Privacy Policy

At Four* Physio (“Four*”, “we”, “us”, or “our”), we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you visit our website, use our services, or interact with us in any way.

Please read this policy carefully. By using our website or services, you confirm that you have read and understood it.

1. Who We Are

Four* Physio is an integrated musculoskeletal (MSK) healthcare provider based in Shoreham-by-Sea, West Sussex. We operate three services:

  • Four*Physio — advanced practice physiotherapy assessment, diagnosis, and treatment.
  • Four*Gym — a pay-as-you-go gym for adults aged 50 and over.
  • Four*Essentials — our digital notes and exercise platform for patients.

For the purposes of data protection law, Four* Physio is the Data Controller responsible for your personal data. You can contact us at: privacy@fourstarphysio.co.uk

2. What Information We Collect

2.1 Information You Provide to Us

  • Personal details: name, date of birth, address, email address, telephone number.
  • Health information: medical history, symptoms, diagnoses, treatment notes, exercise records, and rehabilitation progress (for clinical and gym service users).
  • Payment information: billing details, payment method (processed securely via our payment provider — we do not store full card details).
  • Communications: messages, enquiries, feedback, and any correspondence you send us.
  • Account details: login credentials for the Four*Essentials platform.

2.2 Information We Collect Automatically

  • Usage data: pages visited, time spent on site, links clicked.
  • Technical data: IP address, browser type and version, device type, operating system.
  • Cookie data: as described in our Cookie Policy (Section 9 below).

2.3 Special Category Data

As a healthcare provider, we process special category data, including health and medical information. We handle this data with the highest levels of security and care, and only process it where we have a lawful basis to do so (see Section 4).

3. How We Use Your Information

We use your personal information to:

  • Provide, manage, and deliver our physiotherapy, gym, and digital platform services.
  • Create and maintain your clinical records and exercise programmes.
  • Process payments and manage bookings and appointments.
  • Communicate with you about your care, appointments, and account.
  • Send service-related updates, class schedules, or changes to our offerings.
  • Respond to your enquiries and complaints.
  • Improve and develop our services through anonymised analysis.
  • Meet our legal and regulatory obligations as a healthcare provider.
  • Detect and prevent fraud or misuse of our services.

We will only send you marketing communications (such as newsletters or promotional updates) where you have given us your explicit consent, and you may withdraw that consent at any time.

4. Our Lawful Basis for Processing

We process your personal data on the following legal bases:

  • Contract: to fulfil our obligations when you book and receive our services.
  • Legitimate interests: to operate, maintain, and improve our business in ways you would reasonably expect.
  • Legal obligation: to comply with regulatory and professional standards applicable to healthcare providers.
  • Vital interests: in emergency situations where processing is necessary to protect life.
  • Explicit consent: for marketing communications and, where required, for processing special category health data.
  • Health or social care purposes (UK GDPR Article 9(2)(h)): for the provision of healthcare treatment and management.

5. Who We Share Your Information With

We do not sell your personal data. We may share your information with:

  • Healthcare professionals: GPs, consultants, or other clinicians involved in your care, with your knowledge and where clinically necessary.
  • Service providers: trusted third parties who support our operations (e.g. payment processors, IT and hosting providers, email platforms), bound by confidentiality and data processing agreements.
  • Regulatory bodies: where we are legally required to disclose information to professional or statutory regulators.
  • Funding and community partners: where you have consented to participate in funded community programmes (e.g. National Lottery-funded initiatives), only the minimum necessary information will be shared.
  • Successors: in the event of a business sale or transfer, your data may be transferred to the new owner, who will be required to uphold this policy.

6. How Long We Keep Your Information

We retain your personal data only for as long as is necessary for the purposes set out in this policy, and in accordance with applicable legal and professional obligations.

  • Clinical health records: retained for a minimum of 8 years following the end of treatment, in line with NHS and professional body guidelines (or until age 25 for records relating to children, whichever is longer).
  • Financial and payment records: retained for 7 years in accordance with HMRC requirements.
  • Website enquiries and general correspondence: retained for up to 2 years.
  • Marketing consent records: retained until consent is withdrawn, plus a reasonable period thereafter.

When data is no longer required, it is securely deleted or anonymised.

7. Your Rights

Under UK data protection law, you have the following rights:

  • Right of access: to request a copy of the personal data we hold about you.
  • Right to rectification: to ask us to correct inaccurate or incomplete data.
  • Right to erasure: to request deletion of your data in certain circumstances.
  • Right to restrict processing: to ask us to limit how we use your data.
  • Right to data portability: to receive your data in a structured, machine-readable format.
  • Right to object: to object to processing based on legitimate interests or for direct marketing.
  • Rights relating to automated decision-making: we do not make solely automated decisions that significantly affect you.

To exercise any of these rights, please contact us at privacy@fourstarphysio.co.uk. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. How We Keep Your Data Secure

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it from unauthorised access, loss, or disclosure. These include:

  • Encrypted data storage and transmission (SSL/TLS).
  • Access controls limiting data to authorised personnel only.
  • Regular security reviews of our systems and processes.
  • Staff training on data protection and confidentiality obligations.

While we take all reasonable steps to protect your data, no method of transmission over the internet is completely secure. If you have concerns about security, please contact us.

9. Cookies

Our website uses cookies to improve your browsing experience and help us understand how visitors use our site. Cookies are small text files stored on your device.

We use the following types of cookies:

  • Essential cookies: necessary for the website to function correctly.
  • Analytics cookies: to understand how visitors interact with our site (e.g. Google Analytics). These are only placed with your consent.
  • Preference cookies: to remember your settings and choices.

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal information.

11. Children’s Privacy

Our gym services are intended for adults aged 50 and over. Our physiotherapy services may be provided to patients of all ages; where we treat children under the age of 16, we will obtain consent from a parent or guardian and handle their data with additional care in accordance with UK GDPR and the ICO’s Children’s Code.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by updating the date at the top of this document and, where appropriate, by email or a notice on our website. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:

  • Email: privacy@fourstarphysio.co.uk
  • Address: Four* Physio, Shoreham-by-Sea, West Sussex
  • Website: fourstarphysio.co.uk

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO):

  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Four*Physio • Shoreham-by-Sea, West Sussex • fourstarphysio.co.uk