Armstrong's Hand Therapy & Physiotherapy

Hempstead, Kent

Privacy Policy

Armstrongs Hand Therapy and Physiotherapy is committed to protecting the privacy and security of your personal and health information. I am registered as a Data Controller with the Information Commissioner’s Office (ICO) under registration number ZB800652.

This Privacy Policy outlines how I collect, use, disclose, and safeguard your information when you visit my website, communicate with me, receive clinical treatment, or interact with my public profiles.

Information I Collect

I only collect personal and health information that is strictly necessary to provide clinical care and manage my practice:

  • Personal Details: Name, date of birth, email address, telephone number, home address, and emergency contact details provided when contacting me or booking appointments.
  • Clinical & Health Data: Medical history, current symptoms, physical assessment findings, treatment plans, GP/consultant details, and clinical notes recorded during or following your sessions.
  • Public Reviews & Feedback: Testimonials, ratings, or reviews you choose to post on public platforms (such as Google Reviews or Facebook).

Website Cookies

  • No Tracking Cookies: My website does not use tracking, analytical, or advertising cookies, nor do I track your browsing activity.

How I Use Your Information

I use your information strictly for essential clinical, administrative, and practice promotional purposes:

  • Clinical Care & Notes: To assess, plan, and deliver your hand therapy and physiotherapy treatment.
  • Invoicing & Payments: To issue invoices and manage payment records for your appointments.
  • Referral Letters: To write necessary clinical referral letters or reports (e.g., to your GP, consultant, or insurance provider), solely with your consent.
  • Communication: To send appointment confirmations, reminders, and invoicing updates.
  • Practice Feedback & Social Media: To feature public reviews (e.g., Google Reviews) on my practice website and official social media channels to showcase patient experiences.

I do not send promotional emails, newsletters, or marketing communications, nor do I sell or share your data with third parties for commercial advertising.

Lawful Basis for Processing Data

Under UK GDPR, I am required to state the specific legal grounds used to collect and process your information:

  • Personal Details: Processed under Article 6(1)(b) (necessary to perform our contract for clinical services) and Article 6(1)(f) (legitimate interest for essential practice management like appointment scheduling and invoicing).
  • Clinical & Health Data: Health data is classified as sensitive “Special Category Data.” It is processed under Article 9(2)(h) (necessary for the provision of healthcare and management of health systems, adhering to my professional duties set by the Health and Care Professions Council [HCPC] and the Chartered Society of Physiotherapy [CSP]).
  • Public Reviews & Feedback: Processed under Article 6(1)(f) (Legitimate Interests) for displaying patient feedback, and Article 9(2)(e) where you have voluntarily made health-related information public by posting a review on a public platform (such as Google).

Public Reviews and Social Media

If you choose to post a review or rating on a public platform (such as Google Reviews or my public Facebook page):

  • Re-sharing Public Feedback: Because this information has been made public by you, I may feature these reviews on my website or official practice social media channels (e.g., Facebook, Instagram) to display patient outcomes and clinical feedback.
  • Anonymity & Privacy: When creating graphics for social media featuring public reviews, I will typically display first names or initials only to safeguard your broader online privacy.
  • Removal Requests: If you would like a social media post or website item featuring your public review to be taken down, please email [email protected] and it will be removed promptly where technically feasible.

Secure Note-Taking & Technology Processors

To maintain accurate, secure, and encrypted clinical records, I use dedicated software platforms:

  • Practice Management System (WriteUpp): Your personal details, invoices, and clinical notes are securely stored within WriteUpp, a cloud-based practice management platform compliant with UK GDPR and ICO guidelines. Data is encrypted both in transit and at rest.
  • AI-Assisted Documentation (Heidi AI): During or immediately following sessions, I may use Heidi AI to assist with clinical note transcription. Heidi AI processes session audio solely to generate clinical documentation. It complies strictly with UK GDPR and health data standards. Audio recordings are processed securely, and your personal health data is never used to train public AI models.

Disclosure of Your Information

I do not sell, rent, trade, or pass on your personal information to third parties for marketing or any other commercial purposes. Information is only shared under the following limited circumstances:

  • Medical Referrals: To health professionals (e.g., GP, consultant, or insurer) with your explicit consent.
  • Legal Requirements: If required by law or regulatory obligation.

Data Security & Storage Retention

I implement robust technical security measures to protect your personal and clinical data. All electronic records are held within password-protected, encrypted systems complying with note storage regulations outlined by the Information Commissioner’s Office (ICO).

In accordance with Chartered Society of Physiotherapy (CSP) and Health and Care Professions Council (HCPC) standards, clinical records are retained for mandatory statutory periods before secure deletion:

  • Adult Patients (18+): Retained for 8 years following the date of your last treatment.
  • Children and Young People (under 18): Retained until the patient’s 25th birthday (or 26th birthday if treated at age 17), or 8 years after their last treatment, whichever is longer.
  • Specialized Cases (Mental Capacity / Complex Disabilities): Retained for up to 20 years after the last entry.

Your Legal Rights

Under UK data protection law (UK GDPR), you have specific rights regarding your data:

  • Right of Access: Request a copy of the personal details and clinical records I hold about you.
  • Right to Rectification: Ask for inaccurate or incomplete personal information to be updated.
  • Right to Erasure: Request the deletion of your personal data. (Note: This right is qualified in healthcare; I am legally required to retain medical records for mandatory statutory periods as outlined above).
  • Right to Restrict Processing: Request to temporarily restrict the processing of your data in specific circumstances.
  • Right to Object: Object to the processing of your data. (Note: Because I do not engage in direct marketing, processing is limited strictly to necessary clinical care and legal record-keeping).
  • Right to Data Portability: Request a copy of the personal data you provided directly to me in a structured, commonly used electronic format.
  • Automated Decision-Making: Tools like Heidi AI are used strictly to transcribe drafts; all medical decisions and final records are made and reviewed directly by me.

Updates to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my practice software or legal regulations. Updated versions will be posted directly to this page.

Contact Me & Regulatory Information

If you have any questions, concerns, or requests regarding this Privacy Policy or my privacy practices, please contact:

Armstrongs Hand Therapy and Physiotherapy

ICO Registration Number: ZB800652

Phone: 07393 613 062

Email: [email protected]

Location: Hempstead, Kent

You also have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).