We are actively working on our GDPR strategy and considers this to be an ongoing process that will continue to develop beyond the enforcement date of 25th May 2018. We will continually strive to ensure that personal data privacy is embedded as routine practice.

Why we collect and process your personal data

Gateway Physiotherapy is a data controller. This privacy notice sets out our privacy policy.
We collect and process patients’ personal data for the purposes of healthcare.
Our legal bases for processing personal data for healthcare purposes include public task or legitimate interests.
Otherwise our legal basis is legitimate interests

The data we may collect and process

We will collect and store information about you when you visit our website; enquire about our products and services via an online form or by telephone; when you email us or when you meet with us.
When you visit our website, we will collect electronic ID data such as your Internet Protocol (IP) address. We collect information about your browsing
The personal data of patients that we may collect and process includes:
Your name, contact details and personal identifiers (such as date of birth and NHS number)
Your general health history, your family medical history, and any relevant medial information you tell us about
Details of therapy sessions and treatments we provide
Information relevant to your continued care from other people who care for you or know you well, such as other health professionals and relatives
habits on our websites using ‘cookies’.

How we hold and share your personal data

We process your personal data in strict confidence. We keep your personal data securely in our filing and electronic systems. Patient records are only accessible to the healthcare professionals that are working with you and those under their supervision.
We will usually keep any personal data we hold about you for ten years after our last contact with you before we delete it. This is the period recommended as good practice by the Chartered Society of Physiotherapy. If we collected the data when you were aged under 18 we will keep it until your 25th birthday, in line with NHS requirements. In exceptional cases we may need to retain personal data for a longer period, and will explain our reasons for doing so on request.
In the course of processing your personal data we may share it with:
The healthcare professionals working for gateway physiotherapy and those under their supervision
Healthcare professionals and those under their supervision at other physiotherapy practices, but only if you have specifically asked us to pass your personal data to them
Your GP, other healthcare providers and commissioners in connection with your ongoing healthcare treatment
Software providers for our patient record and invoicing systems, and financial institutions, so that we can keep patient records up to date and arrange payment for services provided to you

Your rights

You have legal rights in respect of the personal data we hold about you. The Information Commissioner’s Office (ICO) has published guidance on the full range of rights. The rights that are most relevant to the way in which we use your personal data include:
The right to be informed about how we use personal data – this privacy notice gives that information
The right to object – if you object to us processing your data for healthcare purposes where our legal basis is legitimate interests (see ‘why we collect and process your personal data’, above), we will then stop doing so, unless we are processing the data in respect of a legal claim or can otherwise show that our legitimate interest in processing the data overrides your rights and interests
The right of access – if you ask us for the personal data we hold about you we will provide it within a month, free of charge (unless we have already provided it to you, in which case we may have to charge you the administrative cost of providing it again).
The right to rectification – if you ask us to correct personal data about you that is inaccurate or incomplete, we will do so within a month (unless we need longer, in which case we will discuss this with you)
The right to erasure – also known as the ‘right to be forgotten’. If you ask us to delete your personal data, we will do so if there is no compelling reason to continue processing the data. We will not usually delete healthcare data before our usual time limit (see ‘how we hold and share your personal data’ above) where we have a duty to keep accurate records – for example, to comply with a legal obligation, or in connection with a legal claim. If you ask us to delete such data we will discuss this with you

Contacting us and the ICO about your personal data

Please speak to us first if you have any questions or concerns about the way in which we process personal data. You can contact Gateway Physiotherapy via email or in writing to Gateway Physiotherapy, 26 St Vincent Road, Pudsey, West Yorkshire, LS28 9EW.
You have the right to complain to the ICO if you have a concern about our handling of your personal data which you do not think we can resolve.