Privacy Policy

PRIVACY AND COOKIES POLICY OF SOHO PHYSIOTHERAPY

Last updated: 11^TH November 2020

Introduction

Welcome to SOHO Physiotherapy`s Privacy Policy. Let me first give you a quick plain English Overview and then if you wish to dig deeper the full document is below.

We take protection of your personal data seriously. To this end all information apart from the Consent Form is stored electronically within our Practice Management Software TM3 by blue zinc and we pay for a hosted service so that this information is professionally stored in a server bunker in Northern Ireland with all the necessary security measures in place. Consent Forms we scan and then store in the same way. Paper copies are kept in locked facilities on site.

We may share some information with your GP and other relevant Consultants involved in your care and, if necessary, our Partners at Fitness Lab should they become involved in your ongoing strength and conditioning rehab. Our email system between therapists is with Microsoft Office 365 ecosystem.

Here is the full document should you wish to know more detail.

• Privacy Policy
  • what personal data we may collect about you in connection with: (i) providing you with our goods and services; (ii) your online interaction with us (including via our website(s), email or social media channels); (iii) our in-person interactions with you; and (iv) any other channels related or ancillary to the foregoing (collectively, the “Channels“);
  • how we collect, store, disclose, transfer, protect and otherwise process that information and for what purposes; and
  • other important information, such as the lawful bases by which we process your personal data, how long we might retain your personal data, the rights you have in relation to personal data we hold about you, and how we use “cookies” and other technologies on our website.
  • SOHO Physiotherapy respects your privacy and is committed to treating any information that we obtain about you with as much care as possible and in a manner that is compliant with all applicable data protection legislation including the EU General Data Protection Regulation 2016/679 (“GDPR“) and any applicable national implementing laws in relation to the same (collectively, “Data Protection Legislation“).
  • This document (the “policy“) explains:
  • This policy supplements (and its terms apply in addition to) any other terms of use or other terms and conditions agreed between you and SOHO Physiotherapy from time to time.
  • This policy is intended to be communicated to you in a concise, transparent, intelligible and easily accessible manner, but we appreciate that you may have queries or want to seek clarification as to its terms. If so, please contact us using the details available on our website.
  • SOHO Physiotherapy reserves the right to make changes to this policy in order to reflect any changes in Data Protection Legislation and best practice from time to time. Soho Physiotherapy will endeavour to notify you of such changes but you are advised to check for an updated version of this policy each time you interact with us through the Channels.
• Information collected

1. • During the course of providing you with access to our website and other services, we sometimes need to collect information about you and your use of our website and other services.
   • Information you give to us
     • When you use our website and services we may ask if you would like to receive marketing and promotional emails from us or we may invite you to take part in a competition or to share content via email or social networks. To benefit from these services you may be required to provide us with personal information such as your name, e-mail address, telephone number or date of birth.
     • When you register for goods or services from us we may ask for other information such as information about your health goals and workout activity. Some of this data may be regarded as “special categories of personal data” under the GDPR and so we only do so when we have your express consent.
     • We may from time to time need payment information from you in order to obtain payment for our services. We do not retain that payment information and use it only for the purposes of obtaining payment for our services. We may from time to time engage third party payment processors and where we do we will ensure that they abide by our same high standards of data privacy and use industry standard encryption methods.
     • We do not process any information about criminal convictions and offences or any information relating to children under the age of 13, and you should not provide us with any such information through any of the Channels.
   • Information gathered from your use of our website
   • When you use our website and related services we may collect certain information automatically, such as the type of device you are using, the device ID, IP address, MAC address, IMEI number (a number unique to your device) and information about your use of our website. Where possible, unique identifiers are anonymised and at no time do we attempt to identify you as an individual. Where any such data can identify you, we process that data in accordance with the privacy terms set out in this policy.
   • Our website does not collect precise real-time location information about your device.

