Cranfold Physical Therapy Centre is committed to ensuring that your and your family’s privacy is protected in accordance with the law. This privacy policy explains what information Cranfold Physical Therapy Centre may collect, how it is protected and how this information may be used, in accordance with the General Data Protection Regulations 2016 (GDPR) and country-specific data protection legislation.


Any information that we hold on you will only be used in accordance with this privacy policy and any consent that you have provided to us on our website; sign-up forms; on registration as a patient; or during any clinical appointments.

We may change this policy from time to time and the latest copy will always be available on this website page, at our premises and on request. You should check this policy from time to time to ensure that you are aware of the latest version and are happy with any changes. This policy version is effective from 22.05.2018.

Who are we?

Cranfold Physical Therapy Centre and Cranfold Physio are both trading names of Cranfold Physical Therapy Centre Ltd, registered in England. Company no. 03843651. 107 High Street Cranleigh Surrey GU6 8AU. Email reception@cranfoldphysio.co.uk. During this document we may refer to this Company as ‘Cranfold Physio’, ‘we’ or ‘our’ and we are a Data Controller in terms of data protection classification. Cranfold Physio work with several well-known, accredited and trust-worthy Data Processors including Atlas Health Group Ltd, our parent company, and Microsoft, who are also bound by Data Protection and GDPR legislation.

Our Information Security Commitment

Cranfold Physio are committed to ensuring that your information is confidential and secure. In order to prevent unauthorised access or disclosure, we have implemented suitable physical, electronic and managerial procedures to safeguard and secure the information we collect and securely store online, within the clinical environment and within our vital data processing and storage systems. Cranfold Physio are registered with the Information Controllers Office (ICO), are registered for PCI-DSS compliance as part of our card data security measures and are currently applying for non-compulsory Cyber Essentials IT Security accreditation as part of our commitment to data security.



Defining Personal Data.

Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Cranfold Physio, in the course of its business, is required to process data. Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

What Information may Cranfold Physio collect about me?

We may collect the following information about you as a web-user, social media contact or if you sign-up to our marketing database via a contact form:

Name, Email address, Birthday, IP Address, contact preferences.

Other information relevant to customer surveys and/or offers such as hobbies.

In addition, as a prospective or registered patient we may also collect (and legally may be obliged to collect) the following data:

Additional personal information such as date of birth, title.

Contact information including address, email address, contact phone numbers.

Next of kin or family members already registered with Cranfold Physio Ltd.

Demographic information such as address, postcode, preferences and interests.

Medical contact information such as GPs, consultants or other allied professionals.

Health insurance details such as policy number, authorisation code, excess.

Clinical information including current injury or episode of care, past medical history, family structure and medical history, current or past medications, allergies, social status and history including job title, work status, hobbies, exercise frequency.

Referral letters, investigation reports or copies, solicitor and health insurance correspondence.

We do not store credit card details and all card transactions are undertaken in accordance with PCI-DSS requirements to ensure that your card data is protected at all times.

How will Cranfold Physio use the information it collects about me?

Cranfold Physio may use your information for several purposes including:

To provide and improve our services, activities, marketing and online content.

To provide you with relevant and useful information.

To contact you regarding a comment or submission you have made on our social media or website.

To enable us to contact you to deal with your requests or enquiries and provide excellent customer service.

For service administration such as appointment reminders, invoicing, account updates, clinical follow-up and correspondence.

For clinical assessment, treatment, management and liaison including (with your permission) correspondence with third parties such as referrers; medical insurers; your GP; consultant; allied or related professionals such as a therapist, personal trainer, Pilates teacher; your employer and any other relevant party.

We may also use your information to contact you for market research or service improvement purposes. We may contact you by email, phone or mail.

We may use the information to customise our(s) website according to your interests.

We may also show you relevant advertising on third party sites.

For analysis and research purposes to improve our services. This may include analysis of non-identifiable information such as postcode area, age, gender, referral source, appointment type, outcome however organisational measures are taken to ensure that this data is not combined to an extent that it becomes uniquely identifiable. Analysis can include using geodemographic information from external sources such as IP address location; Email open and click rates.


