Privacy Policy

1. Introduction

Rehalign Private Limited ("we", "us", or "our") is committed to protecting your privacy and personal data. This privacy policy explains how we collect, use, store, and share your personal data when you visit our website, contact us, or use our mobile physiotherapy services.

2. Scope of this policy

This privacy policy applies to our physiotherapy clients and their families/carers, website visitors and users, individuals who contact us for inquiries or appointments, and healthcare professionals who refer patients to us.

This policy covers data processing through our website, email communications, appointment booking systems, and physiotherapy services, including domiciliary care and clinic-based treatments.

3. The data we collect

We collect the following categories of personal data:

• Identification & Contact Data: Name, address, phone number, email address, date of birth, NHS number (where applicable)
• Appointment & Billing Data: Appointment history, treatment plans, billing information, payment records
• Special Category Health Data: Medical history, assessment results, treatment notes, progress reports, rehabilitation goals, functional assessments, and other health information relevant to neurological rehabilitation. Health data is classified as "special category personal data" under UK GDPR Article 9.
• Device & Usage Data: IP address, approximate location, browser type, device information, website usage patterns, cookies and similar technologies (analytics and marketing ones only if you consent)
• Communications: Email correspondence, phone call records, feedback, complaints

4. Purposes & lawful bases

We process personal data for the following purposes and lawful bases:

• Provide assessment & treatment: Contract (Art. 6(1)(b)) + Health (Art. 9(2)(h))
• Clinical record-keeping & safety: Legal obligation + Health (Art. 9(2)(h))
• Payment processing: Contract (Art. 6(1)(b))
• Communications & reminders: Legitimate interests (Art. 6(1)(f)) - with opt-out
• Marketing newsletters: Consent (Art. 6(1)(a))
• Safeguarding / vital interests: Vital interests (Art. 6(1)(d), Art. 9(2)(c))
• Analytics & site improvement: Consent (Art. 6(1)(a)). Analytics tools only run if you accept analytics cookies
• Marketing cookies & advertising pixels: Consent (Art. 6(1)(a))

5. How we use special category (health) data

We process special category health data only when necessary for providing physiotherapy assessment and treatment, maintaining clinical records as required by professional standards, ensuring patient safety and continuity of care, communicating with other healthcare professionals (with your consent), and complying with legal obligations under healthcare regulations.

All health data is kept strictly confidential and is only accessed by registered physiotherapists involved in your care, administrative staff on a need-to-know basis, and authorized personnel for technical support (with appropriate safeguards).

Our processing complies with professional standards set by the Chartered Society of Physiotherapy (CSP) and Health and Care Professions Council (HCPC) requirements.

6. Data sources

We collect personal data from the following sources: directly from you during consultations, through our website forms, email communications, and phone calls; from your referrer (GP, consultant, or other healthcare professional with your consent); from your GP/consultant medical history and referral information (with your explicit consent); from devices and our website automatically collected technical data and usage information; and from family members/carers with your consent for appointment coordination and care planning.

7. Sharing your data

We use the following third-party processors to provide our services:

• Cliniko for clinical practice management & scheduling (medical records, notes, and booking dates)
• Stripe for payment processing (billing information, payment details encrypted)
• Postmark for email delivery (contact information, appointment reminders, and notifications to our team when you submit an enquiry, booking request or chat message)
• Firebase Firestore (Google) for secure CRM, enquiries, bookings, chat messages, newsletter, and website logging (telemetry)
• Supabase for staff sign-in to our admin area and the content of our website FAQ pages (not for patient records)
• Vercel for website hosting and anonymous site-performance statistics
• Umami Cloud for cookie-free website statistics (pages viewed, clicks on our booking button, where visitors came from, device type and country). It does not use cookies
• Google Analytics 4 (Google) for website analytics, only if you accept analytics cookies
• Microsoft Clarity (Microsoft) for page heatmaps and session recordings that show how the site is used, only if you accept analytics cookies
• Ahrefs Analytics for website analytics, only if you accept analytics cookies
• ip-api.com to estimate your approximate location (country and city) from your IP address, only if you accept analytics cookies
• Meta (Facebook) Pixel for advertising measurement, only where enabled on our site and if you accept marketing cookies

Some of these providers are based outside the UK, so information may be processed in other countries.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

8. Cookies & similar technologies

We use essential cookies and browser storage to keep the site working and to remember your cookie choices. We only use analytics and marketing tools if you accept them in the cookie banner. You can change or withdraw your choice at any time using the cookie preferences link in the footer of every page.

• Essential (always on): remembering your cookie choice and basic site function.
• Cookie-free statistics (always on): Umami Cloud counts visits to our pages without using cookies or similar identifiers stored on your device.
• Analytics (only with your consent): Google Analytics 4, Microsoft Clarity, Ahrefs Analytics and our own visit statistics (pages viewed, device type, approximate location and where you came from).
• Marketing (only with your consent): the Meta (Facebook) Pixel, where enabled.

If you reject analytics cookies, none of the consent-based analytics tools above are loaded. If you withdraw analytics consent later, the page reloads without them and their cookies are removed.

9. Retention

• Clinical Records: Adults retained for 8 years after last contact or treatment. Children retained until 25th birthday (whichever is longer).
• Financial Records: Retained for 6 years as required by UK tax law.
• Marketing Data: Retained until consent is withdrawn or 3 years of inactivity.
• Website Analytics: Anonymized data retained for up to 2 years.

10. Version & sign-off

Privacy Policy Version: 7 October 2026

Rehalign Ltd

133 Franchise Street, Wednesbury, WS10 9RH, England