Privacy & Your Data

Who holds your information

Physio & Me Ltd is the data controller for everything described on this page — we decide what is collected and why.

• Physio & Me Ltd, 1 Forest Drive West, Leytonstone, London E11 1JZ.
• Registered in England & Wales, company number 13207287.
• Any question about your data: hello@physioandme.co.uk, or 07496 656945.

What we collect when you book

A booking gathers four separate things. They are stored separately, and only the first two are needed to hold an appointment.

• Your account — name, email, phone, date of birth, and an emergency contact if you give one.
• The appointment itself — which treatment, the date and time, the price, and a payment reference from Stripe.
• Your intake questionnaire — the health answers for that specific treatment, including anything you mark on the body map.
• After your session — Saarah's treatment notes, and any documents or plans she shares with you.

Why we are allowed to hold it

Under UK GDPR every use of your data needs a lawful basis. Ours are:

• To take and honour your booking, and to take payment — because we have a contract with you (Article 6(1)(b)).
• To hold your health information — because it is needed to provide healthcare, by a registered professional bound by a duty of confidentiality (Article 9(2)(h)).
• To keep payment and accounting records — because the law requires it (Article 6(1)(c)).
• We do not rely on consent to provide your care, so withdrawing consent does not stop you being treated. Marketing, if we ever send any, is a separate opt-in.

Where it is stored, and how

Your records live in a hosted database rather than on a laptop or in a filing cabinet. Three companies are involved, each doing one job:

• Supabase runs the database and the sign-in system. Data is encrypted in transit and at rest.
• Every record is tied to your account by a database rule, so one client's questionnaire cannot be read from another client's session — the restriction is enforced by the database itself, not just by the website.
• Stripe takes payments. Card details are entered on Stripe's own payment page and never reach Physio & Me — we keep only a reference number so we can match a payment to your booking, and issue a refund if one is due.
• Lovable hosts the website and sends the booking and reminder emails.
• Google Analytics runs only with your consent, and your information is never sold or passed to anyone for marketing.

Who can see it

• Saarah. The clinic is a single-clinician practice, so no other staff have access to your records.
• Anyone you ask us to share with — a GP, a consultant, an insurer — and only after you have asked.
• Where the law requires it, or where there is a serious safeguarding concern. This is rare, and we would tell you unless telling you would create a risk.
• Notes Saarah keeps for her own reference are internal and are never shown in your account; anything meant for you is shared with you deliberately.

How long we keep it

Health records have to be kept for a set period after treatment ends — this is a record-keeping obligation, so it applies even if you close your account.

• Clinical records — retained for 8 years after your last appointment. For anyone treated under 18, until their 25th birthday (or their 26th, if they were 17 at the last appointment).
• Booking and payment records — kept for 6 years after the end of the tax year they fall in, which is what accounting law requires.
• Your account details — kept while your account is open, then removed once nothing above still needs them.
• Contact form enquiries that do not turn into a booking — removed once the enquiry is dealt with.

Cookies and browser storage

Essential cookies keep the site working. Google Analytics is only loaded if you accept it on the cookie banner, and you can change that choice at any time on the cookie policy page.

• Signing in stores a session in your browser so you stay signed in. Without it you would have to sign in on every page.
• If you dismiss a banner, we note that in your browser so it does not come back.
• If you start a booking and are asked to sign in, what you have filled in so far is held in your browser for the length of that visit and cleared when you close the tab.
• Analytics tells us how many people visit and which pages they read. It is never used for advertising, and there are no cross-site tracking cookies on this site.

Your rights

You can exercise any of these by emailing us. We will respond within one month, and there is no charge.

• See a copy of everything we hold about you.
• Have anything inaccurate corrected.
• Have your data deleted — though where a clinical record is still inside its retention period we have to keep it, and we will tell you if that applies.
• Ask us to restrict what we do with it, or object to a particular use.
• Receive your data in a portable form, or have it sent to another practitioner.

If you are unhappy

• Please tell us first — hello@physioandme.co.uk — so we have the chance to put it right.
• You also have the right to complain directly to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. Complaining to us first is not a condition of going to them.