Recovery Lab Farnham LTD

Last updated: 18/09/26

1. About this Privacy Notice

Recovery Lab Farnham LTD provides physiotherapy services, including home-based physiotherapy.

We respect your privacy and are committed to protecting your personal information.

This Privacy Notice explains:

• what information we collect about you;

• why we collect and use it;

• who we may share it with;

• how we protect it;

• how long we keep it; and

• your rights in relation to your personal information.

This notice applies whether you are treated directly by Recovery Lab Farnham LTD or by an independent associate physiotherapist providing services through Recovery Lab Farnham LTD.

2. Who is responsible for your information?

The organisation responsible for your personal information is:

Recovery Lab Farnham LTD

Address: 11 Wrecclesham hill, Gu10 4JN

Email: recoverylabfarnham@gmail.com

Telephone: 07588382082

For some aspects of your clinical care, an independent associate physiotherapist may have their own professional and data-protection responsibilities. Where this is relevant, we will ensure that appropriate arrangements are in place.

3. What information do we collect?

Depending on the services you receive, we may collect the following information.

Personal information

This may include:

• your name;

• date of birth;

• address;

• telephone number;

• email address;

• emergency contact details where appropriate; and

• information you provide when contacting us.

Appointment and administrative information

This may include:

• appointment dates and times;

• appointment type;

• booking history;

• cancellation information;

• attendance information;

• payment information;

• deposits and refunds; and

• correspondence relating to your appointments.

Health and clinical information

In order to provide safe and appropriate physiotherapy, we may collect information about:

• your medical history;

• your current symptoms;

• injuries and medical conditions;

• previous treatment;

• medication;

• relevant investigations or test results;

• physical activity and functional ability;

• clinical assessment findings;

• treatment provided;

• rehabilitation plans;

• exercises and advice;

• progress and outcomes; and

• relevant information received from other healthcare professionals.

Health information is treated as special category personal data under UK data-protection law and receives additional protection.

4. How do we collect your information?

We may collect information:

• directly from you when you contact or book with us;

• during your assessment or treatment;

• through our website;

• through our online booking system;

• by telephone, email or text message;

• from an associate physiotherapist;

• from another healthcare professional or organisation where appropriate;

• from someone acting on your behalf where appropriate; or

• from payment, booking or practice-management systems that we use.

5. Why do we use your information?

We use your information where necessary to:

• arrange and manage your appointments;

• provide physiotherapy assessment and treatment;

• maintain appropriate clinical records;

• communicate with you about your care;

• provide rehabilitation and exercise advice;

• arrange follow-up appointments;

• process payments;

• manage deposits and cancellations;

• communicate with other healthcare professionals involved in your care where appropriate;

• respond to enquiries;

• deal with complaints;

• manage clinical or safeguarding incidents;

• maintain appropriate business records;

• comply with legal and professional obligations;

• protect the health and safety of patients and others; and

• establish, exercise or defend legal claims where necessary.

We will only collect and use information that is relevant and reasonably necessary for these purposes.

6. Our legal basis for using your information

Data-protection law requires us to have a lawful basis for using personal information.

The lawful basis depends on what we are doing with your information.

Depending on the circumstances, we may rely on:

• performing a contract with you or taking steps at your request before entering into a contract;

• complying with a legal obligation;

• our legitimate interests;

• your consent, where appropriate; and

• other lawful bases available under applicable data-protection legislation.

For health information, we also need an additional condition under the UK GDPR because health information is special category data.

Where appropriate for the provision of healthcare, this may include the health or social care condition under Article 9(2)(h) of the UK GDPR, together with the applicable requirements under UK law.

Your consent to receive physiotherapy treatment is separate from the legal basis we use to process your personal information.

7. Who may see your information?

Your information may be accessed by people who need it for legitimate purposes connected with your care or the operation of Recovery Lab Farnham LTD.

