Privacy Policy for Flexibility Matters Physiotherapy's Client

Last revised March 2025

1. DATA  CONTROLLER

For the purpose of the DPA and GDPR the Data Controller is Flexibility Matters Ltd trading as Flexibility Matters Physiotherapy. Our registration Number in the Data Protection Public Register is ZB336660. Flexibility Matters Ltd is committed to protecting your personal information and being transparent about what information we hold in accordance with the Data Protection Act and the General Data Protection Regulations.

Definitions of terms within this privacy notice “we”, “our”, “us”, “Company” is a direct reference to Flexibility Matters Ltd.

2. OVERVIEW

This Policy applies specifically to information held about clients of Flexibility Matters Physiotherapy. This privacy policy applies to the Flexibility Matters Physiotherapy website https://www.fmphysio.com/ (the “Website”). At Flexibility Matters Physiotherapy we take your privacy seriously. This policy covers the collection, processing and other use of personal data under the Data Protection Act 1998 (“DPA”) and the General Data Protection Regulations (“GDPR”), that came into force on 25th May 2018.

3. PRIVACY STATEMENT

Your privacy is important to Flexibility Matters Physiotherapy. We developed this privacy statement to inform you how we use the personal data we collect from you via paper records and our Cliniko Online page. This is the only part of our website that collects any data on you and the only data collected is that which is provided by you.

“Personal data” is information relating to an identified or identifiable natural person.

By using the Website you consent to this policy.

4. INFORMATION WE COLLECT

We will collect personal data on this Website only if it is directly provided to us by you the user via the registration form, for example, your name, e-mail address, telephone number and gender, and any other personal information you freely give in both the appointment option message and registration information, and therefore has been provided by you with your consent.

We will collect sensitive personal data on your medical history, and record information after your treatment on what has been medically diagnosed and what treatment has taken place during your session. Anything you disclose during treatment may be recorded in your notes if deemed appropriate. The clinic uses both electronic and paper records where your data may be stored.

We also use analytical and statistical tools that monitor details of your visits to our website and the resources that you access, including, but not limited to, traffic data, location data, weblogs and other communication data (but this data will not identify you personally).

Visit counts. Our website counts how many times each page is viewed, how often a Book button is clicked and how many forms are started, as daily totals, with no cookies and nothing that could identify you: no IP address and no device ID. If your browser asks websites not to track you, you are not counted. If you accept cookies, we also keep a log of your own visits and use Microsoft Clarity and Google Analytics (section 10).

We engage Balance VA Ltd to provide certain administrative functions for us, including but not limited to answering our phones and booking appointments in our diaries. They are required to respect the security of your personal data and to treat it in accordance with the law.

5. LAWFUL BASIS AND HOW WE USE YOUR INFORMATION

We may hold and process personal sensitive data that you provide to us in accordance with the DPA and GDPR.

We will use staff data for all purposes associated with the administration of the service provider/customer contract and relationships. The purposes for which we may use your data (including sensitive personal information) we collect during a customer’s association with us include:

• maintaining customer records
• administering finance (e.g. customer sales)
• providing health treatments and services
• complying with statutory requirements (e.g. monitoring equal opportunities and processing and responding to subject access requests and information requests and complying with our obligations under our publication scheme)
• carrying out research, surveys and statistical analysis (including using third-party data processors to carry out benchmarking and surveys for us)
• providing operational information
• promoting our services and other operational reasons on our website where appropriate, handling external business calls via our reception team and any enquiry service we may use and taking or commissioning photographs or films on campus or at TL events for promotional purposes
• safeguarding and promoting the welfare of customers
• ensuring the safety and security of our customers
• preventing and detecting crime
• dealing with complaints
• carrying out audits

The information that we collect and store relating to you is primarily used to enable us to provide our services to you, and to meet our contractual commitments to you.

If you have consented, we may use the information you have given to contact you with services and products that we can provide.

Follow-up emails. If you leave your email address on one of our service pages or in the booking questions on our home page, to start booking or to get a free guide, we keep your email address, first name, which page you used (from the booking questions, also which appointment and practitioner you were looking at), whether you asked for tips, and which of our emails we have sent you. We use this to send you a short series of emails about that service (a reminder two hours after you start booking, then up to four more over the next month; for a guide, the guide itself and, only if you tick the box, a few tips). Before each email we check our booking system (Cliniko) to see whether you have booked; once you have, the emails stop. Our lawful basis is your consent (when you ask for the guide or tips) and our legitimate interest in following up a booking you started. The emails are sent by Resend, our email provider, which holds your email address and first name while they run; the details are also stored by Netlify, our website host. We delete your details 45 days after the last email in the series. Every email has an unsubscribe link; if you use it, Resend keeps your email address marked as unsubscribed so we never email you again.

