Privacy Notice | More Motion Physiotherapy

Who we are

More Motion Physiotherapy is a private physiotherapy and sports massage practice run by Jeremiah Adegoke, a Chartered Physiotherapist registered with the Health and Care Professions Council (registration number PH146029) and a member of the Chartered Society of Physiotherapy.

Under UK data protection law, Jeremiah Adegoke trading as More Motion Physiotherapy is the data controller for the information described in this notice. That means we decide what information is collected about you and how it is used, and we are responsible for looking after it.

Contact: Jeremiah Adegoke, More Motion Physiotherapy
Email: info@moremotionphysiotherapy.co.uk
How to reach us: Email is the best way to contact us about anything in this notice, including a request to see your record. We are a mobile practice and do not publish a postal address, but we will provide one on request.

We are a small practice and do not have a statutory Data Protection Officer. Jeremiah Adegoke is personally responsible for data protection and is the person to contact about anything in this notice.

What information we collect

The information we hold about you falls into two groups.

Ordinary personal information

Your name, date of birth and gender
Your home address, email address and phone number
Your occupation
The name and contact details of your GP practice
The name, relationship and phone number of your emergency contact
Your appointment history, payment records and correspondence with us, including messages you send us by email, Instagram, TikTok or WhatsApp about booking
How you heard about us

Health information (special category data)

The reason you have come to see us, your symptoms and how they started
Pain scores and how your problem affects what you can do
Your past and present medical conditions, medication, allergies, surgery and injuries
Whether you are pregnant or have recently given birth
Your answers to our safety screening questions
Our clinical findings, assessment, diagnosis, treatment plan and notes from every appointment, whether at your home or by video
Any scan or imaging reports, letters or other records you give us
Photographs or video, where you have agreed to these

Health information is a special category of data under UK GDPR and is given extra protection in law. We only collect what we need in order to treat you safely.

Where we get it from

Almost all of it comes directly from you, through our intake form, in conversation during your appointments, and in messages you send us. Occasionally we receive information from your GP, a consultant, another therapist, your insurer, or your club or employer, where you have asked us to work with them.

Why we use your information, and our lawful basis

What we do	Lawful basis (Article 6)	Health data condition (Article 9)
Assess and treat you, at home or online	6(1)(b) necessary to perform our contract with you	9(2)(h) provision of health care and treatment, with the DPA 2018 Schedule 1 condition for health or social care purposes
Keep a clinical record of your care	6(1)(c) legal obligation, and 6(1)(f) our legitimate interest in a complete professional record	9(2)(h) as above
Screen you for conditions that make treatment unsafe	6(1)(b), and 6(1)(d) protecting your vital interests in an emergency	9(2)(h), and 9(2)(c) where you are physically unable to give consent
Manage and remind you about appointments	6(1)(b) necessary to perform our contract with you	Not applicable
Take payment and keep accounts	6(1)(b), and 6(1)(c) legal obligation under tax law	Not applicable
Provide receipts or reports for a health insurance claim you make	6(1)(b) necessary to perform our contract with you	9(2)(a) your explicit consent
Communicate with your GP or another clinician about your care	6(1)(b), or 6(1)(f) legitimate interests	9(2)(h), with your recorded preference respected
Deal with a complaint, a claim, or our professional indemnity insurers	6(1)(f) our legitimate interest in defending our position	9(2)(f) establishing, exercising or defending legal claims
Raise a safeguarding concern about a child or adult at risk	6(1)(c) legal obligation, or 6(1)(d) vital interests	9(2)(b) or 9(2)(c), with the DPA 2018 Schedule 1 safeguarding condition
Send you marketing emails or texts	6(1)(a) your consent, which you can withdraw at any time	Not applicable
Use photos, video or case details for teaching or social media	6(1)(a) your consent	9(2)(a) your explicit consent

An important point about consent

We do not rely on your consent as our lawful basis for holding your clinical record. We rely on Article 9(2)(h), which covers health care provided by a professional bound by a duty of confidentiality. This is the position the Information Commissioner's Office expects healthcare providers to take.

In practice it means you cannot withdraw consent to make us delete your clinical record, because consent was never the basis for holding it and we have professional and legal duties to keep it. Every other right in the "Your rights" section still applies to you in full.

Where we do rely on your consent, which is marketing, use of your images, and sharing with your insurer, you can withdraw it at any time and we will stop.

Who we share your information with

We do not sell your information, and we never share it for advertising. We share it only in the circumstances below.

People involved in your care

Your GP or another healthcare professional, where it is in your interests and in line with the preference you recorded on our intake form
Your private health insurer, where you are claiming, and only the information needed for the claim, with your explicit consent
Your club, coach or employer, only where you have specifically asked us to and only to the extent you have agreed

Service providers who process data on our behalf

These organisations act as our data processors under written terms. They may only use your information to provide their service to us.

Jotform, which hosts our intake, screening and consent forms. Our account stores submissions on servers in Frankfurt, Germany.
Google Workspace, which provides our business email and Google Meet, which we use for online consultations. Google acts as our processor under its Cloud Data Processing Addendum. We do not record video consultations.
Cloudflare, which hosts this website. See "Our website" below.
An accountant, where we engage one, who sees financial records only. These contain your name, the dates you attended and the amounts paid, and no clinical detail.

Your clinical record itself is held by us directly, on paper and in files on our own encrypted device, rather than by an external records provider. We take payment by bank transfer and cash, so no card payment company handles your information.

