Privacy Policy

---

We are committed to protecting your privacy and ensuring the lawful, fair, and transparent handling of your personal data. This Privacy Notice explains how we collect, store, process, and safeguard your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the professional standards of the Health and Care Professions Council (HCPC).

1. Data Controller

Thrive Health Group LTD is the Data Controller responsible for your personal information.

Contact details:

info@thrivehealthgroup.co.uk

03332421305

If you have concerns regarding how your data is handled, please contact us in the first instance. You also have the right to raise matters with the UK Information Commissioner’s Office (ICO).

2. What Information We Collect

We collect personal and clinical information necessary to assess, plan, and deliver safe physiotherapy care, including but not limited to:

• Full name, address, contact details, date of birth
• Medical history, medication, injury details, and treatment notes
• Appointment details, location of home visits, and clinical assessments
• Payment details (secured through third-party platforms)
• Referral information, GP or consultant details where relevant
• Website browsing data (IP address, cookie usage, and analytics)

Because clinical records may include health information, this data is classified as Special Category Data under GDPR and must be processed with additional safeguards.

3. Lawful Basis for Processing

We process your data in accordance with the lawful bases set out in the UK GDPR. These may include:

• Article 6(1)(a) – Consent: when you submit information via forms or booking systems
• Article 6(1)(b) – Contract: to arrange and deliver physiotherapy sessions
• Article 6(1)(c) – Legal Obligation: record keeping, insurance, safeguarding, tax, or regulatory requirements
• Article 6(1)(f) – Legitimate Interest: administrative and operational functions

For health information, we rely on:

• Article 9(2)(h) – Processing is necessary for the provision of health or social care and treatment

We only collect what is necessary for safe care, record accuracy, and legal compliance.

4. Professional Standards & Confidentiality

As HCPC-registered professionals (or equivalent), we follow HCPC expectations for:

• Accurate and secure clinical record keeping
• Respecting confidentiality and privacy
• Only sharing data where justified, necessary, and lawful

Clinical records are retained only for the period required by national guidance and professional regulations.

5. How We Use Your Information

Your data is used for:

• Physiotherapy assessment, treatment, and clinical decision-making
• Maintaining accurate, contemporaneous clinical records
• Handling bookings, confirmations, and enquiries
• Managing payments and invoicing
• Liaising with other healthcare professionals (only with your consent or when legally required)
• Meeting HCPC, insurance, and safeguarding commitments

We will never use your data for marketing without explicit consent.

6. Sharing Your Information

We only share data where necessary, proportionate, and lawful. This may include:

• Other medical professionals involved in your care (with your consent)
• GP, specialist, or insurer if relevant to your treatment
• Secure digital systems (booking software, encrypted storage providers)
• Legal bodies or authorities when required by law or safeguarding duty

We do not sell data to third parties.

7. Data Storage, Retention & Security

We store personal and clinical data securely using encrypted systems with restricted access.

Data will be retained only for the legally required period. For adult health records, this is typically 8 years from the last treatment date (or longer for children or certain legal circumstances), in accordance with recognised healthcare standards.

When no longer required, data will be deleted securely.

8. Your Rights Under GDPR

You have the right to:

• Access your records
• Request rectification of any inaccurate information
• Request erasure (where legally appropriate)
• Restrict or object to certain forms of processing
• Data portability

You may withdraw consent at any time where consent is the lawful basis for processing.

To exercise any rights, please contact us. For security, we may ask you to verify your identity.

If dissatisfied with our response, you have the right to contact the ICO.

9. Online Bookings, Forms & Payments

When using our online booking or enquiry facility:

• Information is transmitted securely
• Only necessary data is requested
• Payments are handled by approved third-party processors
• We ensure contractual safeguards and GDPR compliance with any external providers

10. Cookies & Website Usage

Our website may use cookies or analytics to optimise usability and performance. These do not identify you directly. You may disable them via your browser if preferred.

11. Updates to This Notice

We may update this Privacy Notice periodically to reflect changes in law or operational practice. The latest version will always appear on this webpage.

12. Contact

To request further information, raise concerns, or exercise your rights:

Thrive Health Group LTD Email: info@thrivehealthgroup.co.uk Phone: 03332421305