Effective Date: 07/08/2026

Last Updated: 07/08/2026

Stubbs Rehab and Injury Clinic operates the website "stubbsrehab.co.uk"  and provides sports therapy and rehabilitation services. We are committed to protecting the privacy, confidentiality, and security of our patients and website visitors.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, [Insert Clinic Name] is the Data Controller of your personal and health data.

• Contact Details: Name, email address, phone number, date of birth, emergency contact details, and residential address.

Under UK GDPR, health data is classified as "Special Category Data." We collect:

• Medical, injury, and surgical history.
• Current physical symptoms, lifestyle habits, and occupation.
• Clinical assessment notes, diagnosis, treatment plans, and discharge summaries.
• GP details and medical referral letters.

• Technical & Usage Data: IP address, browser type, operating system, pages visited, and access duration using cookies and standard analytics.

Under UK GDPR, we must have a lawful basis to process your data:

• Provision of Healthcare (Article 6(1)(f) & Article 9(2)(h)): Processing your personal and health data is necessary for medical diagnosis, the provision of healthcare, treatment, and managing our health services.
• Consent (Article 6(1)(a)): For non-essential marketing emails, newsletter updates, or using non-essential cookies on our Site.
• Contractual Obligation (Article 6(1)(b)): To manage appointments, process payments, and provide agreed services.
• Legal Obligation (Article 6(1)(c)): To comply with tax laws and healthcare record-keeping standards set by UK professional bodies.

We process your data strictly to:

• Book, reschedule, and manage your appointments.
• Perform physical assessments, plan treatments, and deliver clinical care.
• Invoice for services or submit claims to your private health insurance provider.
• Communicate with your GP or NHS specialist (strictly with your explicit permission).
• Maintain secure clinical records as required by UK healthcare law.

We do not sell, rent, or trade your personal data. We only disclose your information to:

• Healthcare Professionals: Your GP, NHS consultants, or referring specialists, but only where clinically necessary and with your consent.
• Data Processors: Third-party cloud software providers essential to our business, including:
  • Practice Management / Electronic Health Record (EHR) software (e.g., Rehab Guru)
• Private Medical Insurers: To process pre-authorized claims on your behalf.
• Legal & Regulatory Bodies: The ICO, HCPC, or law enforcement if required by UK law.

All third-party processors are bound by strict Data Processing Agreements (DPAs) requiring compliance with UK GDPR standards.

We implement robust physical, technical, and organizational measures to keep your data secure, including end-to-end encryption for electronic records and secure SSL technology on our Site.

• Adult Patient Records: In accordance with UK health guidelines, adult clinical records are retained for a minimum of 8 years following your last treatment.
• Children/Minors: Records for patients under 18 at the time of treatment are retained until their 25th birthday (or 8 years after death if applicable).
• Financial Records: Payment and tax records are retained for 6 years following the end of the tax year, as required by HMRC.

Once the applicable retention period expires, records are securely destroyed or permanently anonymized.

Under UK GDPR, you have the following rights:

• Right of Access (Subject Access Request): You can request a free copy of the personal and medical data we hold about you.
• Right to Rectification: You can ask us to correct inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You can request deletion of your personal data. Note: This right does not apply to clinical notes where we are legally obligated to retain records for standard health retention periods.
• Right to Restrict or Object to Processing: You can object to direct marketing or request that we limit how we process your data in certain scenarios.
• Right to Withdraw Consent: Where processing relies on consent (e.g., marketing), you can withdraw consent at any time.

To exercise any of these rights, contact our Data Protection Lead using the details below.

Our Site uses essential cookies for standard site navigation and security. We also use performance/analytics cookies (e.g., Google Analytics) to understand website usage. You can manage your cookie preferences or opt out at any time via our website cookie banner or your browser settings.

If you have any concerns about our data practices, please contact us first so we can resolve the issue. If you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Tel: 0303 123 1113

Website: https://ico.org.uk

For any privacy-related queries, Subject Access Requests, or concerns, please contact:

• Clinic Name: Stubbs Rehab and Injury Clinic
• Data Protection Lead / Officer: Mr Aaron Stubbs
• Email: aarondstubbs@gmail.com