Privacy Policy

We are Medella Home Physio & OT. We take the privacy of patients, referrers, applicants, and website visitors seriously. This notice explains what we collect, why we use it, and the choices available to you.

A. Website and enquiry data

Depending on how you use the site, we may collect:

• Patient and family enquiries: name, email address, phone number, visit postcode, and the message you choose to send.
• Professional enquiries: name, work contact details, organisation, role, broad enquiry purpose, area, timing, preferred response, and a brief outline. The form tells referrers not to send clinical records or detailed health information at this stage.
• Website statistics: pages viewed, broad location, device/browser type, referring source, and selected interactions. We use this to understand and improve the website, not to make decisions about individual visitors.
• Advertising measurement: form completions and clicks to call or message may be counted in Google Ads and Microsoft Advertising. Event names and page context are used; we do not send the contents of an enquiry, names, contact details, diagnoses, or clinical information to analytics or advertising tools.
• Security information: Cloudflare and Cloudflare Turnstile process limited technical information to protect the site and forms from abuse.

We use Google Search Console for aggregated search-performance reporting. Search Console does not set cookies in your browser when you visit this website.

B. Recruitment and joiner data

If you use the unlisted joiner form, we process the information needed for recruitment, contracting, professional checks, workforce planning, references, and onboarding. This may include identity and contact details, date of birth, address, professional registrations, availability, emergency-contact and referee details, and information you choose to provide about adjustments or health matters relevant to the role.

C. Clinical and patient data

If you become a patient, or are arranging care for someone else, we may process special category health data, including medical history, current health conditions, relevant GP or consultant details, treatment notes, and rehabilitation progress.

We process clinical data where necessary for the provision of health or social care under Article 9(2)(h) UK GDPR and the related duties that apply to healthcare professionals.

Patient clinical notes are not stored in the public website. We use specialist providers for different parts of the service:

• Website hosting and form protection: Cloudflare Pages, Workers, and Turnstile.
• Enquiry delivery: Brevo sends form notifications and confirmations; Microsoft 365 is used for business email and communication.
• Clinical notes: WriteUpp, an ISO 27001-certified practice-management system used by healthcare professionals.
• Invoicing: Xero.
• Payments: Stripe and GoCardless. We do not store your card or direct-debit details on this website.
• Website and advertising measurement: Google Analytics 4, Google Ads, and Microsoft Advertising as described below.

We use Google Analytics, Google Ads and Microsoft Advertising to understand how people find and use this website. This includes measuring whether someone arrived through an advert and later used a contact option, such as clicking to call or message us, or completing an enquiry form.

These services use analytics and advertising-measurement cookies and may record an advertising click identifier, the pages visited, broad location and device/browser information. We do not send names, contact details, enquiry messages, diagnoses or clinical information to these tools.

We use this information for website and advertising performance reporting, not to personalise the website or create individual visitor profiles. Google Signals and advertising personalisation are disabled. Google Analytics event data is retained for 14 months. You can restrict or clear cookies using your browser settings.

We use the service providers named above only where necessary to operate the business, deliver care, protect the website, process payments, or understand aggregate website and advertising performance. We may share relevant medical information with professionals involved in a patient's care, such as a GP, consultant, or case manager, with the patient's knowledge or appropriate authority unless disclosure is required by law or to protect someone's safety.

We retain information only for as long as necessary for the purpose for which it was collected and to meet legal, regulatory, insurance, and professional obligations. GA4 event-level data is retained for 14 months. Adult clinical records are generally retained in line with the schedules recommended by the Chartered Society of Physiotherapy and Royal College of Occupational Therapists, commonly eight years after the last treatment, subject to the circumstances of the record.

Depending on the circumstances, UK data-protection law gives you rights including:

• Access: request a copy of personal data we hold about you.
• Rectification: ask us to correct inaccurate information.
• Erasure: ask us to delete information, where the right applies.
• Restriction or objection: ask us to restrict or stop certain processing.
• Complaint: raise a concern with the Information Commissioner's Office.

To exercise a right or ask a privacy question, email contact@private-physio.co.uk or use our contact page.