Privacy notice

Last updated: 30 October 2026

Hive Physio Ltd is a home-visit physiotherapy practice run by Kathryn Kwan, chartered physiotherapist. This notice explains what personal information we collect, why we use it, who we share it with, how long we keep it and what your rights are. We are the data controller for your information.

Contact us

Hive Physio Ltd, Holly Tree House, 17 Hall Road, Bowdon, Altrincham WA14 3AW
Phone: 07775 842219
Email: kathryn@hivephysio.co.uk
Registered in England and Wales, company number 12744887
Registered with the Information Commissioner’s Office, number ZA899109

What we collect

Your name, address, phone number, email address and date of birth.
Next of kin or emergency contact details.
Health information: your medical history, symptoms, assessment findings, treatment notes, exercise plans, and letters or results from your GP, consultant or other clinicians.
Information about your home and care needs where it is relevant to your treatment, such as mobility aids or support at home.
Invoicing and payment details. We do not store full card numbers.
What you tell us when you make an enquiry through our website form, by email, by phone, by WhatsApp or on social media.
If you contact us on behalf of a relative, your name, contact details and relationship to them.

We treat adults only.

Health information is “special category data” under UK data protection law and has extra protection.

Why we use it and our lawful bases

To assess and treat you and keep clinical records. Lawful basis: contract. For health information, we rely on the provision of health care by a health professional who owes you a duty of confidentiality (UK GDPR Article 9(2)(h) and Data Protection Act 2018, Schedule 1, paragraph 2).
To keep the records required of an HCPC-registered physiotherapist. Lawful basis: legal obligation and legitimate interests.
To invoice you and keep accounts. Lawful basis: contract and legal obligation.
To reply to an enquiry. Lawful basis: legitimate interests, or taking steps at your request before treatment starts.
To protect you or someone else in an emergency, or where there is a safeguarding concern. Lawful basis: vital interests or legitimate interests, and for health information, the safeguarding condition in the Data Protection Act 2018.
To send occasional updates or ask whether you would leave a review. Lawful basis: your consent, which you can withdraw at any time.
Photographs or video. We only take or use these with your separate written consent.

Where we get it from

Directly from you, from a relative or carer acting for you, and, with your agreement, from your GP, consultant or other health professionals.

Who we share it with

We never sell your information. We only share it where it is needed:

Your GP, consultant or other health professionals involved in your care, with your agreement.
A relative or carer, with your agreement.
Your health insurer, if you ask us to provide information to support a claim.
Service providers who act only on our instructions: Zanda Health (clinical records and booking software), Wix (our website and enquiry form), our email provider, and WhatsApp if you message us there. Our accountant also receives invoicing records and handles them as a separate controller.
Safeguarding authorities, emergency services, regulators or courts, where the law requires or allows it.

We owe you a duty of confidentiality. We only share your health information without your agreement where the law requires it or where there is a serious risk of harm to you or someone else.

Transfers outside the UK

Some of our service providers may store information outside the UK. Where they do, we make sure the transfer is protected by UK adequacy regulations or approved contract terms, such as the UK International Data Transfer Agreement.

How long we keep it

Clinical records: 8 years after your last treatment.
Invoices and accounting records: 6 years from the end of the financial year they relate to.
Enquiries that do not lead to treatment: 12 months.

After that we securely delete or destroy the information.

Your rights

You have the right to ask for a copy of your information, to have it corrected, to ask us to delete it or limit how we use it, to object to how we use it, to ask us to transfer it to you or someone else, and to withdraw consent at any time where we rely on consent. Some rights are limited for clinical records, which we must keep for the periods above. We will reply within one month, and there is normally no charge. To make a request, contact us using the details above.

Website and cookies

Our website is hosted by Wix. Information you send through the enquiry form is stored in our Wix account and emailed to us. Our Cookie Policy explains the cookies the site uses. If you message us on WhatsApp, your messages are end-to-end encrypted and WhatsApp (part of Meta) handles them under its own privacy policy. We copy anything needed for your care into your clinical record.

Complaints

If you are unhappy with how we have used your information, please contact us first and we will try to put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.