Privacy Notice
Edinburgh Performance Physiotherapy LLP
Last updated: September 2026
Edinburgh Performance Physiotherapy LLP (“EPP”, “we”, “us” or “our”) is committed to protecting your privacy and keeping your personal and health information secure.
This Privacy Notice explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, how long we retain it and the rights you have in relation to your information.
As a physiotherapy provider, we collect information about your health in order to provide safe and appropriate assessment, treatment and rehabilitation. Health information is classed as special category personal data under UK data-protection law and receives additional protection.
This Privacy Notice applies to patients and prospective patients of EPP, including children and young people, and to people who contact us through our website, email, telephone or other communication channels.
1. Who we are
Edinburgh Performance Physiotherapy LLP is the data controller responsible for determining how and why your personal information is processed in connection with the physiotherapy services we provide.
Registered name: Edinburgh Performance Physiotherapy LLP
Registered number: SO308423
Registered in: Scotland
Registered office and clinic address:
Corstorphine Cougars RFC
The Pavilion
Carrick Knowe Parkway
Edinburgh
EH12 7EE
Data Protection Contacts:
David Gibson and Ronnie McGregor
Email: info@epphysiotherapy.co.uk
Telephone: 07871 200084
If you have any questions about how EPP uses your information or would like to exercise any of your data-protection rights, please contact us using the details above.
2. Information we may collect about you
The information we collect will depend on your relationship with EPP and the services you receive.
Personal and contact information
This may include:
your name;
date of birth;
address;
email address;
telephone number;
emergency contact details;
parent or guardian details where appropriate;
GP, consultant or other healthcare-professional details;
occupation;
sport, activity and exercise information; and
information about sports clubs, coaches or other people involved in your rehabilitation where relevant.
Health and clinical information
To provide physiotherapy and rehabilitation safely, we may collect and record information including:
your current injury, symptoms or condition;
previous injuries and medical history;
relevant medical conditions;
previous surgery;
medications;
investigations, scans and test results;
information supplied by GPs, consultants or other healthcare professionals;
assessment and examination findings;
diagnoses and clinical opinions;
treatment provided;
rehabilitation programmes and exercises;
strength, movement and functional testing;
progress and outcome measures;
return-to-running or return-to-sport information;
correspondence relating to your care; and
other information that is clinically relevant to your assessment, treatment or rehabilitation.
Health information is special-category data under UK GDPR. This includes not only diagnoses and treatment records but also information such as medical tests and physiotherapy information from which a person's health status can be identified.
Photographs, video and performance information
Where clinically appropriate, EPP may use photographs or video as part of assessment, rehabilitation and monitoring.
This may include:
running and gait-analysis footage;
movement-analysis footage;
exercise and rehabilitation videos;
return-to-play or return-to-sport testing;
clinical photographs;
before-and-after clinical footage; and
other video used to assess movement, technique or rehabilitation progress.
Running and movement analysis may be carried out using Onform. Onform's service can process videos containing an individual's image and other information uploaded through its platform.
Clinical photographs and videos form part of your health information where they relate to your assessment or treatment and will be treated accordingly.
Use of identifiable photographs or videos for marketing, social media, promotional material or testimonials is separate from clinical use. We will obtain specific permission before using identifiable patient images or footage for those purposes.
Payment and transaction information
We may process information relating to appointments, charges and payments.
Payments may be made through:
takepayments;
Stripe;
Cliniko-integrated payment services;
bank transfer; or
cash.
EPP does not need to retain full payment-card details within your clinical record. Payment providers may process payment information in accordance with their own legal obligations and privacy terms.
3. Where we obtain your information
Most personal information is provided directly by you when you:
book an appointment;
attend EPP;
speak with your physiotherapist;
contact us by telephone or email;
provide information during assessment or treatment;
make a payment; or
provide information during your rehabilitation.
We may also receive relevant information from other people or organisations involved in your care, including:
GPs;
orthopaedic consultants and surgeons;
other healthcare professionals;
physiotherapists;
hospitals or clinics;
referrers;
sports clubs;
strength and conditioning professionals or coaches; and
parents or guardians where appropriate.
Where information is received from another healthcare professional or referrer, it will only be used where relevant to your care or another legitimate purpose described in this notice.
4. Why we use your information
We use personal information where necessary to operate EPP and provide safe, appropriate healthcare.
This includes using information to:
arrange and manage appointments;
identify and communicate with patients;
assess injuries and health conditions;
provide physiotherapy assessment and treatment;
formulate clinical opinions and diagnoses;
design rehabilitation programmes;
monitor progress;
perform strength, movement, gait and performance assessments;
conduct return-to-running and return-to-sport testing;
maintain appropriate clinical records;
communicate information relevant to your care;
provide continuity of care;
communicate with other healthcare professionals where appropriate;
process payments;
send appointment confirmations and reminders;
respond to enquiries;
manage complaints;
meet professional, regulatory, insurance and legal requirements;
protect patients or others where there is a safeguarding or serious safety concern; and
monitor and improve the quality of our services.
