Privacy Policy

1. Introduction

Rehalign Private Limited ("we", "us", or "our") is committed to protecting your privacy and personal data. This privacy policy explains how we collect, use, store, and share your personal data when you visit our website, contact us, or use our mobile physiotherapy services.

2. Scope of this policy

This privacy policy applies to our physiotherapy clients and their families/carers, website visitors and users, individuals who contact us for inquiries or appointments, and healthcare professionals who refer patients to us.

This policy covers data processing through our website, email communications, appointment booking systems, and physiotherapy services, including domiciliary care and clinic-based treatments.

3. The data we collect

We collect the following categories of personal data:

• Identification & Contact Data: Name, address, phone number, email address, date of birth, NHS number (where applicable)
• Appointment & Billing Data: Appointment history, treatment plans, billing information, payment records
• Special Category Health Data: Medical history, assessment results, treatment notes, progress reports, rehabilitation goals, functional assessments, and other health information relevant to neurological rehabilitation. Health data is classified as "special category personal data" under UK GDPR Article 9.
• Device & Usage Data: IP address, browser type, device information, website usage patterns, cookies
• Communications: Email correspondence, phone call records, feedback, complaints

4. Purposes & lawful bases

We process personal data for the following purposes and lawful bases:

• Provide assessment & treatment: Contract (Art. 6(1)(b)) + Health (Art. 9(2)(h))
• Clinical record-keeping & safety: Legal obligation + Health (Art. 9(2)(h))
• Payment processing: Contract (Art. 6(1)(b))
• Communications & reminders: Legitimate interests (Art. 6(1)(f)) - with opt-out
• Marketing newsletters: Consent (Art. 6(1)(a))
• Safeguarding / vital interests: Vital interests (Art. 6(1)(d), Art. 9(2)(c))
• Analytics & site improvement: Legitimate interests (Art. 6(1)(f)) or Consent

5. How we use special category (health) data

We process special category health data only when necessary for providing physiotherapy assessment and treatment, maintaining clinical records as required by professional standards, ensuring patient safety and continuity of care, communicating with other healthcare professionals (with your consent), and complying with legal obligations under healthcare regulations.

All health data is kept strictly confidential and is only accessed by registered physiotherapists involved in your care, administrative staff on a need-to-know basis, and authorized personnel for technical support (with appropriate safeguards).

Our processing complies with professional standards set by the Chartered Society of Physiotherapy (CSP) and Health and Care Professions Council (HCPC) requirements.

6. Data sources

We collect personal data from the following sources: directly from you during consultations, through our website forms, email communications, and phone calls; from your referrer (GP, consultant, or other healthcare professional with your consent); from your GP/consultant medical history and referral information (with your explicit consent); from devices and our website automatically collected technical data and usage information; and from family members/carers with your consent for appointment coordination and care planning.

7. Sharing your data

We use the following third-party processors to provide our services:

• Cliniko for clinical practice management & scheduling (medical records, notes, and booking dates)
• Stripe for payment processing (billing information, payment details encrypted)
• Postmark for email delivery (contact information, appointment reminders)
• Firebase Firestore for secure CRM, newsletter, and website logging (telemetry)

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

8. Retention

• Clinical Records: Adults retained for 8 years after last contact or treatment. Children retained until 25th birthday (whichever is longer).
• Financial Records: Retained for 6 years as required by UK tax law.
• Marketing Data: Retained until consent is withdrawn or 3 years of inactivity.
• Website Analytics: Anonymized data retained for up to 2 years.

9. Version & sign-off

Privacy Policy Version: 18 September 2025

Rehalign Ltd

133 Franchise Street, Wednesbury, WS10 9RH, England