• How we will use your information

1. • Any personally identifiable information that you give to us will only be used for the purpose(s) for which it was supplied. In addition to any other purposes we tell you about from time to time, we may use the personal data described above to:
     • Personalise content on the Channels;
     • Send you promotional and marketing materials, notifications, updates and news;
     • Provide you with access to our products and services;
     • Our own internal uses (such as administration and training);
     • Responding to any correspondence from you – including enquiries, comments and complaints;
     • Administering any polls, services, questionnaires, contests or special events which you express an interest in from time to time;
     • Recording your purchase and workout history and generally administering your account with us;
     • Market research; and
     • Carrying out other business activities in circumstances where you have, or ought reasonably to have, an expectation that we will process your personal data for a particular purpose (including as may be provided for in our terms of use or other agreement between us).
   • Automatically gathered information is used to enable us to provide you with a better service by helping us to understand how our website is used and by reporting any technical problems to us (anonymously).

• Usage reporting (analytics)

1. • To better understand how our website and services are used, we may use the services of another company to provide us with anonymous statistical information about your use of our website. Anonymous information is not covered by the Data Protection Legislation.
     • Analytics services we may use & how to opt-out:
   • Our website uses Google Analytics. If you are not happy for to be included in their reporting please do not use our website until we have a solution to allow you to opt-out. For information about how Google treats your information please visit their Privacy Policy.

• THE LAWFUL BASES BY WHICH WE PROCESS YOUR PERSONAL DATA

1. • Your consent
     • By accepting the terms of this policy, you give SOHO Physiotherapy your express, freely given consent to process any of your personal data in accordance with the terms of this policy. Without prejudice to the foregoing, you also give SOHO Physiotherapy your express, freely given consent to process any special categories of personal data (in particular relating to your health and fitness) which we obtain and process in accordance with this policy. Your consent referred to in this paragraph includes your consent to transfer your data to third parties, some of whom may be outside the EEA, in accordance with paragraphs 7 and 8.
     • You may withdraw your consent given under this paragraph (in whole or in part) at any time by contacting us at the details shown on our website. You can also unsubscribe from different types of emails by following the unsubscribe link displayed at the bottom of each email (if and as applicable). The withdrawal of your consent shall not affect the lawfulness of processing based on consent before withdrawal or the lawfulness of processing based on other lawful grounds as set out below.
   • Other lawful grounds
     • Without prejudice to the consent given by you under paragraph 1 above, SOHO Physiotherapy may process your personal data in any circumstances where such processing is necessary:
     • in order to perform any agreement between us (including pursuant to our terms of use or for us to provide you with goods or services you have requested);
     • to comply with any applicable law or regulation; or
     • for the purposes of the legitimate interests pursued by us or third parties. These legitimate interests include the purposes outlined in this policy but also include other general commercial interests and internal administrative purposes.
     • To provide feedback information concerning your health, wellbeing and physical performance to an insurance company which has referred you to us for training and which is paying the cost of such training.

• What if you refuse to provide us with any personal data?

1. • Where we need to collect personal data by law, or under the terms of an agreement we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
   • Whilst we may be able to provide you with certain products and services notwithstanding your refusal to submit personal data, this may limit your ability to participate in some activities or features or your use of certain services.
   • We may lawfully obtain information from third parties or public sources and we may process that information where it is an essential component of the products and services we offer you.

• Information we may share

1. • We may share personal data with our group companies and partnered companies (if any) from time to time (together, “Affiliates“) in order to provide our goods and services to you and for the other purposes outlined in this policy.
   • From time to time, we will also need to share personal data with the following types of third party service providers who we engage to provide services which facilitate our business and who may need to process your personal data to the extent necessary to provide those services:
     • email service providers such as Mailchimp;
     • scheduling and appointment system providers such as TM3 by Blue Zinc and MindBody Online
     • payment processors such as Stripe and Paypal
     • other third parties approved by you, such as social media sites which you link to your account (if and when we offer that feature) or share content via or third parties who administer any competitions or surveys on our behalf which you voluntarily partake in; and
     • any similar or replacement third parties from time to time.
   • We seek to ensure that any third party engaged by us who processes your personal data has policies and procedures in place to ensure compliance with the Data Protection Legislation. For any third parties that are based, or process data, overseas, we only engage such third parties in accordance with paragraph 8. Unless otherwise disclosed to you from time to time, we will remain the data controller in respect of your personal data notwithstanding that third parties may be engaged as data processors.
   • We may share your personal information with third parties where we are required to do so by law or regulation (such as in connection with an investigation of fraud or other legal enquiry) or in connection with other legal proceedings (including where we believe that your actions violate applicable laws, our terms of business or any usage guidelines for specific products or services, or threaten the rights, property, or safety of our Company, our users, or others.