5. Our lawful basis for using your information
Under UK GDPR, EPP must have a lawful basis for processing personal information.
Different lawful bases may apply depending on why information is being processed.
For providing and administering physiotherapy services, relevant bases may include:
Contract – Article 6(1)(b)
Where processing is necessary to provide services you have requested or to take steps at your request before providing those services.
Legitimate interests – Article 6(1)(f)
Where processing is necessary for EPP's legitimate interests in operating a safe and effective physiotherapy practice, managing patient care, maintaining appropriate records and administering the business, provided those interests are not overridden by your rights and interests.
Legal obligation – Article 6(1)(c)
Where we need to process information to comply with a legal obligation.
Vital interests – Article 6(1)(d)
This may apply in limited circumstances where processing is necessary to protect someone's life.
Consent – Article 6(1)(a)
We may rely on consent for particular optional activities, such as certain forms of marketing.
The appropriate lawful basis depends on the particular purpose for which the information is being used. The ICO requires organisations to identify and document their lawful basis before processing personal information.
6. Health and other special-category information
Information about your health receives additional protection under UK GDPR.
Processing special-category data requires both an Article 6 lawful basis and a separate Article 9 condition.
For health information required to provide physiotherapy, EPP will generally rely upon:
Article 9(2)(h) UK GDPR – health or social care
This permits the processing of health information where necessary for purposes including medical diagnosis and the provision of healthcare or treatment, subject to the applicable legal and confidentiality safeguards.
The corresponding UK law is contained in the Data Protection Act 2018, Schedule 1, Part 1, condition 2. The ICO explains that Article 9(2)(h) can cover medical diagnosis, provision of healthcare/treatment and management of healthcare services where the required safeguards apply.
Our physiotherapists are regulated healthcare professionals and are subject to professional duties regarding confidentiality and the secure management of patient information.
This means that we do not rely upon your consent simply because you have booked a physiotherapy appointment as the basis for all processing of your health information.
Consent may, however, be appropriate for specific activities such as marketing or certain disclosures outside routine clinical processing.
7. Clinical records
EPP has a professional responsibility to maintain accurate and appropriate clinical records.
Your clinical record may include:
information you provide;
assessment findings;
clinical reasoning;
treatment records;
rehabilitation plans;
correspondence;
test results;
photographs or video where clinically relevant; and
information received from or provided to other healthcare professionals.
HCPC standards require registered physiotherapists to maintain full, clear and accurate records and protect them against loss, damage and inappropriate access.
Our main patient-management and clinical-record system is Cliniko.
Cliniko states that UK account data is stored in the UK and provides UK GDPR arrangements including data-processing terms and subprocessors.
8. Clinical testing and technology
EPP uses clinical and performance technology where appropriate to assist assessment and rehabilitation.
VALD
We may use VALD technology, including force plates and dynamometry, to collect objective information about factors such as strength, force, movement and physical performance.
Identifiable information and testing results may be stored within the VALD platform and relevant results may also form part of your EPP clinical record.
VALD's published privacy information confirms that its systems may process personal information including contact details, age/date of birth and information entered into its applications.
Onform
EPP may use Onform for video-based running, gait and movement analysis.
This may involve recording and storing video containing your image for clinical analysis and monitoring. Onform describes its service as providing video feedback, analysis and communication tools and states that its systems may process videos containing an individual's image.
We will only use clinical technologies where they are relevant to the services being provided.
9. Who can access your clinical information
Within EPP, access to patient information is restricted to people who require it for legitimate clinical or operational purposes.
David Gibson and Ronnie McGregor have access to EPP patient records.
Future clinicians working for or on behalf of EPP may be given appropriate access to records where necessary for the provision of care. Access will be subject to appropriate confidentiality and data-protection requirements.
Our strength and conditioning team operates as a separate business and does not automatically have access to EPP patient records.
Information will only be shared with external strength and conditioning professionals or coaches where there is an appropriate reason and lawful basis to do so and, in normal circumstances, with the patient's agreement.
10. Sharing information with other healthcare professionals
Good rehabilitation sometimes involves collaboration with other professionals.
Where appropriate, EPP may share relevant information with people involved in your care, such as:
your GP;
orthopaedic consultant or surgeon;
another physiotherapist;
another healthcare professional;
a strength and conditioning professional;
a sports coach;
a sports club;
a referrer; or
an insurer, should EPP provide insured treatment in the future.
For routine collaborative care outside EPP, we will normally discuss the proposed sharing with you and obtain your agreement before sending identifiable clinical information.
We will only share information that is relevant and appropriate for the purpose.
