Privacy Policy

Last updated 31 October 2026

Who is responsible for the data

Each physiotherapist using PhysioAssess is the data controller for the patient records they create. PhysioAssess provides the software that stores and processes those records on their behalf.

What we collect

• Patient details: name, date of birth, phone, email, address and notes.
• Health data: assessments, measurements, red-flag screening, clinical notes, exercise plans and reports.
• Appointments, visit fees and payment status (card details are handled by Stripe and never stored by us).
• Text messages sent to patients and records of patient consent.
• An access log of who created, viewed, changed, exported or deleted each patient record.
• Physiotherapist account details: name, clinic, title and email.

Why we use it (lawful basis)

Health data is processed to provide physiotherapy care, under UK GDPR Article 6(1)(e) or (b) and Article 9(2)(h) (provision of health care by a health professional). Optional uses, such as text reminders or AI-assisted summaries, are recorded as separate consents on the patient's record.

Who we share it with

• Our secure cloud hosting provider, which stores the data.
• An AI service, when the physiotherapist asks for a summary or exercise plan. It receives clinical findings and age, not names, and is instructed not to store them.
• Twilio, which receives the phone number and message text for texts.
• Stripe, which processes visit fee payments.

How we protect it

Individual accounts and database access rules restrict patient records to their authorised physiotherapist. Recorded audit events include patient-page views and exports, and changes to patient records, assessments, appointments and consents; this is not a complete record of every data access or revision. Browser sessions automatically sign out after 15 minutes of inactivity, with a warning one minute beforehand. This browser safeguard is not a guarantee of server-side session revocation.

How long we keep it

Adult health records are flagged for review 8 years after the last contact; this does not automatically delete them. The physiotherapist decides whether continued retention is required. Confirmed patient deletion removes their linked assessments, appointments, texts, consents and booking links from the active database. Audit history remains, and database backups may retain earlier copies until those backups expire. Daily database backups and database exports do not include storage files.

Your rights

Patients can ask their physiotherapist to access, correct, export or delete their data, to restrict or object to processing, or to withdraw consent for optional uses. Physiotherapists can export a complete copy of a patient's data from the patient's page. You can also complain to the Information Commissioner's Office (ico.org.uk).

Contact

For questions about your data, contact the physiotherapist or clinic that treated you.