When will Cranfold Physio Contact Me?

Cranfold Physio may contact you:

In relation to any service, activity or online content you or your child (under 16) have made enquiries about or registered for, in order to ensure that Cranfold Physio can deliver these services, e.g. to verify your email when you sign up for a Cranfold Physio Appointment booking Log-in; to verify a ‘bounced’ Email address; to help you reset your password; to ensure that you have received an appointment reminder, invoice reminder or other ‘service’ communication.

In response to a referral from a 3rd party such as a medical professional, medical insurer, care organisation or solicitor.

In relation to any correspondence we receive from you or any contact, comment or complaint you make to or about Cranfold Physio, it’s products, services or content.

In relation to any clinical services you are using.

To invite you to participate in surveys about Cranfold Physio, it’s products or services.

To update you regarding changes to Cranfold Physio’s terms and conditions, pricing or financial obligations, policies and practices.

For marketing purposes, as set out in section 6.

We will never contact you to ask for your Cranfold Physio online password, or other login information.  Please be cautious if you receive any emails or calls from people asking for this information and claiming to be from Cranfold Physio.

Will I be contacted for marketing purposes?

Cranfold Physio will only send you marketing emails, mailshots or personalised advertisements on our website or 3rd party sites (such as Facebook, Google, Instagram and Twitter) where you have agreed to this.

We offer periodic Email newsletters and news Emails, to let you know about Cranfold Physio ‘s products and services as well as relevant news content such as medical research findings. We may personalise the message content based upon any information you have provided to us.

If you don’t want to be shown targeted advertising messages from Cranfold Physio, some third party sites allow you to request not to see messages from specific advertisers on that site.

If you change your mind and wish to update your preferences or stop all personalised services from Cranfold Physio, including targeted advertising messages on third party sites you can do so via the footer of any marketing Emails; by Emailing reception@cranfoldphysio.co.uk or by writing to us at our registered address.

Will Cranfold Physio share my personal information with anyone else?

We will keep your information within Cranfold Physio except where you have requested or consented for it to be shared or disclosure is required or permitted by law:

To government bodies and law enforcement agencies, including for child or adult protection, safe-guarding or where we believe that any breach of applicable laws has taken place.

We may share your personal information internally. For example, to enable invoicing, internal clinical referral or with another clinician in the absence of your clinician due to holiday or sickness.

For clinical management and liaison including (only with your permission) correspondence with third parties such as referrers; medical insurers; your GP; consultant; allied or related professionals such as a therapist, personal trainer, Pilates teacher; your employer and any other relevant party.

Third parties such as health insurers and GP practices may also store your personal data, will have their own data security policies and are similarly bound by the Data Protection Act 1998, and the General Data Protection Regulation (GDPR) (EU) 2016/679. Cranfold Physio has no control over these and you should contact these third parties directly should you wish to view their privacy policies.

Sometimes Cranfold physio uses third parties to process or store your information on our behalf, for example to provide card payment services; secure electronic data storage or data analysis. Cranfold Physio requires that these third parties comply strictly with our instructions and that they do not use your personal information for their own business purposes, unless you have explicitly consented to the use of your personal information in this way. Some of the Companies that own software that we use to process data, such as Microsoft (Office 365), and Xero are based outside of the EU however each company has either opted to comply with Data Protection Act 1998, and the General Data Protection Regulation (GDPR) (EU) 2016/679 legislation or have been formally accredited.

Cranfold Physio would only share information in circumstances where such disclosure is permitted under applicable laws, including data protection law.

How long will the Cranfold Physio keep my personal information?

We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract that we may hold with you.

The Records Management Code of Practice for Health and Social Care (2016) specifies different time frames and retention strategies for different types of medical records. For example, it specifies the need to keep adult medical records for at least 8 years and those of children and pregnant women, until the child is 25. All patient information processed by Cranfold Physio after 2012 is stored securely in a cloud-based, practice management portal, TM2. BlueZinc IT Ltd own and operate this system, and they have their own extremely stringent internet safeguards, and security policies as a registered data processor.

