Fortis Physiotherapy Privacy & Cookie Policy
Last updated: February 2026
Fortis Physiotherapy (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, store and protect your personal data when you:
– visit our website
– contact us
– book an appointment
– receive physiotherapy or rehabilitation services
We process personal data in accordance with:
– UK General Data Protection Regulation (UK GDPR)
– Data Protection Act 2018
– Privacy and Electronic Communications Regulations (PECR)
1. Who We Are (Data Controller)
Fortis Physiotherapy is the data controller responsible for your personal data.
Address:
Rugg Farm Stables
Church Street
Ilchester
BA22 8EQ
Telephone: 07506 332097
Email: admin@fortisphysio.co.uk
We do not appoint a statutory Data Protection Officer, however all data protection queries should be sent to the email address above.
2. The Type of Personal Data We Collect
We may collect and process the following information:
Identity & Contact Information
– Name
– Address
– Email address
– Telephone number
– Date of birth
– Emergency contact details
Health Information (Special Category Data)
Because we are a healthcare provider, we also collect medical information, including:
– Injury history
– Medical conditions
– Medication
– GP details
– Treatment notes
– Clinical assessment findings
– Rehabilitation progress records
This is classified as special category health data under UK GDPR.
Appointment & Payment Information
– Appointment records
– Attendance history
– Payment information (processed securely via third-party providers)
Website Usage Data
– IP address
– Browser type
– Device information
– Pages visited
– Referral source
3. How We Collect Your Data
We collect information when you:
– complete a contact form
– email or telephone us
– book an appointment
– attend a consultation
– complete medical questionnaires
– use our website
– consent to marketing communications
4. Our Lawful Basis for Processing
Under UK GDPR we must have a legal basis for processing your data.
We rely on the following:
Contract
To provide physiotherapy assessment and treatment.
Legal Obligation
To maintain appropriate healthcare records.
Legitimate Interests
To manage appointments, service quality and clinic administration.
Special Category Health Data
We process medical data under Article 9(2)(h) UK GDPR — provision of health care and treatment.
Your explicit consent is obtained for treatment and for sharing information where necessary (for example with your GP or insurer).
5. How We Use Your Information
We use your personal data to:
– assess and treat your condition
– maintain clinical records
– manage bookings and appointments
– contact you regarding your care
– send exercise rehabilitation programmes
– process payments
– communicate with your GP or referrer (with permission)
– comply with professional and legal obligations
– improve our services
– send occasional service updates or clinic information (only where permitted)
We do not sell your data to any third party.
6. How Long We Keep Your Data
Healthcare providers are legally required to retain records.
We keep physiotherapy records for:
Adults: 8 years after your last appointment
Children: until age 25 (or 26 if 17 at last treatment)
This follows professional guidance for private healthcare practice and medico-legal limitation periods.
After this period your data is securely deleted or destroyed.
7. Who We Share Data With
We may share your information when necessary with:
– your GP or consultant (with your consent)
– medical insurers (if you claim through insurance)
– other healthcare professionals involved in your care
– secure software providers (clinical notes or booking systems)
– payment processors
– legal or regulatory authorities if required by law
All third parties are required to keep your data secure and confidential.
8. Data Security
We take appropriate security measures including:
– encrypted clinical record systems
– password protected devices
– secure cloud storage
– restricted staff access
– secure disposal of records
– confidentiality procedures
9. International Transfers
Where cloud software providers store data outside the UK, we ensure they use:
– UK adequacy regulations, or
– Standard Contractual Clauses approved under UK GDPR
10. Your Data Protection Rights
You have the right to:
– access your personal data
– request correction of inaccurate data
– request erasure (where legally permitted)
– restrict processing
– object to processing
– data portability
– withdraw consent at any time
To exercise your rights contact:
admin@fortisphysio.co.uk
We will respond within one month.
11. Complaints
If you are unhappy with how we handle your data, please contact us first.
You also have the right to complain to the supervisory authority:
Information Commissioner’s Office (ICO)
www.ico.org.uk
12. Cookies
Our website uses cookies to ensure it functions correctly and to help us understand website usage.
Strictly Necessary Cookies
Required for basic website functionality such as page navigation and security.
Analytics Cookies
We may use Google Analytics to understand website performance and improve user experience. These cookies collect anonymous information including:
– pages visited
– time spent on site
– device type
You can disable cookies through your browser settings at any time.
13. Marketing Communications
We will only send marketing emails if:
– you have consented, or
– you are an existing patient and the communication relates to similar services
You may unsubscribe at any time using the link in our emails or by contacting us.
14. Third-Party Links
Our website may contain links to other websites. We are not responsible for their privacy practices and recommend reviewing their privacy policies.
15. Changes to This Policy
We may update this Privacy Policy periodically to reflect legal or operational changes. The latest version will always be available on our website.
If you have any questions about this policy, please contact:
Fortis Physiotherapy
admin@fortisphysio.co.uk
07506 332097
