1. Who we are
The TMD Physio is the data controller under the UK GDPR and Data Protection Act 2018. Registered address: 26-27 Bedford Square, Bloomsbury, London WC1B 3HP. Data protection contact: Krina Panchal (secretary@krinapanchalphysio.com). ICO registration number: ZB288125.
2. What data we collect
We collect four categories of information:
Contact data — name, email, phone, address, referrer details (from booking or referral forms).
Clinical data — health history, symptoms, examination findings, treatment notes, any imaging you share with us, correspondence with your GP or consultant, and outcome measures collected during your care.
Payment data — processed by Stripe. We do not store your full card details on our systems.
Website usage data — analytics and cookies as detailed in our Cookie Policy.
3. Why we collect it (lawful bases under UK GDPR)
Provision of healthcare — Article 6(1)(b) contract + Article 9(2)(h) health provision. Applies to your clinical records, appointment scheduling, and consultant/insurer correspondence.
Marketing communications — Article 6(1)(a) consent. Applies only where you have opted in. Withdrawable at any time via the unsubscribe link in every marketing email.
Legal or regulatory compliance — Article 6(1)(c). Applies to HMRC records, HCPC/CSP investigations, and lawful requests from public authorities.
4. Who we share your data with
We share data on a strict need-to-know basis with: • Your GP or referring consultant — only with your explicit consent for a summary letter after appointments • Your private medical insurer — for claim processing, only after you sign an authorisation • Our IT service providers (email, secure appointment booking, cloud storage) — all UK/EU-hosted and GDPR-compliant, bound by contractual data-processor terms • HMRC or public authorities where required by law We do not sell your data to anyone, ever.
5. How long we keep it
Clinical records — 8 years from your last appointment (or, for children, until age 25, whichever is longer). This aligns with Chartered Society of Physiotherapy retention guidance.
Contact and marketing data — until you unsubscribe or ask for deletion. Deleted within 30 days of your request.
Payment records — 7 years, as required by HMRC.
Website analytics — a maximum of 24 months, then automatically aggregated or deleted.
6. Your rights
Under UK GDPR you have the right to: • Access your data (Subject Access Request) • Rectify inaccurate data • Erase your data (subject to the clinical retention requirements above) • Restrict or object to processing • Data portability — receive your records in a machine-readable format • Withdraw consent for marketing at any time • Complain to the ICO — ico.org.uk / 0303 123 1113 Requests should be sent to secretary@krinapanchalphysio.com. We respond within 30 days.
7. International transfers
Some of our IT service providers store data in the EU or under UK-approved international transfer safeguards (Standard Contractual Clauses). We do not transfer clinical data outside the UK/EU without your explicit consent.
8. Security
We protect your data using access controls, encrypted storage, TLS on all connections to our website, MFA on administrative accounts, and regular security reviews. In the unlikely event of a personal-data breach affecting your rights, we will notify you and the ICO within 72 hours as required by law.
9. Contact
Any privacy question or rights request: secretary@krinapanchalphysio.com. To make a complaint to the regulator: ico.org.uk / 0303 123 1113.