11. When we may share information without your consent
There are limited circumstances in which information may be disclosed without your consent.
This may occur where disclosure is required or permitted by law, including circumstances involving:
safeguarding concerns;
serious risk of harm to you or another person;
medical emergencies;
legal or regulatory obligations;
court orders;
the establishment, exercise or defence of legal claims; or
another lawful requirement to disclose information.
Any such disclosure will be considered carefully and limited to information that is necessary and appropriate in the circumstances.
12. Children and young people
EPP treats children and young people from 8 years of age.
We may collect information about a child's parent or guardian, including their name and contact details. Parents or guardians will commonly arrange appointments and may receive administrative communications about the child's care.
How clinical information is communicated and shared will depend on factors including the child's age, understanding, capacity, the nature of the information, safeguarding considerations and applicable professional and legal obligations.
We will handle information concerning children and young people with particular care and will respect their privacy and confidentiality in accordance with applicable law and professional standards.
13. Email and communications
EPP uses Google Workspace for its business email service.
If you email EPP, your message may contain personal or health information. Email correspondence relevant to your care may also be recorded in or transferred to your clinical record where appropriate.
Google makes data-processing terms available for Google Workspace where it acts as a processor.
Please remember that ordinary email communication carries inherent privacy and security risks. We therefore encourage patients not to send more sensitive information by email than is reasonably necessary.
EPP may also use email and SMS through Cliniko for appointment confirmations, reminders and other administrative communications relating to your care.
These service communications are different from marketing communications.
14. Marketing communications
Receiving physiotherapy from EPP does not automatically sign you up to receive marketing.
If we introduce newsletters, promotional communications, educational emails or similar direct marketing, we will use an appropriate opt-in process where required.
Where we rely on your consent for marketing, you may withdraw that consent at any time.
Withdrawing consent for marketing will not affect your ability to receive physiotherapy from EPP or necessary communications concerning your appointments or care.
We will not sell patient contact information to third parties for marketing purposes.
15. Testimonials, reviews and marketing images
EPP may publish patient testimonials or reviews.
Where we directly use a testimonial that identifies you or reveals information about your treatment, we will obtain appropriate permission before publication.
We will also obtain specific permission before using identifiable patient photographs or videos for:
social media;
advertising;
promotional materials;
website marketing;
case studies; or
other promotional purposes.
Permission for these activities is separate from consent to physiotherapy treatment.
You are under no obligation to agree to your image, video or testimonial being used for marketing purposes.
16. Payments
EPP uses third-party providers to process electronic payments, including Stripe and takepayments, as well as payment functionality integrated with Cliniko.
These providers may process information necessary to authorise and record payments.
EPP does not need to store full payment-card details in your clinical record.
We may retain appropriate transaction, invoice and accounting information where required for business, tax, accounting or legal purposes.
17. Where your information is stored
Our primary clinical records are stored electronically within Cliniko.
Depending on the services you receive, relevant information may also be processed through:
VALD – clinical strength and performance testing;
Onform – running, gait and movement video analysis;
Google Workspace – email correspondence;
Stripe/takepayments – payment processing; and
EPP computers – for documents such as clinical correspondence and letters where required.
We do not routinely maintain paper patient records, patient spreadsheets or a separate EPP cloud drive containing clinical records.
18. International transfers
Some organisations providing technology to EPP operate internationally or may use subprocessors located outside the UK.
Where personal information is transferred internationally, EPP will take reasonable steps to ensure that appropriate data-protection arrangements and safeguards required by UK law are in place.
This may include use of an applicable UK adequacy regulation, contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to approved Standard Contractual Clauses, or another lawful transfer mechanism.
Cliniko states that data for accounts created in the UK is stored in the UK, although Cliniko itself is not physically based in the UK and maintains UK GDPR arrangements including a UK representative and data-processing terms.
Google Workspace also provides data-processing terms and data-region options for eligible Workspace editions.
EPP will periodically review the arrangements of the third-party providers it uses.
19. How long we keep your information
We keep personal information only for as long as reasonably necessary, taking account of clinical, professional, regulatory, insurance, legal, tax and accounting requirements.
As our standard clinical-record retention policy:
Adult clinical records: generally retained for at least 8 years after the conclusion of treatment/last clinical contact.
Children and young people's clinical records: generally retained until the patient's 25th birthday, or longer where the applicable professional/legal retention requirements require it. Where a young person is 17 at the conclusion of treatment, this can mean retention until their 26th birthday.
Different or longer retention periods may apply in particular circumstances, including where records relate to an ongoing complaint, legal claim, safeguarding matter or another situation requiring extended retention.
The eight-year adult period and retention into the mid-20s for children's records are consistent with established UK healthcare/physiotherapy record-retention practice. HCPC itself requires records to be managed in accordance with applicable legislation, protocols and guidance rather than prescribing one universal retention period.
