Privacy Policy
Last updated: September 2026
Data Controller
Neurosana Therapies Ltd
Registered in England
Companies House: 17166307
ICO Registration: ZC139035
Contact: admin@neurosanatherapies.co.uk
1. Who We Are
Neurosana Therapies Ltd is a specialist neurological physiotherapy practice providing home-based rehabilitation services to clients across London and the Home Counties.
Neurosana Therapies Ltd is the data controller for the personal data described in this policy. This means that we are responsible for deciding how and why your personal data is processed and for ensuring that it is handled in accordance with data protection law.
This privacy policy explains how we collect, use, store and share personal data and sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions about how we handle your data, please contact us at admin@neurosanatherapies.co.uk.
2. What Data We Collect
Clients and their representatives
In order to provide physiotherapy and rehabilitation services, we may collect and process:
Full name, date of birth and contact details
Medical history, diagnoses and clinical records
Rehabilitation goals, assessment findings and treatment notes
Information about physical, cognitive, behavioural or other difficulties relevant to rehabilitation
Medication information where relevant to physiotherapy management
Information about equipment, care, support or environmental needs where relevant
Details of treating clinicians, case managers, solicitors, deputies and other professionals involved in your care
Funding and billing information, including the identity of the person or organisation funding treatment
Communication records, including emails, letters and relevant professional correspondence
Information required for safeguarding, risk management and clinical governance
Where a client is a child or lacks capacity to make particular decisions, we may also process relevant information about their parent, guardian, litigation friend, deputy, attorney, next of kin or other authorised representative.
Referrers and professional contacts
If you refer a client to us or work with us professionally, we may hold:
Your name, job title and organisation
Your professional contact details
Records of referrals made and correspondence exchanged
Your professional registration details, where relevant
Information relating to our professional relationship with you
Website visitors and enquiries
If you contact us through our website, by email or by telephone, we may collect the information you choose to provide, including information contained within an enquiry or assessment request.
Please be aware that enquiries about neurological rehabilitation may contain health information, which is treated as special category personal data and handled accordingly.
Our website uses cookies and similar technologies that are necessary for the operation and security of the website. With your consent, we may also use analytics or performance technologies to help us understand how our website is used and improve it.
Further information is available in our Cookie Policy, and you can manage non-essential cookies through our website's cookie preferences.
3. Special Category Data
Information about a person's health is classified as special category personal data under UK GDPR and receives additional legal protection.
We process health information primarily where it is necessary for the provision or management of health care or treatment under Article 9(2)(h) UK GDPR, together with the relevant provisions of Schedule 1, Part 1 of the Data Protection Act 2018.
Clinical information is processed by, or under the responsibility of, healthcare professionals who are subject to professional duties of confidentiality.
In some circumstances, another special category condition may apply. For example, where processing is necessary for the establishment, exercise or defence of legal claims, we may rely on Article 9(2)(f) UK GDPR.
Where we rely specifically on your explicit consent for a particular use of special category data, we will make this clear to you and you may withdraw that consent at any time.
We will only use health information for legitimate purposes connected with your care, the operation and governance of our service, our professional and legal obligations, or another purpose permitted by law.
4. Why We Process Your Data and Our Legal Basis
Different legal bases may apply depending on the circumstances.
Providing physiotherapy assessment and treatment
Article 6(1)(b) — performance of a contract or steps taken before entering into a contract.
Special category basis: Article 9(2)(h) — provision and management of health care.
Preparing clinical reports, rehabilitation recommendations and updates for case managers, legal teams, deputies or other authorised parties
Article 6(1)(b) — performance of a contract and/or Article 6(1)(f) — legitimate interests.
Special category basis: normally Article 9(2)(h), and Article 9(2)(f) where processing is necessary for the establishment, exercise or defence of legal claims.
Working with other professionals involved in a client's rehabilitation
Article 6(1)(b) and/or Article 6(1)(f).
Special category basis: Article 9(2)(h), where applicable.
Communicating with referrers and professional contacts
Article 6(1)(f) — our legitimate interests in operating our rehabilitation service and maintaining appropriate professional relationships.
Complying with legal, regulatory, safeguarding and professional obligations
Article 6(1)(c) — compliance with a legal obligation, and/or Article 6(1)(f) where appropriate.
An appropriate Article 9 condition will also be identified where special category data is involved.
Invoicing, accounting and financial administration
Article 6(1)(b) — performance of a contract and/or Article 6(1)(c) — compliance with legal obligations.
Responding to enquiries about our services
Article 6(1)(b) where the enquiry relates to taking steps at your request before entering into a contract, or Article 6(1)(f) — our legitimate interests in responding to enquiries about our services. Where an enquiry contains health information, an appropriate Article 9 condition will also apply.
Establishing, exercising or defending legal claims
Article 6(1)(f) and, where special category data is involved, Article 9(2)(f).
Where we rely on legitimate interests, we consider whether our interests are necessary and proportionate and balance them against the rights and interests of the individuals concerned.
5. Who We Share Your Data With
We do not sell or rent personal data.
Depending on the circumstances, we may share relevant information:
With the referring case manager, solicitor, deputy, insurer, funding body or other authorised professional involved in arranging or managing your rehabilitation
With physiotherapists and other clinicians involved in providing your treatment
With other healthcare and rehabilitation professionals involved in your care where clinically appropriate
With our clinical supervision or governance team where necessary for quality assurance, professional supervision and safe practice
With organisations providing software or professional services that we use to operate our practice, where they process information on our behalf under appropriate contractual arrangements
With the HCPC, CSP or other regulatory or professional bodies where disclosure is appropriate or required
With safeguarding organisations, local authorities, law enforcement agencies or other relevant bodies where disclosure is necessary and lawful
Where necessary for the establishment, exercise or defence of legal claims
Where we are otherwise required or permitted to disclose information by law
We will only share information where there is an appropriate lawful basis. In relation to confidential clinical information, we will also comply with our professional duties of confidentiality and applicable healthcare confidentiality requirements.