This may include:

• your treating physiotherapist;

• independent associate physiotherapists providing services through Recovery Lab Farnham LTD;

• other healthcare professionals involved in your care, where appropriate;

• your GP or other healthcare professional where appropriate;

• insurers or organisations funding your treatment, where applicable;

• booking and practice-management software providers;

• payment providers;

• IT, cloud-storage and communications providers;

• professional advisers such as accountants, solicitors and insurers;

• regulatory or professional bodies where required; and

• government authorities, courts or law-enforcement bodies where legally required.

We will only share your information where there is an appropriate legal basis and where the sharing is necessary and proportionate.

8. Independent associate physiotherapists

Recovery Lab Farnham LTD may use independent associate physiotherapists to provide physiotherapy services.

An associate physiotherapist may need access to your personal and clinical information in order to:

• assess you;

• provide treatment;

• maintain your clinical records;

• arrange appointments;

• communicate with you about your care; and

• provide appropriate follow-up.

Associates are required to maintain patient confidentiality and comply with applicable data-protection and professional requirements.

An associate may also work for other healthcare organisations or operate their own independent physiotherapy practice.

Your information will not be shared with another organisation simply because the physiotherapist also works there.

9. If you have been referred to an associate

If Recovery Lab Farnham LTD introduces you to an associate physiotherapist, the associate will receive the information reasonably necessary to provide your care.

The associate will remain professionally responsible for their clinical assessment and treatment.

Your information will continue to be handled confidentially and in accordance with applicable data-protection requirements.

10. If you are an associate's own patient

Some patients may be introduced to Recovery Lab Farnham LTD by an independent associate physiotherapist.

If you choose to receive treatment through Recovery Lab Farnham LTD, your information will be processed by the Clinic in connection with the services we provide.

This may include using our booking, payment, administration and clinical-record systems.

The fact that your physiotherapist originally introduced you does not reduce our responsibility to protect your personal information while you are receiving services through Recovery Lab Farnham LTD.

11. Communication with you

We may contact you by:

• telephone;

• email;

• SMS or text message;

• post; or

• our online booking or patient-management systems.

We may use these methods to send:

• appointment confirmations;

• appointment reminders;

• appointment changes;

• cancellation information;

• administrative information; and

• information relating to your treatment.

Please tell us if your contact details change.

Where electronic communication is used, we will take reasonable steps to protect your information.

12. Marketing

We may wish to tell you about Recovery Lab Farnham LTD services, developments or offers.

Where applicable law requires consent for marketing communications, we will obtain the appropriate consent.

You can ask us to stop sending marketing communications at any time.

Choosing not to receive marketing will not affect your ability to receive treatment from us.

13. Payments and deposits

Patients normally pay Recovery Lab Farnham LTD directly for appointments.

We may process information necessary to:

• take payment;

• process deposits;

• process refunds;

• manage cancellations;

• maintain financial records; and

• comply with accounting and legal requirements.

Payment information may be processed by third-party payment providers acting on our behalf.

We do not need to know or retain more payment information than is reasonably necessary for these purposes.

14. How we protect your information

We take appropriate technical and organisational measures to protect your personal information from:

• unauthorised access;

• accidental loss;

• destruction;

• damage;

• inappropriate disclosure;

• unauthorised alteration; or

• unauthorised use.

Access to your information is restricted to people who need it for legitimate purposes.

Because health information is particularly sensitive, we take additional care when storing, accessing and sharing clinical information.

Our independent associate physiotherapists are also required to protect patient information and follow our data-protection and confidentiality requirements.

15. Clinical photographs

In some circumstances, photographs may be clinically useful as part of your assessment or treatment.

Where photographs are taken:

• we will only take photographs where they are reasonably necessary;

• appropriate consent will be obtained where required;

• photographs will be treated as confidential clinical information;

• they will be stored securely; and

• they will not be used for marketing or social media without appropriate permission and a lawful basis.

You can ask your physiotherapist why a photograph is being taken and how it will be used.

16. Use of artificial intelligence and digital tools

We may use technology and digital tools to support the administration or delivery of our services.

We will not knowingly enter identifiable patient information into publicly available artificial-intelligence tools or other services where doing so would compromise patient confidentiality or breach data-protection requirements.

Where technology is used to process your information, we will take appropriate steps to ensure that the processing is lawful and secure.

