 Our clinical records system, Carepatron, stores your records in the UK. Some other providers are based outside the UK, including Heidi Health (Australia) and GoHighLevel, Google and Meta (United States), so your data may be processed outside the UK. When that happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, the UK–US Data Bridge, or the provider’s contractual safeguards and UK or approved data hosting. You can ask us for details.

5. How long we keep your information

5.1 We keep information only as long as needed, in line with the law and guidance from our professional bodies:

5.2 We may keep records for longer where there is an ongoing complaint, investigation or legal claim. After these periods, we securely delete or destroy your information, or anonymise it so it can no longer identify you.

6. Keeping your information secure

6.1 We protect your information with appropriate technical and organisational measures. These include: multi-factor authentication and unique passwords on all systems; encrypted, access-controlled cloud systems with audit trails showing who viewed or changed a record; written data processing agreements with every provider; locked storage for any paper records; annual data protection training and confidentiality obligations for all staff and contractors; and a ban on using WhatsApp or personal messaging apps for patient information. We have written procedures for responding to data breaches and cyber incidents.

6.2 No system is completely secure. We record every data breach. Where required, we report a breach to the ICO within 72 hours of becoming aware of it, and if it is likely to put you at high risk, we will tell you without undue delay.

6.3 Please do not send detailed health information by unencrypted email or social media messages unless you are comfortable doing so. We may contact you by email or text about your appointments unless you ask us not to.

7. Links to other websites

7.1 Our website links to other sites, including our payment providers and social media. We are not responsible for their privacy practices, so please read their policies.

8. Cookies

8.1 Our website uses a small number of cookies. Strictly necessary cookies are always on. Analytics cookies are only set if you choose to accept them. We do not use marketing or advertising cookies, social media tracking pixels or retargeting; if we ever do, we will ask for your consent first.

8.2 Google Analytics collects your IP address (shortened for UK visitors), device and browser type, pages visited, time on site, how you found us and approximate (city-level) location. It does not receive any health or patient information, and we have turned off Google’s use of this data for its own advertising.

8.3 When you first visit, our cookie banner lets you Accept All, Reject Non-Essential or Manage Preferences. Nothing is pre-ticked, and the site works fully whichever you choose. You can change your mind at any time using the Cookie Settings link in the footer of every page, or by emailing us. We will ask again after 12 months or if our cookies change.

8.4 We never place cookies or tracking code in a way that shares your health information or treatment details with advertisers.

9. Children and young people

9.1 We treat children and young people under 18. They must be accompanied at every Session by a parent, legal guardian or another adult authorised by them, and a parent or guardian gives consent to treatment. We collect the child’s information and the contact details of the parent or guardian. Young people aged 16 or over, and younger children who fully understand their treatment (Gillick competence), are also asked for their own consent and may exercise their own data protection rights. Where a young person is competent, we will normally ask them before sharing confidential details with a parent, unless there is a safeguarding concern. Our website is not intended for children to buy from directly.

10. Your rights

10.1 You have the right to access, correct or delete your information, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time. Some rights are limited for clinical records we are required to keep. To make a request, contact us at care@r3physiotherapy.com.

11. Complaints

11.1 If you have a concern about how we handle your information, please contact us. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

12. Changes to this policy

12.1 We may update this policy from time to time. The latest version will always be on this page with its “last updated” date. If we make significant changes that affect how we use your information, we will tell you by email or a notice on our website.