Where appropriate, we will discuss information sharing with you. However, there are circumstances in which information may lawfully need to be shared without consent, for example to comply with a legal obligation, address a serious safeguarding concern or protect somebody from serious harm.
6. Third-Party Systems and Data Processors
We use carefully selected third-party organisations and software to help us provide and administer our services.
Where another organisation processes personal data on our behalf, we take appropriate steps to ensure that suitable contractual and data-protection arrangements are in place.
These may include:
Cliniko — clinical records, appointments and practice management
Microsoft 360 — professional email, secure document management and communication
Xero — invoicing and financial administration
Squarespace — website hosting and website functionality
This list will be reviewed and updated to reflect the systems actually used by Neurosana Therapies.
Some providers may process data outside the UK. Where this occurs, we take steps to ensure that appropriate safeguards are in place as described in Section 10.
7. How Long We Keep Your Data
We retain records only for as long as necessary, taking account of applicable legal requirements, professional guidance, clinical need, safeguarding considerations and the establishment, exercise or defence of legal claims.
Our clinical record retention periods are informed by relevant professional guidance, including guidance issued by the Chartered Society of Physiotherapy.
As a general guide:
Adult clinical records: normally retained for at least 8 years following the conclusion of treatment
Children's clinical records: normally retained until the patient's 25th birthday, or 26th birthday where treatment ended when the patient was 17, subject to circumstances requiring a longer retention period
Records connected with litigation or potential legal proceedings: may be retained for longer where reasonably necessary in connection with ongoing or anticipated proceedings, professional obligations, or the establishment, exercise or defence of legal claims
Financial and accounting records: retained for the period required by applicable tax, accounting and company law
Some circumstances may require records to be retained for longer than these general periods.
When personal data is no longer required, it will be securely deleted, anonymised or destroyed in accordance with our data-retention procedures.
8. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
These measures include, as appropriate:
Secure and access-controlled systems for clinical records and sensitive information
Appropriate encryption and security measures provided by the systems we use
Password protection and appropriate access controls
Secure methods of communicating sensitive information where appropriate
Limiting access to personal data to those who need it for legitimate professional purposes
Appropriate confidentiality arrangements
Review of third-party processor security and data-protection arrangements
Procedures for identifying, managing and responding to personal data breaches
If a personal data breach occurs, we will assess the potential impact. Where a breach is likely to result in a risk to individuals' rights and freedoms and notification is required, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where required, affected individuals will also be informed.
9. Your Rights
Depending on the circumstances and the legal basis on which we process your information, you may have the following rights under UK data-protection law.
Right of access
You may request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request.
Right to rectification
You may ask us to correct personal data that is inaccurate or complete information that is incomplete.
Right to erasure
In certain circumstances, you may ask us to delete your personal data. This right is not absolute and may not apply where, for example, we are required or permitted to retain clinical records for legal, regulatory, professional or other legitimate reasons.
Right to restrict processing
In certain circumstances, you may ask us to restrict how we use your personal data.
Right to data portability
In certain circumstances where processing is carried out by automated means and is based on consent or contract, you may have the right to receive personal data in a structured, commonly used and machine-readable format.
Right to object
You may object to certain processing carried out on the basis of legitimate interests. We will consider your objection and whether we have compelling legitimate grounds to continue processing.
Right to withdraw consent
Where we rely on consent as the legal basis for a specific processing activity, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
To exercise any of these rights, please contact admin@neurosanatherapies.co.uk.
We will normally respond to a valid request within one month. We may ask for information to confirm your identity before releasing personal data.
If you have concerns about how we have handled your information, we would welcome the opportunity to address them.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.
10. International Transfers
Some of the service providers we use may store or process personal data outside the United Kingdom.
Where personal data is transferred internationally, we will ensure that the transfer is made in accordance with UK GDPR and that an appropriate mechanism or safeguard is in place where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.
11. Children and People Who May Lack Capacity
We recognise that many of the clients we support may be children or adults who have difficulties with decision-making capacity as a result of neurological injury or disability.
We handle their personal information with particular care.
For children, we will involve a parent, guardian or other person with appropriate parental responsibility where required.
Where an adult may lack capacity to make a particular decision about their information or care, we will act in accordance with applicable law and professional guidance, including the principles of the Mental Capacity Act 2005 where relevant. We may work with an authorised attorney, deputy, litigation friend or other appropriate representative depending on the circumstances.
A person's capacity will not be assumed solely on the basis of a diagnosis or neurological condition.
Clinical records relating to children and adults who lack capacity will be retained in accordance with our applicable retention requirements.
12. Cookies and Website Privacy
Our website uses cookies and similar technologies.
Cookies that are strictly necessary for the website to operate may be used without consent where permitted by law. Non-essential cookies, such as certain analytics, performance or marketing technologies, will only be used where the appropriate consent has been obtained.
Visitors can manage their choices through the cookie controls available on our website.
For more information about the cookies and similar technologies used on our website, please see our Cookie Policy.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our services, systems, legal obligations or guidance.
The current version will be available on our website at neurosanatherapies.co.uk.
Where appropriate, we will notify clients, referrers or other affected individuals of material changes.
This policy was last reviewed in September 2026.