1. Who is responsible for your information?
WholePerson Bodywork is operated by Tony Han-wei Lee, trading as WholePerson Bodywork.
For data-protection purposes, WholePerson Bodywork is the data controller for the personal information described in this notice.
You can contact WholePerson Bodywork about your personal information at:
- Website
- wholepersonbodywork.co.uk
2. What information may be collected?
I only collect information that is reasonably necessary to provide and manage my services safely and professionally.
Identity and contact information
- first name
- surname
- date of birth
- email address
- telephone number
Appointment and administrative information
- appointments
- cancellations
- payments
- packages or memberships
- communications relating to your appointments
Health and treatment information
Where relevant, this may include:
- reason for seeking treatment
- symptoms
- relevant medical history
- injuries or operations
- medication
- allergies
- pregnancy information
- relevant physical or psychological health information
- previous investigations or diagnoses you choose to disclose
- assessment findings
- treatment provided
- treatment consent
- treatment responses
- progress
- home-care or exercise recommendations
- referrals or recommendations to seek other healthcare
Health information is treated as special-category personal data and receives additional protection under data-protection law.
Other information you choose to provide
You may voluntarily provide information about your:
- occupation
- exercise or training
- daily activities
- lifestyle
- sleep
- stress
- recovery
- treatment preferences
- goals
I aim to collect only information that is relevant to your treatment or the management of your relationship with WholePerson Bodywork.
3. Why is your information used?
Your information may be used to:
- assess whether treatment is appropriate and safe
- understand what brings you in and what you would like help with
- plan and adapt treatment
- identify contraindications or situations where treatment should be modified or postponed
- obtain and document informed consent
- maintain appropriate treatment records
- monitor progress and response to treatment
- provide appropriate home-care, movement or exercise recommendations
- communicate with you about appointments
- manage bookings, payments, packages and memberships
- respond to questions or enquiries
- meet professional, insurance, legal and regulatory responsibilities
- manage complaints or potential legal claims
- maintain the safety, security and administration of the practice
Your health information will not be used for unrelated advertising or sold to third parties.
4. What is the lawful basis for using your information?
Different lawful bases may apply depending on how your information is being used.
Contract
Processing may be necessary to provide the service you have requested, including booking, administering and delivering appointments.
Legitimate interests
Some information may be processed where reasonably necessary to operate and protect the practice, maintain appropriate records, communicate with clients and manage or defend professional or legal matters.
These interests will be balanced against your privacy rights.
Legal obligation
Information may be processed where this is necessary to comply with applicable legal or regulatory obligations.
Consent
Where consent is the appropriate basis — for example certain optional marketing communications — you can withdraw that consent at any time.
5. How is health information used lawfully?
Information about your physical or psychological health is special-category personal data.
Where health information is necessary to assess suitability and provide treatment, WholePerson Bodywork relies, where applicable, on the UK GDPR condition concerning the provision of health care or treatment, together with the professional/common-law duty to keep information confidential.
Where necessary, health information may also be retained or used for the establishment, exercise or defence of legal claims.
Treatment consent and data-protection lawful basis are separate matters.
You can always withdraw your consent to a particular treatment or technique. This does not necessarily mean that existing clinical records must or can immediately be deleted.
6. Where does the information come from?
Most information is provided directly by you through:
- consultation forms
- consent forms
- booking forms
- email or messaging
- conversations during appointments
- assessment and treatment
With your permission, information may occasionally be received from another healthcare professional or another person acting on your behalf.
Information would not normally be requested from another healthcare professional without discussing this with you first.
7. How is your information stored?
Reasonable technical and organisational measures are used to protect personal information from:
- unauthorised access
- accidental loss
- inappropriate disclosure
- alteration
- misuse
Digital records may be stored using secure third-party services used to operate WholePerson Bodywork.
These may include services used for:
- consultation and consent forms
- secure document storage
- bookings
- payments
- website hosting
Where Google Forms, Google Drive or other Google Workspace services are used, these services may process information on behalf of WholePerson Bodywork.
Access to client information is restricted to those who genuinely need it for an appropriate purpose.
Appropriate account-security measures such as strong passwords and multi-factor authentication should be used.
8. Who might your information be shared with?
Your information is treated as confidential.
It may be shared only where reasonably necessary, including with:
Service providers
Trusted providers that help operate the practice, such as:
- secure IT/cloud-storage providers
- booking-system providers
- payment processors
- email providers
- website providers
They should only process information for the purposes necessary to provide their services.
