Your information

Privacy policy

How we collect, use and look after your personal information, including the health information we need to treat you safely.

Last updated 17 October 2026

Who we are

The Mobile Physio is the trading name of Max Gaffney, a sole trader, providing home-visit physiotherapy across South Birmingham and North Worcestershire. Max is a physiotherapist registered with the Health and Care Professions Council (HCPC) and carries out every appointment.

Our postal address is 1231 Bristol Road South, Birmingham B31 2SW.

We are the controller of the personal information described in this policy, which means we decide how and why it is used. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything about your personal information, email info@themobilephysio.co.uk or call 07526 738917.

What we collect

When you get in touch or book, we may collect:

your name and contact details, such as your phone number, email address and home address;
the postcode where appointments would take place, so we can check we cover it;
what you tell us in your message, call, email or WhatsApp conversation;
booking details, such as the appointment type, date and time.

If you become a patient, we also keep clinical records, which may include:

your date of birth, GP and next-of-kin or emergency contact details;
your medical history, medication, symptoms and anything else relevant to your health;
our assessment findings, treatment notes, exercise programmes and progress;
your consent to assessment and treatment.

If you arrange appointments for someone else, such as a parent or relative, we collect your contact details and what you tell us about them. Please make sure they know you are sharing their details with us, and that they agree where they are able to.

If someone is referred to us by a care home, healthcare professional or case manager, we receive their details from that person or organisation.

We also keep payment records, such as amounts paid, dates and receipts.

How we use it, and our lawful basis

Data protection law requires us to have a lawful basis for each way we use personal information. Health information is “special category” data, so using it also needs an additional condition.

Why we use your information, and the lawful basis for each
Why we use it	Lawful basis
To reply to your enquiry and arrange appointments	Taking steps at your request before entering into a contract, or our legitimate interest in answering questions about our service
To assess and treat you, and keep clinical records	Performing our contract with you. For health information: the provision of health care (UK GDPR Article 9(2)(h), with the Data Protection Act 2018, Schedule 1, paragraph 2)
To take payment and issue receipts	Performing our contract with you, and our legal obligation to keep financial records
To keep records for the time required by law and professional standards	Legal obligation, and our legitimate interest in being able to respond to questions or claims about the care we provided
To share information with your GP, family or other professionals	Your consent, or where necessary for your care or to protect you or someone else from harm
To keep our website working and secure	Our legitimate interest in running a safe, reliable website
Optional cookies, if we ever use them	Your consent, which you can withdraw at any time

We do not sell your information, use it for automated decision-making or send you marketing without your permission.

Your health information

Your clinical records are confidential. As an HCPC-registered physiotherapist, Max has a professional duty of confidentiality as well as a legal one.

We only share your health information with family members, carers or care home staff with your consent. If you are unable to give consent, we will act in your best interests and in line with the law, involving the people who are legally able to make decisions on your behalf.

There are rare cases where we may have to share information without consent, for example if we believe you or someone else is at serious risk of harm, for safeguarding, or where the law or a court requires it.

Transfers outside the UK

Some of our service providers may store or process information outside the UK. Where they do, we make sure it is protected by UK adequacy regulations or by appropriate safeguards, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

For example, Cloudflare serves this website and runs its spam check from servers around the world, and Zoho sends our enquiry emails through its data centre in the European Union.

How long we keep it

Enquiries that do not lead to an appointment: up to 12 months after we last hear from you.
Clinical records for adults: 8 years after your last appointment.
Clinical records for children and young people: until their 25th birthday, or their 26th if they were 17 when treatment ended.
Financial records: 6 years, as required for tax purposes.

These periods follow guidance from the Chartered Society of Physiotherapy. We may keep a record for longer if there is a complaint, claim or legal reason to do so. When a record is no longer needed, we delete or destroy it securely.

Your rights

You have the right to:

ask for a copy of the personal information we hold about you;
ask us to correct information that is inaccurate or incomplete;
ask us to delete your information;
ask us to restrict how we use your information;
object to how we use your information;
ask us to transfer your information to you or another organisation;
withdraw your consent at any time, where we rely on it.

Some rights apply only in certain circumstances. For example, we may not be able to delete clinical records before the end of the retention period, because we are required to keep them.

To use any of these rights, email info@themobilephysio.co.uk. There is normally no charge, and we will reply within one month. We may need to confirm your identity first.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.

Keeping it secure

We use appropriate technical and organisational measures to protect your information, including password-protected and encrypted systems, limited access, and secure handling of any paper notes. No method of sending information over the internet is completely secure, so please avoid including detailed health information in an enquiry form or first message.

Using our website

Our website does not use analytics or advertising cookies. See our cookie policy for the small amount of information it stores on your device, and the third-party services it uses.

If you check a postcode on our website, it is sent to postcodes.io to find its approximate location and is not stored by us. Our map and postcode privacy note explains this in more detail.

If you use the enquiry form, the details you type in (your name, how you would like us to reply, your phone number or email address, your postcode and your message) are sent to us by email. The email is delivered by Zoho, which has been set not to keep a copy of its content. To stop automated spam, the form uses Cloudflare Turnstile, which loads when you first click into the form and receives your IP address and technical details about your browser. We keep the details only to reply to you, as described under “How long we keep it”.

Like most websites, our hosting provider may keep short-term technical logs, such as IP addresses and the pages requested, to keep the website running and secure.

Our website is not aimed at children. If you are under 16 and want to arrange treatment, please ask a parent or guardian to contact us.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change that affects you as a patient, we will tell you.