Last updated: 2 August 2026
Hamilton Physiotherapy Ltd (“we”, “us”, “our”) is a private physiotherapy clinic based at 105 Bothwell Road, Hamilton, ML3 0DW, registered in Scotland under company number SC874925. We are the data controller for the personal information described in this policy, whether it is collected through our website, at one of our workshops, at your discovery visit, during ongoing treatment at our clinic, or over the phone.
We are registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, under registration number ZC090792.
This policy explains what personal information we collect, why, how we use it, who we share it with, and the choices and rights you have. It covers both our website and our clinical/patient records, because for a clinic like ours the two are closely linked, for example, you might first give us your details through a workshop sign-up form, then become a patient.
When you sign up to a workshop (in person, via our mailing list, or via a Facebook or Google ad landing page), we collect your name, email address, phone number, and any brief information you give us about the condition or issue that brought you to us, together with your marketing consent choices.
When you book or attend a free discovery (“fit for physio”) visit, we collect further information, including a more detailed history of your symptoms, relevant medical history, lifestyle information relevant to your condition, and the outcome of the visit.
If you go on to become a patient and receive treatment, we create and maintain a clinical record for you in our practice management system (Cliniko), including your assessment findings, diagnosis, treatment plan, clinical notes from each session, movement and strength assessment data (if you are assessed using our VALD Dynamo and force plate equipment), correspondence about your care, and AI-generated transcriptions or summaries of your consultations (see section 5).
When you call us, if a member of our team is able to take your call, we handle it in the usual way. If your call cannot be answered by the team, it may instead be answered by Aeva, our AI phone receptionist, which can take a booking, cancellation, or reschedule directly, or take a message (your name, contact details, and the reason for your call) for a member of our team to call you back. See section 5 for more on how Aeva works.
When you make a payment, we (or our payment providers, Klarna and GoCardless) collect payment and billing information needed to process single-session payments, upfront package payments, Klarna instalment payments, or direct debit collections.
When we contact you about appointments, reminders, or follow-ups, this is done through our clinic communication tool (Peptalkr) by email or SMS, using the contact details you have given us.
When you browse our website, certain information may be collected automatically via cookies and similar technologies, including for Google Ads and Meta (Facebook) advertising and for our mailing list/marketing platform (PhysioFunnels) — see section 7 for full details and your choices.
We use your personal information for the following purposes:
We do not rely on consent as our lawful basis for keeping clinical records or providing treatment itself. Instead, we rely on our contract with you and the specific health and social care condition that UK data protection law provides for clinics like ours. Consent is used only where the law requires a separate, freely given choice, namely for marketing and for cookies/tracking that are not strictly necessary.
We share your information with the following organisations, each acting for a specific purpose. Some of these organisations are “processors” — they only use your data to provide their service to us, under contract, and cannot use it for their own purposes.
Cliniko (patient records and clinical management system). What this means for you: your clinical notes, appointment history, and treatment records are stored in Cliniko’s system. For UK-based accounts such as ours, Cliniko stores this data in the UK. Cliniko’s parent company is based in Australia, and some administrative access or support functions may involve Cliniko group companies outside the UK; this is covered by a data processing agreement including UK-approved safeguards (see section 8).
Peptalkr (appointment communications). What this means for you: this tool sends you appointment confirmations, reminders, and related clinical-administrative emails and SMS messages on our behalf, using the contact details on your patient record.
Aeva (AI phone receptionist). What this means for you: if your call to the clinic cannot be answered by our team, it may be answered by Aeva, which can book, cancel, or reschedule an appointment for you, or take a message for a member of our team to call you back. Calls handled by Aeva are processed and may be recorded or transcribed so that Aeva can carry out your request and so that our team can see a summary of what was discussed. See section 5 and section 8 (international transfers).
PhysioFunnels (workshop and marketing funnel management, and mailing list). What this means for you: if you sign up to a workshop, our mailing list, or express interest through one of our marketing campaigns, your contact details and marketing preferences are held in this system so we can invite you to workshops, follow up after them, and send you marketing communications you have agreed to receive.
Klarna (instalment payment provider). What this means for you: if you choose to pay for a package in 3 instalments via Klarna, you will provide payment and identity information directly to Klarna, which will carry out its own credit assessment and hold your payment data under its own privacy notice. We only receive confirmation of payment, not your full financial details.
GoCardless (direct debit provider). What this means for you: if you choose to pay for a package in 2 instalments by direct debit, GoCardless collects your bank details directly to set up and process your direct debit mandate. We do not store your bank account details ourselves.
VALD (Dynamo and force plates) (movement and strength assessment technology). What this means for you: if your assessment or treatment includes strength or movement testing on our force plates, the results are captured and stored in VALD’s platform, linked to your patient profile, to allow us to track your progress over time. VALD’s corporate group includes entities based in Australia (see section 8 on international transfers).
Our AI note-taking tool (“Patient Notes”). What this means for you: this tool listens to and transcribes or summarises parts of your consultation to help your physiotherapist keep accurate notes more efficiently, so more of your appointment can be spent on hands-on assessment and treatment. See section 5 for how this works and why it applies to all patients.
Google Ads and Meta (Facebook) Ads (advertising and marketing measurement). What this means for you: if you consent to non-essential cookies on our website, these platforms may receive information about your visit so we can measure the effectiveness of our advertising and, where you have agreed, show you relevant ads about our services (retargeting). See section 7.
Professional advisers, our insurer, and regulators, where necessary — for example, our professional indemnity/public liability insurer, the HCPC, or our accountants and any relevant authority where we are legally required to disclose information, such as in a safeguarding concern or a court order.
