Privacy Notice

1. Who we are

Graham Holman Physiotherapy Ltd (company number 06827443, registered in England and Wales), trading as Havering Therapy Centre, 94 North Street, Hornchurch, Essex RM11 1SR, is the data controller for the personal information described in this notice. This means we are responsible for deciding how your information is held and used.

Telephone: 01708 621111
Email: admin@haveringtherapy.com
Data protection contact: Graham Holman, Clinic Director
ICO registration reference: ZA774417

2. What information we collect

The information we hold depends on your relationship with us.

If you are a patient

Details about you: your name, date of birth, address, telephone numbers and email address.
Health information: your medical history, the conditions you are being treated for, medications, relevant test results, details of your assessments and treatment, and notes made by your clinician. This is described in law as special category data and is given extra protection.
Your GP's details, and details of any consultant or other clinician involved in your care.
Payment and funding information: how your treatment is being paid for, and where relevant your insurer, membership number and claim number. We do not store card details.
Correspondence between you and the clinic, including appointment reminders and messages.

If you visit our website

Our website does not use cookies, and we do not run analytics or advertising trackers. We do not build profiles of visitors. See section 7 for the detail.

3. Why we use it, and our lawful basis

Data protection law requires us to have a valid reason — a "lawful basis" — for using your information. Because health information is special category data, we need a basis under both Article 6 and Article 9 of the UK GDPR.

What we use it for	Our lawful basis
Assessing and treating you, and keeping clinical records of your care	Article 6(1)(b) — performance of a contract with you. Article 9(2)(h) — provision of health care and treatment, by professionals bound by a duty of confidentiality.
Managing appointments and contacting you about your care	Article 6(1)(b) — performance of a contract with you.
Taking payment, invoicing and processing insurance claims	Article 6(1)(b) — performance of a contract. Article 6(1)(c) — compliance with our legal obligations, including tax and accounting.
Meeting our professional, regulatory and legal duties (for example HCPC standards, or responding to a legal claim)	Article 6(1)(c) — legal obligation. Article 9(2)(f) — establishment, exercise or defence of legal claims, where relevant.
Keeping our clinic safe and running properly, and improving the quality of our service	Article 6(1)(f) — our legitimate interests in operating a safe and effective clinic.

We do not use your information for marketing, and we do not sell your information to anyone, ever.

Your confidential medical information will only be disclosed to those involved with your treatment. Specifically, we may share information with:

Your GP or other clinicians involved in your care, where this is appropriate and you have consented to it.
Your insurer, where your treatment is being funded by an insurance policy and you have consented to us doing so, for the purpose of progressing your claim.
Our professional advisers — for example our accountant or insurer — where necessary, and under a duty of confidentiality.
Regulators, courts or law enforcement, where we are required to do so by law, or where there is a serious risk of harm.

We do not transfer your personal information outside the United Kingdom.

5. How long we keep it

We keep your clinical records for as long as is required by law and by professional guidance, and no longer than necessary.

Adult patient records: 8 years after the conclusion of your treatment.
Records for children and young people: until the patient's 25th birthday, or their 26th birthday if they were 17 at the conclusion of treatment.
Financial and accounting records: 6 years, as required by HMRC.

When records reach the end of their retention period, they are securely destroyed.

6. How we keep it safe

We take appropriate technical and organisational measures to protect your information, including:

Restricting access to your records to the clinicians and staff who need it to provide your care.
Keeping paper records in locked storage on clinic premises.
Protecting electronic records with access controls, and keeping our systems up to date.
Training our staff on confidentiality and their obligations under data protection law.
All of our clinicians are registered with the Health and Care Professions Council (HCPC) or an equivalent professional body, and are bound by a professional duty of confidentiality.

7. Our website

We have deliberately built this website to collect as little information as possible.

No cookies. This website does not set any cookies on your device.
No analytics or tracking. We do not use Google Analytics or any similar service, and there are no advertising or social media trackers.
Our online registration form does not transmit your answers. If you complete a registration and consent form on our website, everything you type stays in your own web browser, on your own device. Your answers are not sent to us, or to anyone else, over the internet. The completed form is produced on your device for you to print or save, and you choose how to return it to us.
Hosting. Our website is hosted by Netlify. Like all web hosts, their servers process the technical information needed to deliver a web page to you, such as your IP address. They do not receive any information you type into our forms, because our forms do not send anything.
Fonts. The typefaces used on this site are hosted on our own website. Your browser does not contact Google Fonts or any other font service, so no third party sees your visit.
No external requests. Loading a page on this website does not cause your browser to contact any third party. Links to outside organisations — such as the ICO or the HCPC — only take you there if you choose to click them.

If you email us, please remember that ordinary email is not a fully secure way to send confidential medical information. If you would prefer not to email medical details, you are very welcome to bring your form to the clinic or post it to us instead.

8. Your rights

Under UK data protection law you have the right to:

Be informed about how we use your information — which is what this notice is for.
Access your information and receive a copy of it. This is known as a subject access request, and it is free of charge. We will respond within one month.
Have inaccurate information corrected. Note that clinical opinion recorded at the time cannot usually be erased, but we can record your disagreement alongside it.
Request erasure of your information. This right is limited where we are legally required to keep clinical records.
Restrict or object to how we use your information in certain circumstances.
Data portability — to receive certain information in a portable electronic format.
Withdraw your consent at any time, without prejudice, where we rely on your consent.

To exercise any of these rights, please contact us on 01708 621111 or at admin@haveringtherapy.com. We may ask you to confirm your identity before we release information.

9. How to complain

If you have any concerns about how we have handled your information, please tell us first — we would much rather hear from you and put things right. You can contact us using the details above, or see our complaints procedure.

You also have the right to raise your concerns with the Information Commissioner's Office (ICO), the UK's data protection regulator:

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this notice

We may update this notice from time to time. Where changes are significant, we will make this clear on the website. This version was last updated in August 2026.

On this page