Privacy policy

Last updated: 29 July 2026

1. Who we are

Southern Children's Physiotherapy (“we”, “us”, “our”) is a private paediatric physiotherapy practice led by Charlotte Taylor, a chartered physiotherapist registered with the Health and Care Professions Council (HCPC registration number PH63820).

Legal/trading status: Charlotte Taylor trading as Southern Children's Physiotherapy.

Registered address: 4 Old Bridge Road, Iford, Bournemouth, Dorset, BH6 5RG

Email: charlotte@scp-physio.co.uk

Phone: 07779 265002

We are the data controller for the personal information described in this policy, and we are registered with the Information Commissioner's Office (ICO) under registration number ZA490235.

We provide physiotherapy assessment and treatment for children and young people, expert witness services for SEND tribunal cases, and physiotherapy within case-managed care packages. Because of the nature of our work, we handle particularly sensitive information - health information about children - and we take that responsibility extremely seriously.

2. Who this policy covers

This policy explains how we collect and use personal information about:

  • Children and young people we assess and treat (our patients)

  • Parents, guardians and carers

  • Professionals we work with, including school staff, case managers, solicitors, GPs and other clinicians

  • Visitors to our website

3. The information we collect

About children and young people:

  • Name, date of birth, sex and contact details

  • Health information, including diagnoses, medical history, developmental history, assessment findings, treatment records, clinical photographs or videos (only with consent), reports and correspondence about their care

  • Information about their education setting and other professionals involved in their care

  • Information contained in documents shared with us, such as EHCPs, medical reports and tribunal papers

About parents, guardians and carers:

  • Name, relationship to the child, contact details (address, phone, email)

  • Information you share with us about your family circumstances where relevant to your child's care

  • Payment and invoicing details

About professionals:

  • Name, role, organisation and work contact details

  • Correspondence relating to a child's care or a legal case

From our website:

  • Information you submit through our enquiry form (name, email, phone number and your message)

  • Technical information collected by cookies and similar technologies, described in section 13

Health information is “special category data” under UK data protection law and receives extra protection. Almost all of the health information we hold relates to children, and we treat it with the highest level of care.

4. How we collect your information

  • Directly from you, when you contact us by phone, WhatsApp, email or our website form, and during assessments and treatment sessions

  • From your child, where age-appropriate

  • From professionals involved in your child's care, — for example schools, GPs, consultants, case managers and solicitors

  • From documents provided for expert witness work, such as court or tribunal papers

Please note that email, text and WhatsApp are not 100% secure methods of communication; by using them to contact us you are giving your implied consent to communicate this way.

5. Why we use your information and our lawful bases

We use personal information to:

  • Respond to enquiries and arrange appointments

  • Assess, treat and support the children in our care, and keep accurate clinical records

  • Communicate with families and, with consent, with schools and other professionals involved in a child's care

  • Prepare expert witness reports and EHCP recommendations where instructed

  • Invoice and keep accounting records

  • Meet our legal and professional obligations, including HCPC standards and safeguarding duties

  • Run and improve our website

Our lawful bases under UK GDPR are:

  • Contract (Article 6(1)(b)) — to provide the physiotherapy services or expert witness services you have engaged us for

  • Legal obligation (Article 6(1)(c)) — for example record-keeping, tax and safeguarding requirements

  • Legitimate interests (Article 6(1)(f)) — to respond to enquiries, administer our practice and keep our website secure

  • Consent (Article 6(1)(a)) — where we ask for it, for example for clinical photography or sharing updates with a school

Because health information is special category data, we also rely on:

  • Article 9(2)(h) — processing necessary for the provision of health care, carried out by a registered health professional bound by a duty of confidentiality

  • Article 9(2)(f) — where information is needed for legal claims, such as SEND tribunal proceedings

  • Article 9(2)(a) — your explicit consent, where we ask for it

You can withdraw your consent at any time by contacting Charlotte Taylor — this won't affect any processing already carried out.

6. Children's information

We:

  • Always work with the knowledge and involvement of a person with parental responsibility

  • Involve children and young people in decisions about their information in a way appropriate to their age and understanding; young people with sufficient understanding (usually from around 13, and particularly from 16) have their own data protection rights

  • Never use children's information for marketing

  • Only photograph or film a child for clinical or training purposes with explicit written consent, which can be withdrawn at any time

7. Confidentiality and safeguarding

Everything you and your child share with us is treated as confidential. There is one important exception: if we have concerns that a child or another person is at risk of harm, we may be required to share information with appropriate authorities (such as local authority safeguarding teams) without consent. We will only ever share what is necessary, and where possible we will discuss this with you first. This reflects our legal and professional safeguarding duties.

