Who we are
Physit Limited (“Physit”, “we”) provides physiotherapy in clients’ homes, in work places, in care settings and in our treatment room. We are the controller of the personal information described in this notice.
- Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ
- Trading address: 22 Hurlingham Studios, Ranelagh Gardens, London SW6 3PA
- Company number: 08276116, registered in England and Wales
- ICO registration number: ZB161330
Last updated: 17/10/2026
Who this notice covers
This notice explains how we handle information about:
- our clients: people we assess or treat
- people acting for a client, such as relatives, carers and legal representatives.
Staff, job applicants and website visitors have separate privacy notices. We give this notice to clients when they register with us, and you can ask us for a copy at any time.
The information we collect
About clients
- contact and identity details: name, address, date of birth, phone number, email address and GP details
- health information: medical history, assessment findings, treatment notes, outcome measures, letters and reports, and clinical photos or videos taken with your agreement
- funding details: your insurer and policy or authorisation number, or the solicitor, case manager or employer arranging your treatment
- payment records: invoices and payments. Card payments are made through a secure payment link from our payment provider, and we never see or keep your card details
- communications: emails, appointment messages and notes of phone calls
- details of anyone acting for you, such as a relative, a carer or the holder of a Lasting Power of Attorney.
Where it comes from
Most information comes from you. We also receive it from people involved in your care or treatment, such as your GP or consultant, your health insurer, a solicitor or case manager, your employer, or the care home or retirement village where we treat you, and from relatives or representatives acting for you.
How we use your information
Data protection law requires a lawful basis for each use of your information. For health information, we also need an additional condition.
| What we use it for | Lawful basis | Condition for health information |
| Assessing and treating you, and keeping clinical records | Our contract with you, or our legitimate interests where someone else arranges or pays for your care | Providing health care (UK GDPR Article 9(2)(h)) |
| Arranging appointments and sending reminders | Contract; legitimate interests | Providing health care |
| Sharing information with others involved in your care, such as your GP | Contract; legitimate interests | Providing health care |
| Invoicing, payments and insurance claims | Contract; legitimate interests | Providing health care; shared with your insurer with your agreement |
| Reports for solicitors, case managers and employers | Legitimate interests | Legal claims (Article 9(2)(f)) or providing health care; shared with your agreement |
| Protecting someone at risk of harm | Recognised legitimate interests (safeguarding) | Safeguarding (Data Protection Act 2018, Schedule 1) |
| Handling complaints and rights requests | Legal obligation | As for the original information |
| Defending legal claims and meeting legal and regulatory duties | Legal obligation; legitimate interests | Legal claims |
| Publishing a testimonial, or using a photo or video for teaching or publicity | Your consent | Your explicit consent |
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
We need your health information to treat you safely. If you would rather not share something, please tell your physiotherapist, as it may limit the treatment we can offer.
We do not use your information for marketing and we do not sell it. We never enter information that identifies you into AI tools, and we do not make decisions about you by automated means.
Who we share it with
We share only what each recipient needs:
- People involved in your care: your GP, consultants, other physiotherapists treating you, and staff at your care home or retirement village. You can object to this; please tell us.
- People arranging or paying for your treatment: your insurer, solicitor, case manager or employer, with your agreement.
- Your representatives: relatives or carers you have agreed we can speak to, or people with legal authority to act for you.
- Where the law requires or allows it: for example, to protect someone at risk of harm, in an emergency, or when a court, the police or a regulator such as the HCPC or the ICO lawfully asks.
- Our insurers and legal advisers, if there is a complaint or claim.
We also use trusted service providers, who process information for us under contract, only on our instructions and with appropriate security. They provide:
- our clinical records and appointment system
- email, file storage and IT services
- card payment processing
- appointment messaging.
Information sent outside the UK
Most of your information stays in the UK or the European Economic Area. Some of our service providers, such as our payment and messaging providers, may process information in the United States. Where that happens, the transfer is protected as UK law requires, for example by UK adequacy regulations or standard data protection clauses.
How long we keep it
| Information | How long we keep it |
| Clinical records | 8 years after your last treatment. If you return, this starts again after your new treatment ends. We may keep a record for longer if there is a legal reason, such as a claim. |
| Invoices and financial records | 6 years from the end of the financial year |
| Complaints and rights requests | 6 years after closure |
| Testimonial consent | While the testimonial is published, plus 2 years |
How we protect it
Our systems can only be reached from Physit-managed devices, with secure sign-in, encryption and up-to-date security software. Staff can access only what they need for their role, and complete data protection training every year.
Your rights
You have the right to:
- get a copy of your information
- have inaccurate information corrected
- have information deleted, or its use restricted, in some circumstances. We usually cannot delete clinical records during the retention period, because we must keep accurate records of the care we provide
- object to some uses of your information
- receive information you gave us in a format you can reuse
- withdraw your consent, where we rely on it.
To make a request, email [privacy email] or call 0204 570 2391. It is free, and we normally reply within one month.
Complaints
Complaints page: https://www.physit.co.uk/complaints/
Messages
Messaging apps. If you message us through a messaging app, including through the link on our website, we use it only to arrange appointments. Please don’t send medical details. If you do, we copy what is needed into your record and delete the message.
Changes to this notice
We review this notice at least once a year and whenever we change how we use personal information. The date at the top shows when it was last updated.
