CORE Physio Privacy Policy
Privacy notice for patients, prospective patients and website visitors
Last updated: 14 September 2026
1. Who we are
This privacy notice explains how CORE Physio collects, uses, stores and shares personal information when you use our services, contact us or visit our website.
Our website is corephysio.uk.
For data-protection purposes, the clinic is responsible for personal information processed in connection with CORE Physio.
Clinicians working at the clinic may also keep their own professional records where appropriate and may have separate legal responsibilities for information they process in their professional capacity.
2. Information we collect
Depending on how you interact with us, we may collect:
- your name and contact details;
- date of birth;
- appointment information;
- emergency contact details;
- payment and billing information;
- private medical insurer and authorisation details; and
- correspondence with us.
Where necessary to provide physiotherapy or related healthcare services, we may also collect health information including:
- medical history;
- symptoms and injuries;
- diagnoses and treatment history;
- medication;
- relevant lifestyle information;
- clinical assessments;
- treatment plans and progress notes;
- outcome measures;
- consent information; and
- other information you provide to your clinician.
Health information is treated as special category personal data under UK data-protection law.
When you use our website, we may also receive technical information such as your IP address, browser and device information, pages visited and information about how you interact with the website.
3. How we obtain your information
We normally obtain information directly from you through booking and intake forms, consultations, treatment sessions, telephone calls, email and other communications.
Where appropriate, we may also receive information from a parent or guardian, another healthcare professional, your insurer, or another person or organisation involved in your care or payment for treatment.
4. How and why we use your information
We use personal information to:
- arrange and manage appointments;
- assess, provide and document treatment;
- communicate with you about your care;
- manage referrals and clinical correspondence;
- process payments and insurance claims;
- maintain appropriate clinical and business records;
- respond to enquiries and complaints;
- protect patients, staff and the clinic;
- operate and improve our services; and
- comply with professional, regulatory, tax, accounting and legal obligations.
We only use personal information where we have a lawful basis to do so. Depending on the circumstances, this may include performance of a contract, compliance with a legal obligation, our legitimate interests, or your consent where consent is required.
For health information, we also rely on an appropriate condition permitting the processing of special category data, including where processing is necessary for the provision or management of health care by or under the responsibility of a healthcare professional.
5. Clinical records
We maintain clinical records so that we can provide safe, effective and appropriately documented care.
Records may include information supplied by you as well as clinical observations, assessments, treatment provided, advice, consent, communications and relevant documents.
Our standard retention period for clinical records is 8 years.
Where a longer retention period is required or appropriate — for example because of a patient's age, an ongoing legal or regulatory requirement, or another justified reason — records may be kept for longer.
Other categories of information may be retained for different periods according to their purpose and applicable legal requirements.
6. Systems and service providers
We use trusted third-party providers to help operate the clinic and deliver our services. These include:
- Splose for practice management and clinical administration;
- Stripe for payment processing;
- Physitrack for exercise programmes and patient engagement;
- Healthcode where relevant to insurer billing; and
- Google services for business communications and administration.
These providers may process personal information on our behalf or, in some circumstances, as an independent controller.
We share only information reasonably necessary for the relevant purpose and expect providers handling information on our behalf to protect it appropriately.
7. Insurers, healthcare professionals and other disclosures
Where relevant to your care or payment for treatment, we may share appropriate information with:
- private medical insurers;
- referring or treating healthcare professionals;
- diagnostic providers; and
- other organisations involved in your care.
We may also disclose information where required by law, regulation, court order or professional obligation, or where necessary to protect someone's vital interests or address a serious safeguarding concern.
We do not sell your personal information.
8. Payments
Payments may be processed using third-party payment services such as Stripe and payment functionality associated with our practice-management systems.
Payment providers may collect and process payment-card and transaction information in accordance with their own privacy terms.
CORE Physio does not need to retain full payment-card details to process ordinary card payments.
9. Website, cookies and analytics
When you visit corephysio.uk, certain technical information may be collected automatically, such as your IP address, browser type, device information, pages visited and information about how you interact with our website.
We may use this information to operate and secure the website, diagnose technical problems and understand how the website is being used.
Our website uses cookies and similar technologies. Some cookies are necessary for the website to function correctly.
We also use Google Analytics to help us understand how visitors use the website, such as which pages are visited and how visitors navigate the site.
Where required, non-essential analytics cookies will only be used with your consent. You can accept or reject non-essential cookies using the cookie controls provided on our website and can also manage cookies through your browser settings.
Pages on our website may contain content provided by third parties, such as videos, maps or other embedded content. When you interact with such content, the third-party provider may receive information about your visit and may use cookies or similar technologies in accordance with its own privacy policy.
10. International transfers
Some technology providers we use may process or store information outside the United Kingdom.
Where personal information is transferred internationally, we take reasonable steps to ensure that an appropriate legal mechanism and safeguards are in place where required by UK data-protection law.
11. Keeping information secure
We take reasonable technical and organisational measures to protect personal information against accidental or unlawful loss, misuse, alteration, unauthorised access or disclosure.
Access to patient information is limited to people who need it for legitimate clinical, administrative or legal purposes.
12. Your data-protection rights
Depending on the circumstances, you may have rights to:
- ask us for access to your personal information;
- correct inaccurate or incomplete information;
- ask us to erase information;
- restrict or object to certain processing; and
- receive certain information in a portable format.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Some rights are subject to legal exemptions. In particular, we may need to retain clinical, financial or other records even after an erasure request where there is a lawful reason or obligation to keep them.
13. Children and young people
We may provide services to children and young people and process information necessary for their care.
Depending on age, capacity and the circumstances, information and consent may be obtained from or shared with a parent or person with parental responsibility, while also respecting the young person's confidentiality and legal rights.
14. Contacting us and complaints
If you have a question about this privacy notice, want to exercise a data-protection right, or have a concern about how we use your information, please contact CORE Physio using the contact details published on corephysio.uk.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
We would welcome the opportunity to address your concern directly first, but you are not required to contact us before approaching the ICO.
15. Changes to this privacy notice
We may update this privacy notice from time to time to reflect changes in our services, systems, legal requirements or how we process personal information.