8. Who we share information with

We only share personal information where necessary, and we never sell it. Depending on the circumstances, we may share information with:

  • Other professionals involved in your child's care — for example GPs, consultants, occupational therapists, speech and language therapists and school staff — with your knowledge and, other than in safeguarding situations, your consent

  • Schools and nurseries, where we deliver therapy in an education setting or contribute to an EHCP

  • Solicitors, case managers and tribunals, where we are instructed for expert witness or case-managed work

  • Your insurance company or referring agency, where relevant to completing the physiotherapy intervention, with your consent

Service providers who support our practice, acting on our instructions under contract:

  • Shopify (website hosting and enquiry forms)

  • Google (website analytics and business email)

  • WhatsApp (messaging, where you choose to contact us this way). If you contact us by WhatsApp, your messages are handled under WhatsApp's own terms and privacy policy as well as ours. Please avoid sending detailed medical information by WhatsApp; we will move clinical discussions to more appropriate channels.

  • Accounting/bookkeeping software — QuickBooks Intuit.

  • Professional advisers, insurers and regulators where required, and authorities where we have a legal duty.

  • Website functionality - We might work with Service Providers, such as people and outside companies, to run our website, offer the website on our behalf, provide website-related services, and collect analytics data. Depending on the Personal Information they have about you, Service Providers might also assist us in tailoring your experience on the website. These third parties are only entitled to use your Personal Data to do these tasks; they are not allowed to share it with anyone else or use it in any other way.

9. International transfers

Some of our service providers (such as Shopify and Google) may process data outside the UK. Where this happens, the transfer is protected by UK adequacy regulations or International Data Transfer Agreements / Standard Contractual Clauses, in line with UK GDPR.

10. How long we keep information

Storage and retention:

The Chartered Society of Physiotherapy states that “records form a legal record of treatment and therefore must be retained safely and securely in accordance with the Data Protection Act 2018. Under GDPR regulations, data must only be kept for as long as necessary for the original reason it was collected.

Each UK country sets out minimum retention periods for NHS health records. The minimum retention periods apply to all formats/media that contain components of information relating to the health record. Retention schedules vary according to the type of record but, in general, for those with capacity it is usually:

  • Eight years from the date of last treatment for adult records.

  • Eight years after their 18 birthday or until 25 years of age for children.”

  • Enquiries that do not become patients: up to 12 months, then deleted

  • Invoices and accounting records: 6 years plus the current tax year, as required by HMRC

  • Website analytics data: per the retention settings in our analytics tools [to be confirmed]

When information is no longer needed, we delete or destroy it securely.

11. How we keep information secure

We take appropriate technical and organisational measures to protect personal information, including:

  • Secure, access-controlled storage of clinical records - paper records are kept in locked storage, and digital records are held on a secure password-protected accounts with two-factor authentication

  • Secure transfer of reports and records

  • Our website runs on Shopify with SSL/TLS encryption; we do not store health information on the website

  • Only Charlotte and, where strictly necessary, engaged professionals under confidentiality obligations have access to clinical information

12. If something goes wrong

If a data breach affecting your information occurs that poses a high risk to your rights and freedoms, we will inform you without undue delay. We will provide you with a contact person dealing with the breach, explain its nature, and set out the steps being taken to deal with it, in line with our obligations under UK GDPR.

13. Cookies and website analytics

Our website uses cookies — small text files placed on your device:

  • Essential cookies set by Shopify to make the site work and keep it secure

  • Analytics cookies (Google Analytics, via Google Tag Manager) to help us understand how visitors use the site, so we can improve it. These are only set with your consent where required.

You can control cookies through your browser settings.

14. Your rights

You have the right to:

  • Access the personal information we hold about you or your child (a “subject access request”)

  • Ask us to correct inaccurate information

  • Ask us to delete information (though we must retain clinical records for the periods in section 10)

  • Restrict or object to how we use information

  • Receive information you provided to us in a portable format

  • Withdraw consent at any time, where consent is our lawful basis

Requests are free and we will respond within one calendar month. To exercise any right, contact charlotte@scp-physio.co.uk. Where a request concerns a child's records, we will check the identity and parental responsibility of the person asking and consider the child's own views and best interests where they are old enough.

15. Complaints

If you have any concern about how we handle personal information, please contact us first at charlotte@scp-physio.co.uk - we will do our best to resolve it. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

ico.org.uk

0303 123 1113

16. Changes to this policy

We review this policy regularly and will post any changes on this page with an updated date. Significant changes affecting how we use children's health information will be communicated to families directly.

Charlotte Taylor

Specialist Paediatric Physiotherapist

Southern Children's Physiotherapy