Healthcare professionals
Information may be shared with a GP, physiotherapist, osteopath or another healthcare professional where this is appropriate and you have agreed to the disclosure.
Professional advisers and insurers
Relevant information may be shared with professional indemnity insurers, legal advisers, accountants or professional advisers where appropriate, and where necessary for legitimate professional or legal purposes.
Legal, safeguarding or emergency circumstances
Information may be disclosed without your usual permission where disclosure is required or permitted by law, or where necessary in an appropriate safeguarding, legal or serious emergency situation.
I will not sell your personal or health information.
9. International data transfers
Some technology providers may store or process information outside the United Kingdom.
Where personal information is transferred internationally, appropriate safeguards required by UK data-protection law will be used where necessary.
Service providers and data-storage arrangements will be kept under review.
10. How long is information kept?
Personal information is not kept indefinitely without a reason.
Clinical and treatment records
Clinical consultation, consent and treatment records will normally be retained for [CONFIRM RETENTION PERIOD WITH INSURER/PROFESSIONAL BODY] following your last appointment, unless there is a legitimate reason or professional/legal requirement to keep them for longer.
Financial records
Information required for accounting and tax purposes may be kept for the period required by applicable law.
Enquiries that do not become clients
Basic enquiry information may be deleted when it is no longer reasonably required.
Marketing information
Marketing contact information will normally be kept until you unsubscribe or withdraw your consent, subject to keeping a minimal record where necessary to ensure that your preference continues to be respected.
Retention periods will be reviewed periodically and information will be securely deleted or anonymised when it is no longer required.
11. Marketing
WholePerson Bodywork will not automatically add you to a marketing mailing list simply because you have booked an appointment.
Where marketing emails or similar electronic communications are offered, you will be given a separate opportunity to opt in where required.
You may unsubscribe or withdraw marketing consent at any time.
Your health information will not be used to create targeted health-related advertising profiles.
12. Website and cookies
The WholePerson Bodywork website may use essential technical functions necessary for the website to operate.
If non-essential analytics, advertising or similar cookies are introduced, appropriate information and consent controls will be provided where required.
More information will be available in the: [INSERT COOKIE POLICY LINK IF APPLICABLE]
13. Your data-protection rights
Depending on the circumstances and the lawful basis being used, you may have rights including the right to:
- be informed about how your information is used
- request access to personal information held about you
- ask for inaccurate information to be corrected
- request deletion of information in certain circumstances
- request restriction of processing in certain circumstances
- object to certain types of processing
- request data portability where applicable
- withdraw consent where processing is based on consent
These rights are not absolute and some may not apply in every situation.
For example, WholePerson Bodywork may sometimes need to retain clinical records despite a deletion request where there is an appropriate legal, professional or claims-related reason to do so.
To exercise a data-protection right, contact: wholepersonbodywork@gmail.com
You may be asked for enough information to verify your identity before information is released or changed.
14. Sharing information with another practitioner
If you would like WholePerson Bodywork to provide information to your GP or another practitioner, this can be discussed with you.
Where appropriate, specific permission will normally be obtained before sharing clinical information.
Only information reasonably relevant to the purpose should be shared.
15. Confidentiality
Information disclosed during consultation, assessment or treatment will be treated confidentially.
Confidentiality may exceptionally be overridden where disclosure is required by law or justified by a sufficiently serious safeguarding, legal or emergency concern.
Where reasonably possible and appropriate, such circumstances would be discussed with you.
16. Complaints about your personal information
If you have concerns about how WholePerson Bodywork handles your personal information, please contact me first so that I have an opportunity to address the issue.
Email: wholepersonbodywork@gmail.com
You also have the right to raise a concern with the UK data-protection regulator:
Information Commissioner’s Office (ICO)
The ICO provides information and a complaints process through its official website.
17. Changes to this Privacy Notice
This Privacy Notice may be updated from time to time to reflect:
- changes to WholePerson Bodywork services
- changes to technology or service providers
- changes to data-protection requirements
- changes to how information is collected or used
The most recent version will be published on the WholePerson Bodywork website with the date of the latest update shown at the top.
18. Contact
For questions about this Privacy Notice, your records or how your personal information is handled, contact:
Tony Han-wei Lee
WholePerson Bodywork
- Website
- wholepersonbodywork.co.uk