Clinical photographs and videos that form part of the health record will normally be managed according to the retention requirements applicable to the relevant clinical record.
Financial and accounting records may be subject to separate statutory retention periods.
When information no longer needs to be retained, it will be securely deleted, destroyed or anonymised as appropriate.
20. Anonymised information, clinical audit and service improvement
EPP may use anonymised information for purposes such as:
clinical audit;
service evaluation;
quality improvement;
education and training; and
understanding the effectiveness of our services.
Where information has been properly anonymised so that an individual can no longer be identified, it is no longer personal data for UK GDPR purposes.
We will not use identifiable patient information for research, teaching or case studies outside the purposes described in this notice without establishing an appropriate lawful basis and any other required safeguards or permissions.
21. Automated decision-making and artificial intelligence
EPP does not currently use solely automated decision-making to make decisions about patient treatment or rehabilitation that have legal or similarly significant effects.
Clinical decisions are made by healthcare professionals.
EPP does not currently intend to enter identifiable patient information into general-purpose artificial-intelligence tools for clinical or administrative purposes.
If our use of technology materially changes, we will review our data-protection obligations and update this Privacy Notice where appropriate.
22. How we protect your information
We take appropriate technical and organisational measures to protect personal information against:
unauthorised access;
accidental loss;
inappropriate disclosure;
alteration;
destruction; and
misuse.
Measures include appropriate access controls, secure clinical systems, password/account security, confidentiality requirements and limiting access to information according to legitimate clinical or operational need.
Cliniko supports security controls including two-factor authentication, and we will use appropriate security settings on systems containing patient information.
No method of electronic storage or transmission can be guaranteed to be completely secure, but we take reasonable and proportionate steps appropriate to the sensitivity of the information we process.
23. Your data-protection rights
Depending on the circumstances and the lawful basis being relied upon, UK data-protection law gives you a number of rights.
These can include the right to:
Be informed
You have the right to know how your personal information is being used. This Privacy Notice is part of how we provide that information.
Access your information
You may request a copy of personal information EPP holds about you, subject to applicable legal limitations.
Correct inaccurate information
You can ask us to correct information that is inaccurate or complete information that is incomplete.
Request erasure
In certain circumstances, you can ask for personal information to be deleted. This right is not absolute and does not necessarily apply to clinical records that EPP is required or entitled to retain.
Restrict processing
In certain circumstances, you can ask us to restrict how we use your information.
Object to processing
You may have the right to object to particular processing, including direct marketing.
Data portability
In certain circumstances, you may be entitled to receive information you have provided to us in a structured, commonly used and machine-readable format or ask us to transmit it to another organisation.
Withdraw consent
Where processing relies on your consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Not every right applies in every situation. In particular, healthcare providers may have legitimate or legal reasons for continuing to retain clinical records even if a patient requests their deletion.
To exercise a data-protection right, contact:
David Gibson or Ronnie McGregor
Email: info@epphysiotherapy.co.uk
Telephone: 07871 200084
We may need to verify your identity before releasing or changing personal information.
24. Complaints about how we use your information
If you have concerns about how EPP has collected, used, stored or shared your personal information, please contact us first so that we can investigate your concern.
Data Protection Contacts: David Gibson and Ronnie McGregor
Email: info@epphysiotherapy.co.uk
Telephone: 07871 200084
You also have the right to complain to the UK's independent data-protection regulator, the Information Commissioner's Office (ICO).
Information Commissioner's Office
You do not have to raise a complaint with EPP before exercising your right to contact the ICO.
25. Website information, cookies and analytics
Our website is provided using Squarespace.
Like most websites, it may use technologies necessary for the website to function and may also use optional analytics, advertising or other technologies depending on how the website is configured.
This section will be updated once EPP's final website cookie, analytics and advertising configuration has been confirmed.
Where consent is required for non-essential cookies or similar technologies, these will not be used on the basis of this Privacy Notice alone. Appropriate information and consent controls will be provided separately.
A separate Cookie Policy will explain the specific cookies and technologies used on the EPP website.
26. Changes to this Privacy Notice
We may update this Privacy Notice periodically to reflect:
changes to our services;
changes to the technology and providers we use;
changes in data-protection law or regulatory guidance; or
changes to the way EPP processes personal information.
The latest version will be available on our website.
Where a change materially affects how we use personal information, we will take appropriate steps to bring that change to the attention of affected individuals where required.
Contact us
Edinburgh Performance Physiotherapy LLP
Corstorphine Cougars RFC
The Pavilion
Carrick Knowe Parkway
Edinburgh EH12 7EE
Registered number: SO308423
Registered in: Scotland
Data Protection Contacts: David Gibson and Ronnie McGregor
Email: info@epphysiotherapy.co.uk
Telephone: 07871 200084
Last updated: September 2026