Where the law requires it

The police, a court, or a regulator, where we are legally obliged to disclose
Social services or the police, where we have a safeguarding concern about a child or an adult at risk
The Health and Care Professions Council or our professional indemnity insurers, in connection with a complaint or claim

Transfers outside the UK

Our form provider stores submissions in the European Economic Area. Google and Cloudflare are United States companies and may process data outside the UK. Where any provider we use transfers personal data outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, or on the International Data Transfer Addendum to the EU standard contractual clauses. If you would rather not send us health information by email, tell us and we will arrange another way.

Our website

No cookies, no tracking. This website does not set cookies and does not use analytics or advertising trackers.
Hosting. The site is hosted by Cloudflare, which processes your IP address and basic technical details of your visit to deliver the page and protect it from attacks.
Fonts. Our fonts are loaded from Google Fonts, so your browser sends your IP address to Google when a page loads.
Links. Links to Instagram, WhatsApp and other sites take you to services with their own privacy notices. We are not responsible for how they use your information.

If we ever add analytics or cookies we will update this notice first and ask for your consent where the law requires it.

How long we keep your information

We follow the retention periods in the NHS Records Management Code of Practice, the standard expected of private practitioners as well as NHS services.

Record	How long we keep it
Adult clinical records	8 years after your last appointment with us
Clinical records for patients under 18	Until the patient's 25th birthday, or their 26th birthday if they were 17 when treatment ended
Records where a patient has died	8 years after death
Financial and payment records	6 years plus the current tax year, as required by HMRC
Form submissions held by Jotform	Deleted within 30 days of being transferred into your clinical record
Paper notes	Transferred into the main record promptly, then shredded
Marketing consent records	Until you withdraw consent, then a further 2 years so we can show you were removed
Photographs and video used publicly	Until you withdraw consent, at which point we remove them
Enquiries that never became appointments	12 months

When a retention period ends we delete electronic records securely and shred any paper.

How we keep your information safe

Access to your record is limited to Jeremiah Adegoke. If a locum or assistant is ever involved in your care, they will be bound by the same duty of confidentiality and a written agreement before they get access.
Electronic records are held on a device protected by full disk encryption, a unique long password stored in a password manager, and a short automatic screen lock.
Every online account we use for your information has two-factor authentication switched on.
Records are backed up to encrypted storage, so they are protected against loss as well as unauthorised access.
Paper notes are kept in a locked cabinet, transferred into the main record promptly, and then shredded.
Form submissions are sent over an encrypted connection and stored on servers in the European Economic Area.
Please keep booking messages on Instagram, TikTok or WhatsApp brief. We move anything clinical to email or our secure form rather than discussing it over social media.
We keep a written record of everything we process, review it at least once a year, and securely delete anything we no longer need.

If a personal data breach is likely to put your rights and freedoms at risk, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you directly and without undue delay.

Your rights

You have the following rights over the information we hold about you. To use any of them, email us at the address above. We will respond within one month, and there is no charge.

The right to be informed

To know what we do with your information. This notice is how we meet that.

The right of access

To get a copy of your record. We may ask you to confirm your identity first.

The right to rectification

To have inaccurate information corrected. A clinical opinion recorded at the time is not inaccurate simply because you disagree with it. Where that happens we will add your comments to the record rather than change what was written.

The right to erasure

To have information deleted. This right is limited for clinical records, because we hold them under Article 9(2)(h) and must keep them for the periods above. It applies in full to marketing data and to images used publicly.

The right to restrict processing

To ask us to pause using your information while a dispute about it is resolved.

The right to data portability

To receive information you gave us in a machine readable format, where we hold it on the basis of your consent or our contract with you.

The right to object

To object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.

The right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

Photographs, video and social media

We ask you two separate questions about images on our intake form.

Images for your clinical record. For example a photograph tracking swelling or range of movement. These are part of your record, are kept for the same period, and are never published.
Images for teaching or social media. Entirely optional, and saying no has no effect on your treatment. If you agree, we will not use your name, and we will remove the content if you change your mind. Once something has been published online, other people may already have copied it, and we cannot control that.

We will never publish anything that identifies you without your explicit consent, and we will not use your appointment in any advertising that implies you endorse us unless you have specifically agreed.

Marketing

We only send marketing emails or texts if you have opted in, and opting in is separate from booking with us. Every message tells you how to unsubscribe, and you can also just reply and tell us to stop.

Appointment confirmations, reminders and clinical follow up are not marketing. You will keep receiving those while you are a patient, whether or not you opt in to marketing.

Children and young people

Where a patient is under 18, we ask a parent or guardian with parental responsibility to complete the intake form and give consent to treatment. Young people who understand what is proposed may consent for themselves, and we always involve them in decisions about their care as far as they are able.

Records for patients treated under 18 are kept until their 25th birthday, or their 26th birthday if they were 17 when treatment ended.

Questions and complaints

If you have a question or are unhappy with how we have handled your information, please contact us first at info@moremotionphysiotherapy.co.uk with "Data protection complaint" in the subject line. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office.

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Complaints about clinical care rather than data can be raised with us directly, or with the Health and Care Professions Council at hcpc-uk.org.

Changes to this notice

We review this notice at least once a year and whenever we change how we work, for example if we adopt practice management software or add analytics to this website. The version and date at the top tell you which version you are reading. If a change materially affects how we use your information, we will tell existing patients directly.

How we look after your information