We do not sell your personal information to anyone, and we do not share it with any third party for their own independent marketing purposes without your specific consent.
We use two AI tools to help us run the clinic efficiently:
AI note-taking during appointments. Our AI note-taking tool helps your physiotherapist keep accurate, detailed clinical notes during your appointment, so that more of your appointment time can be spent on your assessment and treatment rather than on paperwork. The tool listens to relevant parts of your consultation and produces a written summary or transcript, which your physiotherapist reviews and adds to your clinical record in the same way as notes taken by hand. This is a standard part of how we deliver care to every patient, in the same way that keeping your notes in our electronic patient record system (Cliniko) is a standard part of how we deliver care, it is not a separate optional service. By booking and attending an appointment with us, you are agreeing to receive care on this basis. We process this information under the same lawful basis as the rest of your clinical record: our contract with you to provide treatment, together with the health and social care condition described in section 3. The tool we use is hosted in the UK, so no international transfer of this information arises from its use.
Aeva, our AI phone receptionist. When our team is unable to take your call, Aeva can answer instead. Aeva can book, cancel, or reschedule an appointment for you directly, or, if you would rather speak to a person, take a message with your name, contact details, and the reason for your call so a member of our team can call you back. Calls handled by Aeva may be recorded and processed (including automated transcription) so that Aeva can understand and act on your request, and so our team can see what was discussed. This is a standard part of how we handle calls that our small team cannot get to straight away, and applies to any call answered by Aeva; we process this information on the same basis as other booking and administrative contact with us (performance of our contract with you, or steps you ask us to take before booking). If you would prefer not to leave any details with Aeva, you are welcome to call back, email us, or use our website instead.
If you have any questions about how either tool works, or about anything recorded in your notes or in a call, please raise this with a member of our team, who can review this with you.
We will only send you marketing emails, SMS messages, or show you retargeting adverts where you have given your consent (for example, by signing up to our mailing list or a workshop), or, if you are an existing patient, where we are relying on the PECR “soft opt-in” to tell you about similar services to those you have already received, and you have not opted out.
You can opt out of marketing at any time by using the unsubscribe link in any marketing email, replying “STOP” to a marketing SMS, or telling any member of our team. Opting out of marketing does not affect the administrative or clinical messages we need to send you about your appointments and care, and does not affect your treatment.
Our website uses cookies and similar technologies (including tracking pixels from Google Ads and Meta, and tools used by our mailing list provider) to make the site work, understand how it is used, and support our advertising.
Following updates to the Privacy and Electronic Communications Regulations (PECR) made by the Data (Use and Access) Act 2025, which took effect from 5 February 2026, a small number of low-risk categories of cookies strictly necessary cookies, and certain analytics, functionality, and security cookies used solely to improve our own service no longer require your prior consent, provided you are given clear information about them and an easy way to opt out free of charge. However, advertising and retargeting cookies and pixels, including the Google Ads and Meta pixels used on our site, and any analytics that also feed into advertising or profiling, still require your prior, opt-in consent under PECR and are switched off by default until you agree.
When you first visit our website, a cookie banner lets you accept all cookies, reject all non-essential cookies, or manage your preferences by category. You can change your choice at any time using the cookie preferences link in our website footer.
Some of the organisations we use are based outside the UK, or are part of a corporate group with operations outside the UK. Where personal information is transferred outside the UK, UK GDPR requires us to ensure it is protected to a UK standard, either because the destination country has been assessed as offering adequate protection (“adequacy regulations”), or because appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
We only use processors who have given us contractual assurances about how they protect your information, and we review these arrangements periodically.
We keep clinical (health) records for a minimum of 8 years from the date of your last treatment or discharge, in line with guidance from the Chartered Society of Physiotherapy (CSP) reflecting standard NHS practice.
We keep marketing contact details until you unsubscribe or ask us to delete them, at which point we keep a minimal suppression record (e.g. your email address) indefinitely, solely so we do not contact you again by mistake. Payment records are kept for as long as required by tax and accounting law (normally 6 years). Call recordings, transcripts, or messages taken by Aeva are kept only as long as needed to action your request and to allow a short period for quality and dispute-handling purposes. Cookie and analytics data is retained only for the period set in the relevant platform.
We use appropriate technical and organisational measures to protect your personal information, including access controls on our clinical record system, staff confidentiality obligations, and contractual security requirements for all our processors. Only staff who need to see your information to do their job can access it.
We only provide physiotherapy assessment and treatment to patients aged 16 and over; we do not treat children under 16 at our clinic.
Patients aged 16 or 17 generally have full legal capacity in Scotland to consent to their own medical, surgical, or dental treatment, including physiotherapy, under the Age of Legal Capacity (Scotland) Act 1991, and can therefore also make their own decisions about their own health data in most cases, without needing parental involvement.
You are welcome to bring a chaperone to any appointment. Please let us know in advance where possible so we can accommodate this.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact us using the details in section 15. We will respond within one month, and will not normally charge a fee, though we may ask you to verify your identity first.
If you are unhappy with how we have handled your personal information, please contact us first so we can try to resolve it, see section 15. You also have the right to complain directly to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.
Hamilton Physiotherapy Ltd 105 Bothwell Road, Hamilton, ML3 0DW
Email: admin@hamilton-physiotherapy.co.uk
ICO registration number: ZC090792
We may update this policy from time to time, for example to reflect a new processor, a change in the law, or a change to our services. The “Last updated” date at the top of this page shows when it was last changed, and we will let existing patients know of any significant change.