Messages sent through our website. When you send us a question, an enquiry or a message through a form on this website, we email it to our clinic inbox and also keep it in our website's private dashboard, so our physiotherapists can read and answer it there. Only our physiotherapists and the person who looks after our website can see it. We delete it from the website 90 days after the last message about it; the email copy is kept with the rest of our clinic correspondence. If you tell us about your health, we use it only to answer you and to arrange your care. The website is hosted by Netlify, and our replies are sent by Resend.

Booking on our website. When you book on our website, the details you give us (your name, email address, mobile number and date of birth) go straight into your patient record in Cliniko, our clinic system, and are not kept by the website itself. If you save a card, it is held by Stripe, our payment provider, and we never see the full card number. We only charge it if you miss your appointment or cancel with less than 48 hours’ notice, as our cancellation policy says. Our lawful basis is taking the steps you ask for before we treat you. We send you a confirmation email through Resend, and our team gets a short note that you have booked.

The chat on our website. If you use the chat in Contact Us, your messages and the assistant’s answers are processed by Anthropic, which provides the AI that writes the answers, and kept by us for 30 days after your last message so our team can see what people ask and improve our answers; then they are deleted. Please don’t put health details in the chat: for anything personal, use “Email the team” or email info@fmphysio.com. The chat doesn’t ask for your name or contact details.

6. DISCLOSURE OF YOUR INFORMATION

We may disclose your information to regulatory bodies to enable us to comply with the law and to assist fraud protection and minimise credit risk.

7. WHERE WE STORE AND TRANSFER YOUR DATA

As we use remote servers, which may be based outside of the EEA, for our Website and Email system, the information you provide to us via the registration form may be transferred to and stored in countries outside of the European Economic Area (EEA) – this is generally the nature of data stored in “the Cloud”. It may also be processed by staff operating outside the EEA who work for one of our suppliers, e.g. our website server host, or work for us when temporarily outside of the EEA.

You have the right to opt out of our processing of your personal data for marketing purposes by contacting us at info@fmphysio.com

8. SECURITY

The transmission of information via the Internet or email is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of data while you are transmitting it to our site; any such transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access.

9. THIRD-PARTY LINKS

You might find links to third-party websites on our website. These websites should have their own privacy policies, which you should check. We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

10. USE OF COOKIES

We only set the cookies below if you choose Accept in our cookie banner. You can change your mind at any time with Cookie settings at the bottom of every page; choosing No thanks deletes them and the log of your visits.

This website uses cookies. A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. You can read more about cookies at https://aboutcookies.org. The cookies we use allow us to monitor the use of the website and to improve our service offering.

Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can obtain up-to-date information about blocking and deleting cookies at https://aboutcookies.org.

The cookies we use and the purposes for which we use them are:

• Our own visit log (cookie fm_vid, kept for 6 months): a random number that lets us see which of our pages you view, which Book buttons you click and which forms you start, and the website you came from. If you then leave your email address with us (for a guide or to start booking), we link that log to your email so we can see what you were looking for and follow up helpfully. It is deleted with your other details 45 days after our follow-up emails to you end, or 90 days after your last visit if you never leave your email.
• Microsoft Clarity (cookies _clck and _clsk): records how pages are used, such as where people tap and how far they scroll, so we can see what is confusing and fix it. Clarity hides what you type in forms. We give it the same random number as our visit log, never your name or email. Microsoft’s privacy statement: https://privacy.microsoft.com/privacystatement.
• Google Analytics (cookies _ga and _ga_, kept for 6 months): reports on how many people visit, where they come from and which pages they use. We switch off advertising features, and we give it the same random number, never your name or email. Google’s privacy policy: https://policies.google.com/privacy.
• Your answer to the cookie banner is kept in your browser’s storage for 6 months, so we do not ask again on every page.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies. For example, when displaying our Twitter timeline on the website Twitter will use their own cookies.

11. YOUR RIGHTS

The DPA and GDPR give you the right to access information held about you by us. Please write to us or contact us by email if you wish to request confirmation of what personal information we hold relating to you. You can write to us by emailing info@fmphysio.com.

There is no charge for requesting that we provide you with details of the personal data that we hold. We will provide this information within one month of your requesting the data.

If you have not entered into a contract with us to provide you with health services, you have the right to change the permissions that you have given us in relation to how we may use your data. You also have the right to request that we cease using your data or that we delete all personal data records that we hold relating to you. You can exercise these rights at any time by emailing info@fmphysio.com.

12. CHANGES TO THIS POLICY

We may update these policies to reflect changes to the website and customer feedback. Please regularly review these policies to be informed of how we are protecting your personal data.

13. CONTACT

We welcome any queries, comments or requests you may have regarding this Privacy Policy. Please do not hesitate to contact us at info@fmphysio.com.