VCF Physiotherapy Patient Privacy Policy and Health Records

1. Introduction

VCF Physiotherapy & Sports Injury Clinic is committed to protecting the privacy and confidentiality of your personal and health information.

As a physiotherapy practice, we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and professional standards relating to healthcare confidentiality.

This Privacy Policy explains how we collect, use, store, disclose, and retain your personal information.

2. Information We Collect

We may collect and process the following information:

  • Name, date of birth, address, telephone number, and email address 

  • Emergency contact details 

  • GP and other healthcare provider details 

  • Medical history and current health concerns 

  • Injury history, treatment notes, rehabilitation plans, and clinical assessments 

  • Appointment records and correspondence 

  • Referral letters and reports 

  • Payment and billing information 

  • Relevant insurance information where applicable 

We collect this information directly from you or, where appropriate, from healthcare professionals involved in your care.

3. How We Use Your Information

We use your information to:

  • Assess, diagnose, and provide physiotherapy treatment 

  • Maintain accurate clinical records 

  • Develop rehabilitation and treatment plans 

  • Communicate with you regarding appointments and ongoing care 

  • Liaise with your GP, consultant, insurer, or other healthcare professionals where appropriate 

  • Process payments and administrative tasks 

  • Meet legal, professional, and regulatory obligations 

  • Improve the quality and safety of our services 

We only process personal data where we have a lawful basis to do so under UK data protection law, including the provision of healthcare services and compliance with legal obligations.

4. Sharing Your Information

Your information is treated confidentially and will only be shared where necessary and appropriate.

We may share information with:

  • Your GP or other healthcare professionals involved in your treatment 

  • Private medical insurers or case managers where relevant 

  • Diagnostic or imaging providers 

  • Secure practice management or IT service providers 

  • Regulatory authorities or safeguarding agencies where required by law 

We will not sell your personal information to third parties.

5. Storage and Security of Records

We take appropriate technical and organisational measures to keep your information secure and prevent unauthorised access, disclosure, loss, or misuse.

Security measures may include:

  • Secure electronic clinical record systems 

  • Password-protected devices and accounts 

  • Encrypted data storage and backups 

  • Restricted staff access to patient information 

  • Secure disposal of confidential records 

  • Confidentiality obligations for all staff and contractors 

  • Paper records, where used, are stored securely in locked facilities.

6. Retention of Physiotherapy Records

Physiotherapy records are retained in accordance with UK legal, regulatory, and professional guidance.

Adult patient records are generally retained for a minimum of 8 years after the completion of treatment or last patient contact. Records relating to children may be retained until the patient reaches 25 years of age or longer where required by law.

At the end of the applicable retention period, records are securely destroyed or permanently anonymised.

7. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

  • Request access to your personal information 

  • Request correction of inaccurate or incomplete information 

  • Request restriction of processing in certain circumstances 

  • Object to certain processing activities 

  • Request erasure of information where applicable 

  • Lodge a complaint with the Information Commissioner’s Office (ICO) 

Some rights may be limited where healthcare or legal obligations apply.

8. Access to Your Records

You may request access to your health records by contacting us in writing.

We may require proof of identity before releasing records. Requests will be handled in accordance with applicable data protection laws.

9. Website and Online Services

If you use our website, we may collect limited technical information such as cookies, IP addresses, and browsing data to improve functionality and user experience. Please see our website privacy policy and cookies policy for further information.

Any online forms or communications submitted through our website are handled securely.

10. Complaints

If you have concerns about how your information has been handled, please contact us using the details below in section 11.

You also have the right to lodge a complaint with the:

Information Commissioner’s Office: ICO Website

11. Contact Details

VCF Physiotherapy & Sports Injury Clinic

VCF Physiotherapy Patient Privacy Policy and Health Records - May 2026, PDF