Privacy Policy

Magda Sports Therapy respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how personal information is collected, used, stored and protected when you visit this website, contact the practice or receive sports therapy services.

1. Who is responsible for your information?

The data controller is:

Magda Sports Therapy
Streatham Hill, London SW16
Email: magdasportstherapy@gmail.com
Telephone: 07934 248 251

Magda Sports Therapy is operated by Magdalena Kozak as an independent sports therapist.

Questions about this Privacy Policy or the use of your personal information can be sent to the email address above.

2. Information that may be collected

Depending on how you interact with the practice, the following information may be collected:

Contact and identification information

This may include:

• your name;
• telephone number;
• email address;
• preferred method of contact;
• address, where reasonably required;
• emergency contact details.

Appointment and administrative information

This may include:

• appointment dates and times;
• booking, cancellation and attendance history;
• correspondence relating to appointments;
• invoices and payment records;
• information relating to complaints or enquiries.

Health and clinical information

When you book or attend an appointment, it may be necessary to collect information including:

• current symptoms and areas of pain;
• relevant medical history;
• injuries, diagnoses and previous treatment;
• medication;
• allergies;
• information about physical activity, occupation and lifestyle where relevant;
• assessment findings;
• treatment provided;
• rehabilitation exercises and recommendations;
• progress and follow-up notes.

Health information is treated as special-category personal data and is given additional protection.

Website and technical information

When you use this website, limited technical information may be collected automatically, including:

• IP address;
• browser and device type;
• pages visited;
• approximate location;
• referring website;
• date and time of access;
• cookie and website-usage information.

More information is provided in the separate Cookie Policy.

3. How information is collected

Personal information may be collected:

• when you complete a website contact form;
• when you contact the practice by email, telephone or WhatsApp;
• when you book, cancel or rearrange an appointment;
• during your consultation, assessment or treatment;
• through forms or questionnaires;
• when you make a payment;
• when you leave a review or provide feedback;
• automatically through website technology and cookies.

Information may also be received from another healthcare professional or person involved in your care, but only where there is an appropriate reason and lawful basis to receive it.

4. Why your information is used

Personal information may be used to:

• respond to enquiries;
• arrange and manage appointments;
• provide safe and appropriate sports therapy services;
• assess your needs and plan treatment or rehabilitation;
• maintain accurate clinical records;
• communicate about appointments, exercises and follow-up;
• process payments and maintain accounting records;
• manage cancellations, complaints and insurance matters;
• comply with legal, regulatory and professional obligations;
• protect the safety and legal rights of the practice and its clients;
• maintain and improve the website and services;
• prevent fraud, misuse or security incidents.

Your information will not be sold.

5. Lawful bases for processing

Depending on the situation, Magda Sports Therapy may rely on the following lawful bases under UK data-protection law:

Contract

Information may be processed when necessary to arrange and provide services requested by you, manage appointments and fulfil the agreement between you and the practice.

Steps before entering into a contract

Information may be used to respond to your enquiry or discuss a potential appointment before you decide to book.

Legal obligation

Some information may need to be processed or retained to comply with legal, tax, accounting, insurance or regulatory obligations.

Legitimate interests

Information may be processed where reasonably necessary to operate and protect the practice, respond to communications, maintain appropriate records, manage complaints and improve services, provided those interests do not override your rights.

Consent

Consent may be used where appropriate, including for optional communications, photographs, testimonials or other uses that are not necessary for providing treatment. Consent can be withdrawn at any time, although this will not affect processing that took place before withdrawal.

6. Health and special-category information

Information about your physical or mental health is special-category personal data.

Where health information is required to provide an appropriate and safe service, it is processed under an applicable condition in Article 9 of the UK GDPR, including the provision or management of health care by a professional subject to confidentiality obligations, where applicable.

Where that condition is not appropriate, explicit consent or another relevant legal condition may be used.

Only information that is relevant and reasonably necessary for your care and the operation of the practice will be collected.

7. Sharing your information

Personal information is not routinely disclosed to other people.

It may be shared when necessary with:

• service providers supporting website hosting, communications, IT or secure data storage;
• WordPress.com and its associated service providers;
• email, telephone and messaging providers;
• payment or accounting service providers, where used;
• insurers, professional bodies or legal advisers where reasonably required;
• another healthcare professional, GP or emergency service where appropriate;
• government bodies, regulators, courts or law-enforcement authorities where legally required.