• International transfers of personal data

1. • In some circumstances, it may be necessary to transfer your information internationally. In particular your information may be transferred to and/or stored on the servers of our Affiliates or other third parties identified in paragraph 7 which are based outside of the EEA.
   • However, we will not transfer your personal data outside of the EEA unless:
     • such transfer is to a country or jurisdiction which the EU Commission has approved as having an adequate level of protection (including to the USA where Privacy Shield compliant);
     • appropriate safeguards are in place as set out in Article 46 GDPR or equivalent provisions of subsequent Data Protection Legislation; or
     • the transfer is otherwise allowed by applicable Data Protection Legislation (such as in the form of a derogation under Article 49 GDPR).

• Information shared by you

1. • When you use our website and related services we may invite you to share content via email or via a social network. If you choose to share content then please be aware that the privacy and cookies policies of such third party sites govern the information you submit to them and we encourage you to read them.

• How long we will store your information

1. • We will hold your personal information on our systems for as long as it is necessary to provide you with the service you have requested. You may unsubscribe from a service whenever you choose; for example, if you registered to receive newsletters then you may unsubscribe by following the link provided in our emails.
   • For as long as we do store your data, SOHO Physiotherapy follows generally accepted industry standards and maintains reasonable safeguards (in each case which are proportionate to the size and nature of our business) to attempt to ensure the security, integrity, and privacy of the information you have provided. SOHO Physiotherapy has security measures in place designed to protect against the loss, misuse, and alteration of the information under our control.
   • Notwithstanding our efforts to keep your personal data secure, no system can be 100% reliable. To the fullest extent permitted by law, we cannot be held liable for any loss you may suffer if a third party procures unauthorised access to any data you provide through the Channels. In addition, you are responsible for maintaining the strength and confidentiality of your login credentials.
   • We will notify you as soon as reasonably practicable if we have reason to believe that there has been a personal data breach by us (or your personal data held by us) which could adversely affect your rights and freedoms.

• Your rights as a data subject

1. • Subject to any conditions or requirements set out in the relevant Data Protection Legislation, you may have some or all of the following rights in relation to the personal data we hold about you:

• the right to request a copy of your personal data held by us;
• the right to correct any inaccurate or incomplete personal data held by us;
• the right to request that we erase the personal data we hold about you;
• the right to request that we restrict the processing of your data;
• the right to have your personal data transferred to another organisation;
• the right to object to certain types of processing of your personal data by us; and
• the right to complain (please see paragraph 12 of this policy).

• These rights are not absolute and may be subject to limitations, conditions or other provisos set out in applicable law. Please contact us using the links on our website if you would like more information on exercising any of these rights.
• Cookies

1. • A cookie is a small file of letters and numbers stored on your browser or the hard drive of your computer. Cookies contain information that is transferred to your computer’s hard drive.
   • Our website may use cookies to distinguish you from other users of our website. This helps us to provide you with a better experience when you browse our website and also allows us to improve our website.
   • Some data collected by cookies is collected on an anonymous and/or aggregated basis. Where we use cookies that contain personal data, we will only process that personal data as set out in this policy.
   • Our websites use some or all of the following cookies:
     • Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
     • Analytical/performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
     • Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
     • Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.
   • Please note third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.
   • Your browser may give you the ability to block all or some cookies by activating a setting in your browser’s options. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.
   • Except for essential cookies, all cookies will remain unless the cookie cache is cleared (unless otherwise indicated in the table above).

• Questions and complaints

1. • For all questions or complaints about this policy, we would appreciate the chance to deal with your concerns before you approach the relevant data protection authority. Please contact us in the first instance using the contact details on our website. If you are not located in the European Union, please indicate that in your communication.
   • You have the right to make a complaint at any time to the relevant supervisory authority for data protection issues, which in the UK is the Information Commissioner’s Office (ICO) (ico.org.uk).