Can I find out what personal information Cranfold Physio holds about me?

You have the right to request details of the personal information which we hold about you under the Data Protection Act 1998, and the General Data Protection Regulation (GDPR) (EU) 2016/679. Requests should be made in writing to Cranfold Physical Therapy Centre, 107 High Street, Cranleigh, Surrey, GU6 8AU stating what information you require or alternatively you may complete our Subject Access Request Form via Email. We also require additional identification (copies of two forms of ID) prior to releasing any information.

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible at the above address. We will use all reasonable efforts consistent with our legal duty to provide or correct the personal information about you on our records.

Right to withdraw data protection consent.

You have the right to withdraw your consent to processing of your personal data at any time by writing to Cranfold Physical Therapy Centre, 107 High Street, Cranleigh, Surrey, GU6 8AU.

Right to be forgotten

You have the right to request the erasure of all personal data that we hold about you if:

The personal data is no longer necessary for the purpose which it was originally collected or processed.

Consent is the lawful basis for holding the data, and you withdraw your consent.

There is no legitimate interest to continue processing this information.

The personal data is being processed for direct marketing purposes and you object to that processing.

You are required to comply with a legal obligation to request that your data is erased.

You can delete your online access to our appointment booking system however this does not delete the clinical data that we hold for you.

Please note that there is not an absolute right for data to be erased and certain categories of information relating to healthcare are exempt from this right. Legal and ethical requirements to store or maintain certain documents may mean that we are unable to fully comply with a request to delete personal information that we hold about you however any decision and justification will be communicated to you.

How we use website cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

We sometimes embed content from social media and other third party websites. These may include YouTube, Twitter, Facebook and Instagram. When you visit a page containing such content, you may be presented with cookies from these websites and these third party cookies may track your use of the BBC website, including the use of Google Analytics. Cranfold Physio do not control the dissemination of these cookies and you should check the relevant third party’s website for more information. If you continue without changing your settings, we’ll assume that you are happy to receive all cookies on our website.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites

Our website may contain links to other websites of interest. Once you have used these links to leave our site, you should note that we do not have any control over that other website. We cannot therefore be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. These third party websites have their own privacy policies, and are also likely to use cookies, and we therefore urge you to review them.

Subscription to our Email and Direct Mail Database.

Website users, legitimate contacts and our registered patients are provided the opportunity to subscribe to our newsletter and other marketing Emails via a sign-up form hosted by Brevo.

Brevo is a well-known and highly-regarded third party which is also bound by the Data Protection Act 1998, and the General Data Protection Regulation (GDPR) (EU) 2016/679. Brevo has its own privacy policy which is available on it’s website.


The Newsletter informs our customers and business partners about our services, new team members, local charitable events, physiotherapy related information, and clinic news. You will only receive our newsletter if you have opted-in to receiving Email marketing from us. During sign-up the third party software may record the IP address of the computer used as this data is necessary in order to understand the (possible) misuse of the e-mail address of a data subject at a later date. Further information is available from Brevo.


If you change your mind and wish to update your preferences or unsubscribe, you can do so via the footer of any marketing Emails; by Emailing reception@cranfoldphysio.co.uk or by writing to us at our registered address.


Comments functionality on our Blog or website.

Cranfold Physical Therapy Centre offers users the possibility to leave individual comments on our blog and on some parts of our website. A blog is a web-based, publicly-accessible portal, through which one or more people called bloggers may post articles or write down thoughts in so-called blogposts. Blogposts may usually be commented on by third parties.

If you leave a comment on the blog, the comments are stored and published, as well as information relating to the date of the commentary and your pseudonym. Your IP address may be visible to, or stored by Cranfold Physio.


If you any questions or comments about this Privacy Policy or the Data Protection Act 1998, and the General Data Protection Regulation (GDPR) (EU) 2016/679 please contact:

The Data Protection Officer

Cranfold Physical Therapy Centre

107 High Street,

Cranleigh,

Surrey,

GU6 8AU.

reception@cranfoldphysio.co.uk