Information about your treatment will not normally be shared with another healthcare professional without your knowledge or permission, unless there is a serious safety concern or another lawful reason to do so.

Service providers may only use information for the relevant service and are expected to protect it appropriately.

8. WhatsApp, email and social media

You may choose to contact Magda Sports Therapy through WhatsApp, email, Instagram or Facebook.

These services are operated by third-party organisations and have their own privacy practices. Messages sent through them may be processed or stored outside the United Kingdom.

Please avoid sending highly sensitive medical information through social-media comments or public messages.

Where possible, clinical information will be transferred into the appropriate confidential client record rather than retained unnecessarily in informal messaging systems.

9. Website hosting and third-party services

This website is hosted using WordPress.com, which may process limited technical and usage information required to provide, protect and maintain the website.

The website may also include links, embedded content or services provided by third parties, including:

• Google or Apple Maps;
• WhatsApp;
• Instagram;
• Facebook;
• Google Reviews;
• external booking or communication services.

When you interact with a third-party service, that provider may collect information according to its own privacy policy.

Magda Sports Therapy is not responsible for the privacy practices of independent third-party websites.

10. International transfers

Some website, email, messaging, social-media or technology providers may process information outside the United Kingdom.

Where personal information is transferred internationally, reasonable steps will be taken to use services that apply recognised safeguards, such as UK adequacy regulations or approved contractual protections, where required.

11. How long information is kept

Personal information is kept only for as long as reasonably necessary for the purpose for which it was collected and to meet professional, legal, insurance and accounting requirements.

The following general retention periods apply:

• clinical and treatment records: normally eight years after the last appointment or treatment;
• records relating to a person treated while under 18: normally retained until at least their 25th birthday, or 26th birthday where treatment ended when they were 17, where this is appropriate;
• financial and tax records: normally six years after the end of the relevant financial year;
• general enquiries that do not lead to treatment: normally up to 12 months after the last communication;
• appointment messages and routine administrative correspondence: deleted when no longer required, unless needed as part of the clinical, financial or legal record;
• complaint, insurance or legal records: retained for as long as reasonably necessary to resolve the matter and meet applicable limitation or insurance requirements.

Records may be kept for longer where there is an active complaint, legal claim, safeguarding issue, regulatory requirement or other justified reason.

Once information is no longer needed, it will be securely deleted, anonymised or destroyed.

12. How information is protected

Reasonable organisational and technical safeguards are used to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate disclosure;
• alteration;
• destruction or misuse.

Access to clinical and administrative records is limited to those who reasonably require it.

No online or electronic system can be guaranteed to be completely secure. If a personal-data breach creates a risk to individuals, it will be handled in accordance with applicable data-protection requirements.

13. Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for information to be erased;
• request that processing is restricted;
• object to certain uses of your information;
• receive certain information in a portable format;
• withdraw consent where consent is the lawful basis;
• complain about the use of your information.

These rights are not absolute. For example, some clinical, financial or legal records may need to be retained even if you request deletion.

To exercise your rights, contact:

magdasportstherapy@gmail.com

You may be asked to provide information confirming your identity before a request is completed.

14. Complaints

Please contact Magda Sports Therapy first if you have concerns about how your information has been used.

You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office (ICO)
Telephone: 0303 123 1113

Further information is available on the ICO website.

15. Children and young people

A parent or legal guardian may be asked to provide or confirm personal information where a client is under 18.

Information relating to a young person will only be collected and used where reasonably necessary to provide the service safely and appropriately.

The young person’s understanding, confidentiality and involvement in decisions will be respected according to their age, maturity and the circumstances.

16. Marketing

Magda Sports Therapy does not send marketing communications without an appropriate lawful basis.

Where consent has been provided for optional marketing, it may be withdrawn at any time by contacting the practice or using any unsubscribe option provided.

Appointment reminders, treatment-related communication and responses to enquiries are service communications rather than marketing.

17. Changes to this Privacy Policy

This Privacy Policy may be updated when the practice, website, technology or legal requirements change.

The date shown at the top of this page will be updated when material changes are made.

---