Legal

Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Hilltop Home-Based Physiotherapy Services ("we", "us", "our") collects, uses, and protects your personal data when you visit our website or use our physiotherapy services, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Hilltop Home-Based Physiotherapy Services is the data controller responsible for your personal data.

• Address: Greater Manchester
• Email: info@hilltop-physio.com
• Phone: +447957818901

2. Information We Collect

a) Information you give us directly

• Contact details (name, email address, phone number) submitted via our contact form or by phone/email
• Appointment and referral details
• Health information relevant to your treatment (e.g. medical history, mobility, current conditions), collected only with your consent as part of providing physiotherapy care

b) Information collected automatically

• Basic technical data (browser type, device type, pages visited) via standard web server logs and, if enabled, cookies or analytics tools

3. How We Use Your Information

• To respond to enquiries submitted through our contact form
• To arrange, deliver, and follow up on physiotherapy appointments
• To maintain accurate clinical records, as required by professional (HCPC/CSP) standards
• To meet our legal and regulatory obligations
• To improve our website and services

4. Legal Basis for Processing

We process your personal data under one or more of the following legal bases: your consent (particularly for health data), the performance of a contract (delivering the physiotherapy service you have booked), our legal obligations (e.g. clinical record-keeping requirements), and our legitimate interests (e.g. responding to general enquiries).

5. Special Category Data (Health Information)

Health-related information is "special category data" under UK GDPR and receives extra protection. We only collect and process health information with your explicit consent, and only for the purpose of providing safe, effective physiotherapy care. It is stored securely and access is limited to those directly involved in your care.

6. Sharing Your Information

We do not sell your personal data. We may share limited information with:

• Your GP or other healthcare professionals involved in your care, with your consent or where necessary for your treatment
• Trusted service providers who support our operations (e.g. email/SMTP providers used to deliver enquiry emails), under appropriate confidentiality obligations
• Regulatory or legal authorities, where required by law

7. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected. Clinical/health records are generally retained in line with professional guidance (commonly a minimum of 8 years for adult patients in the UK, or longer where indicated by relevant professional body guidance), after which they are securely deleted or anonymised.

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data, where applicable
• Restrict or object to certain processing
• Request data portability
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us using the details above.

9. Cookies

Our website may use essential cookies required for basic functionality. If we introduce analytics or marketing cookies in future, we will update this policy and, where required, request your consent.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure.

11. Complaints

If you have concerns about how we handle your personal data, please contact us first. You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "last updated" date above reflects the most recent revision.

---