Privacy Policy

Gerry McGrann Physiotherapy is the Data Controller responsible for the personal data you provide to us.

• Practice locations:
• V1BE, 75 Mosley St, Manchester M2 3HR
• Peter Bennett Physiotherapy, 3 Offerton Lane, Offerton, Stockport SK2 5AA
• Email: info@gerrymcgrannphysiotherapy.co.uk
• Phone: 07545 826996
• HCPC registration: PH84965
• CSP membership: 087429

We are registered with the Information Commissioner's Office (ICO) as required for organisations processing personal data. If you have any questions about how we handle your information, please contact us using the details above.

We may collect the following categories of personal data:

Standard personal data:

• Full name, date of birth, address, email address, phone number
• Emergency contact details
• GP name and practice details
• Occupation and employer (where relevant to treatment)
• Insurance or payment details

Special category data (health information):

• Medical history, current symptoms, diagnoses and medication
• Clinical assessment findings and treatment records
• Referral letters and reports from other healthcare professionals
• Exercise programmes and home management advice given
• Consent forms and outcome measures

Health data is classified as special category data under UK GDPR Article 9 and is afforded additional protections.

We collect personal data when you:

• Contact us by phone, email or via our website enquiry form
• Complete a patient intake or consent form at your first appointment
• Receive treatment — clinical findings are recorded as part of your healthcare record
• Are referred to us by your GP, consultant or another healthcare professional

Standard personal data (UK GDPR Article 6):

• Contract performance — to book and provide your physiotherapy appointment
• Legitimate interests — to respond to enquiries, manage appointments and run our practice
• Legal obligation — to comply with HCPC record-keeping requirements
• Consent — where you have explicitly agreed, such as for marketing communications

Special category health data (UK GDPR Article 9):

• Healthcare treatment (Article 9(2)(h)) — processing is necessary for the provision of health or social care treatment and the management of health systems, carried out by a registered health professional subject to a duty of confidentiality
• Explicit consent (Article 9(2)(a)) — where required for specific purposes outside of direct care

We use your personal data to:

• Provide safe and effective physiotherapy assessment and treatment
• Maintain accurate and complete clinical records as required by the HCPC
• Communicate with you about your appointments and care
• Liaise with your GP, consultant or other healthcare professionals involved in your care (only with your knowledge and consent, except in emergencies)
• Process insurance or third-party billing where authorised by you
• Comply with legal, regulatory and safeguarding obligations
• Undertake clinical audit or quality improvement (using anonymised or aggregated data)

We will not use your health information for direct marketing or sell it to any third party.

As a registered HCPC physiotherapist, Gerry McGrann may discuss cases in clinical supervision or peer review for the purpose of improving patient care and maintaining professional standards. This is a professional requirement under HCPC Standard 6. Where cases are discussed, every effort is made to anonymise information. In limited circumstances where identification is unavoidable, this is considered a necessary and proportionate disclosure under our legitimate interests as a healthcare provider.

We will only share your personal data where there is a lawful basis to do so. This may include:

• Other healthcare professionals (e.g. GP, consultant, specialist) — only with your knowledge and consent, or in an emergency where your safety is at risk
• Insurance companies — if you are claiming through private medical insurance or employer liability, with your authorisation
• Professional indemnity insurer — in the event of a legal claim, limited clinical information may need to be disclosed
• HCPC or CSP — if required for regulatory investigation or fitness to practise proceedings
• Legal or regulatory authorities — where required by law, including safeguarding referrals, court orders or public health obligations

We do not share your data with any third parties for marketing or commercial purposes.

In certain circumstances we are legally or professionally required to disclose information without your consent:

• Safeguarding: if we have reasonable cause to believe a child or vulnerable adult is at risk of harm, we are legally required to refer to the appropriate authority
• Court orders: if ordered by a court to disclose clinical records
• Serious communicable disease: if required by public health legislation
• Prevention or detection of serious crime

We will always aim to inform you of any such disclosure unless doing so would compromise the purpose of that disclosure.

We retain personal and clinical data in line with HCPC guidance and NHS best practice:

• Adults: clinical records are kept for a minimum of 8 years from the date of the last treatment episode
• Children and young people: records are kept until the patient reaches age 25, or 8 years from last treatment if this is longer
• Deceased patients: records are retained for a minimum of 8 years from the date of death
• Enquiries (no treatment): contact data is deleted within 12 months

After the applicable retention period, records are securely destroyed.

We take appropriate technical and organisational measures to protect your personal data, including:

• Securing physical records in locked storage with restricted access
• Using password-protected devices and encrypted storage for electronic records
• Ensuring any third-party software used to manage records is GDPR-compliant
• Limiting access to personal data to authorised individuals only

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where appropriate, inform you directly.

You have the following rights regarding your personal data:

• Right of access (Subject Access Request): to receive a copy of the personal data we hold about you, free of charge, within one calendar month
• Right to rectification: to have inaccurate data corrected
• Right to erasure: to request deletion of your data where there is no legal basis to retain it (note: this right is limited where we are required to retain clinical records under HCPC standards)
• Right to restriction: to restrict how we process your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time — this does not affect the lawfulness of prior processing
• Rights related to automated decision-making: we do not use automated decision-making or profiling in our clinical or administrative processes

To exercise any of these rights, contact us at info@gerrymcgrannphysiotherapy.co.uk. We will respond within one calendar month. We may ask you to verify your identity before fulfilling a request.

If you have concerns about how we handle your personal data, please contact us in the first instance. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We may update this Privacy Notice from time to time. The most current version will always be available on this website. We recommend checking back periodically. Where changes are material, we will take reasonable steps to notify you.