17. How long do we keep your information?

We keep personal and clinical information only for as long as reasonably necessary.

Clinical records may need to be retained for a longer period to comply with professional, legal, regulatory, insurance and healthcare requirements.

Different types of information may therefore be kept for different periods.

When information is no longer required, we will securely delete, destroy or anonymise it where appropriate.

Our retention periods are reviewed periodically.

18. Your rights

Depending on the circumstances, you may have rights under UK data-protection law including:

• the right to know how your information is being used;

• the right to request access to your personal information;

• the right to ask us to correct inaccurate information;

• the right to request deletion of information in certain circumstances;

• the right to request restriction of processing in certain circumstances;

• the right to object to certain processing;

• the right to data portability in certain circumstances; and

• rights relating to automated decision-making and profiling where applicable.

Not all rights apply in every situation.

Further information about individual rights is available from the Information Commissioner's Office (ICO).

19. Requesting access to your records

You may ask us for a copy of the personal information and clinical records we hold about you.

This is commonly known as a Subject Access Request (SAR).

Requests should be sent to:

Recovery Lab Farnham LTD

Email: recoverylabfarnham@gmail.com

We may need to verify your identity before providing information.

We will deal with your request in accordance with applicable data-protection law.

In certain circumstances, information may be withheld where permitted or required by law.

20. Correcting your information

If you believe that information we hold about you is inaccurate or incomplete, please contact us.

We will consider your request and, where appropriate, correct or update the information.

If you disagree with something recorded in your clinical notes, the original clinical record may need to remain unchanged. In such circumstances, an appropriate correction or additional note may be added to the record.

21. Data breaches

If we become aware of a personal-data breach, we will assess the incident and take appropriate action.

This may include:

• containing the breach;

• investigating what happened;

• assessing the potential risk to individuals;

• taking steps to prevent recurrence; and

• notifying the ICO or affected individuals where legally required.

22. Complaints about your information

If you have concerns about how Recovery Lab Farnham LTD has handled your personal information, please contact us first.

We will investigate your concern and try to resolve it.

You also have the right to complain to the Information Commissioner's Office (ICO).

You can find information about the ICO and how to make a complaint on its website:

Information Commissioner's Office

23. Information about children and vulnerable patients

Where we provide services to children or individuals who may require additional support, we will take appropriate steps to ensure that personal information is handled lawfully and securely.

Where appropriate, we may communicate with a parent, guardian, carer or other authorised person.

Information will only be shared where there is an appropriate legal basis for doing so.

24. Confidentiality and safeguarding

Patient confidentiality is important to us.

However, confidentiality is not absolute.

There may be circumstances where information needs to be shared without your consent, for example where:

• we are required to do so by law;

• there is a serious and immediate risk to you or another person;

• there is a safeguarding concern; or

• sharing is otherwise permitted or required under applicable professional or legal requirements.

Where possible and appropriate, we will explain this to you.

25. Transfers outside the UK

Some of the service providers we use may process information outside the UK.

Where this occurs, we will take appropriate steps to ensure that any transfer of personal information is lawful and that appropriate safeguards are in place

26. Website information

This website collects personal information to power our site analytics, including:

Information about your browser, network, and device

Web pages you visited prior to coming to this website

Your IP address

This information may also include details about your use of this website, including:

Clicks

Internal links

Pages visited

Scrolling

Searches

Timestamps

We provide this information to Squarespace, our website analytics provider, to learn about site traffic and activity.

27.Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes to our services;

• changes in how we use information;

• changes to our technology or systems;

• changes in legal or regulatory requirements; or

• improvements to our privacy practices.

The most recent version will be available from:

www.recoverylabfarnham.co.uk

Last updated: 18/09/26

Contact Recovery Lab Farnham LTD

If you have any questions about this Privacy Notice or how we handle your personal information, please contact us.

Recovery Lab Farnham LTD

Address: 11 Wrecclesham Hill, GU10 4JN

Email: recoverylabfarnham@gmail.com

Telephone: 07588382082

We are happy to answer questions about how your information is collected, used or protected.