Privacy Policy

 Embody – Physiotherapy and Lymphatic Care

Last updated: August 2026

Embody – Physiotherapy and Lymphatic Care (“Embody”, “I”, “me” or “my”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how I collect, use, store and protect your personal information when you:

• Contact Embody
• Book an appointment
• Attend an appointment
• Use the Embody website
• Complete forms or provide information about your health
• Communicate with me by email, telephone, text message or other methods

Embody is responsible for deciding how and why your personal information is used and is therefore the data controller for the personal information I hold about you.

I aim to handle your information fairly, lawfully and transparently, in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Embody – Physiotherapy and Lymphatic Care
Newcastle upon Tyne, United Kingdom

Email: embodyphysiolymph@gmail.com
Website: embodyphysiolymph.co.uk

If you have any questions about how your information is collected or used, please contact me using the details above.

Depending on the services you use, I may collect the following information.

• Your name
• Date of birth
• Address
• Telephone number
• Email address
• Emergency contact details, where appropriate

• Appointment dates and times
• Appointment history
• Treatment and administrative correspondence
• Payment information and transaction records
• Cancellation or non-attendance information

As a physiotherapy and lymphatic care practice, I need to collect information about your health in order to assess, treat and manage your condition appropriately.

This may include:

• Your medical history
• Current symptoms and conditions
• Previous treatment
• Medication
• Surgical history
• Relevant investigations and results
• Information about your physical function and wellbeing
• Clinical assessment findings
• Treatment provided
• Treatment plans and progress
• Information provided by other healthcare professionals where relevant

Health information is considered special category personal data under UK data protection law and is therefore subject to additional protection.

I may collect information:

• Directly from you when you contact or book with Embody
• Through Embody's online booking system
• During appointments and assessments
• Through forms and questionnaires that you complete
• Through telephone calls, emails, text messages or other communications
• From another healthcare professional where this is relevant to your treatment and there is an appropriate lawful basis for obtaining the information

Where possible, I will collect information directly from you.

I use your information to:

• Arrange and manage appointments
• Provide physiotherapy and lymphatic care
• Assess your needs and plan appropriate treatment
• Maintain accurate clinical records
• Monitor your progress and treatment outcomes
• Communicate with you about your appointments and treatment
• Send appointment reminders and other necessary service communications
• Process payments and maintain financial records
• Respond to enquiries
• Meet my professional, legal and regulatory obligations
• Maintain the security and effective operation of my practice
• Deal with complaints or concerns

I will only use your information for purposes that are appropriate and lawful.

Under UK data protection law, I must have a lawful basis for processing your personal information.

For ordinary personal information, I may rely on the following lawful bases:

Where processing is necessary to provide services that you have requested, such as arranging and providing your physiotherapy treatment.

Where I am required to collect, retain or disclose information in order to comply with a legal or regulatory requirement.

Embody uses Cliniko as its practice management and online booking system.

Cliniko is used to manage appointments, communicate with patients and securely store relevant patient information and clinical records.

When you make an online booking through Cliniko, the information you provide is entered into your patient record.

Cliniko provides functionality that allows patients to review and agree to a clinic's privacy policy when booking online. Cliniko states that it supports compliance with UK GDPR and provides a Data Processing Addendum for UK customers.

For patient information processed through Cliniko on behalf of Embody, Embody is the data controller and Cliniko acts as a data processor. This means that Embody determines how and why your information is processed, while Cliniko provides the software and processes information on my behalf.

Cliniko also uses subprocessors to provide certain services, such as cloud storage and email delivery. Cliniko states that these subprocessors are required to comply with applicable data protection requirements.

You can read Cliniko's own privacy policy on its website for further information about how Cliniko handles personal information.

I will keep your personal information confidential and will only share it where there is a lawful reason to do so.

This may include sharing relevant information with:

• Cliniko, as my practice management and online booking system provider
• Other healthcare professionals involved in your care, where appropriate and lawful
• Your GP or other healthcare provider where this is necessary for your care and there is an appropriate lawful basis
• Professional, regulatory or legal bodies where I am required to do so
• Accountants or professional advisers where necessary for the operation of my business
• Payment providers where necessary to process payments

I will not sell your personal information to third parties.

Where I use another organisation to process personal information on my behalf, I will take appropriate steps to ensure that the information is handled securely and in accordance with applicable data protection requirements.

I take reasonable and appropriate steps to protect your personal information from:

• Loss
• Misuse
• Unauthorised access
• Unauthorised disclosure
• Alteration
• Destruction

Electronic information is stored using appropriate password protection and secure systems.

Access to clinical information is restricted to those who need it for legitimate purposes.

I also take reasonable steps to ensure that any paper records and other physical information are stored securely.

I retain clinical records for at least 8 years from the date of your last treatment, in accordance with applicable professional guidance and legal and regulatory requirements.

Where different retention periods apply, for example depending on the age of the patient or the type of record, I will retain records for the appropriate period.

I will keep your information securely throughout the required retention period.

When information is no longer required, it will be securely deleted or disposed of.

The Chartered Society of Physiotherapy's current record-keeping guidance states that, in general, adult health records should be retained for eight years from the date of last treatment.

Under UK data protection law, you may have rights including:

• The right to be informed about how your information is used
• The right to request access to the personal information I hold about you
• The right to request correction of inaccurate or incomplete information
• The right to request deletion of your information in certain circumstances
• The right to request restriction of processing in certain circumstances
• The right to object to certain processing
• The right to data portability in certain circumstances

These rights are subject to certain legal exceptions. For example, I may need to retain clinical information where there is a professional or legal requirement to do so.

If you would like to exercise any of your rights, please contact me using the details provided in this Privacy Policy.

I will respond to requests in accordance with applicable data protection legislation.

I may occasionally contact you about Embody services, where I have a lawful basis to do so.

You can ask me to stop receiving marketing communications at any time.

Essential communications relating to appointments, treatment or services you have requested are not marketing communications and may still be sent where necessary.

The Embody website may use cookies and similar technologies.

Some cookies are necessary for the website to operate correctly. Other cookies may be used to understand how visitors use the website or to support website functionality.

Where required by law, I will request your consent before using non-essential cookies.

Further information about the cookies used on the Embody website may be provided in a separate Cookie Policy.

I take reasonable steps to prevent personal information from being lost, accessed or disclosed without authorisation.

If I become aware of a personal data breach, I will assess the breach and take appropriate action in accordance with applicable data protection law.

Where legally required, this may include notifying the Information Commissioner's Office (ICO) and/or affected individuals.

If you have any concerns about how I have handled your personal information, please contact me first using the details above so that I can try to resolve your concern.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk/

The ICO provides information about data protection rights and how to make a complaint.

I may update this Privacy Policy from time to time to reflect changes in my practice, the services I provide or applicable data protection requirements.

The latest version will be made available through the Embody website.

I will review this Privacy Policy regularly to ensure that it remains accurate and up to date.

Last updated: August 2026