CJR PHYSIOTHERAPY PRIVACY POLICY
Last updated: 5 October 2026
WHO WE ARE
CJR Physiotherapy is owned and run by Cerys Robertson. We are the data controller for the personal information you give us, which means we decide how it is used and are responsible for keeping it safe.
We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, and we handle your information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our ICO registration number is [ICO REGISTRATION NUMBER].
Business name: CJR Physiotherapy
Address: Woodcock Hill Farm, Gate B, Barnet Lane, Elstree, Borehamwood, WD6 3QU, United Kingdom
Phone: 07753 140932
Email: robertsoncerys@yahoo.co.uk
THE INFORMATION WE COLLECT
We only collect the information we need to assess, treat and care for you, and to run our appointments and payments.
• Personal details: your name, date of birth, address, phone number and email address.
• Health information: your medical history, symptoms, assessment findings, treatment notes, consent forms and any letters or reports about your care. This is classed as "special category" data and is given extra protection by law.
• Appointment and payment details: your bookings, cancellations, invoices and payment records.
• Third-party details: your GP's details, and your insurer's details and policy number if you are claiming through private medical insurance.
WHY WE USE IT AND OUR LEGAL BASIS
Under UK GDPR we must have a lawful reason for using your information. Ours are:
• To provide your treatment and run your appointments. Our lawful basis is that it is necessary to provide the service you have asked for (Article 6(1)(b), contract).
• To hold your health information and clinical records. Our lawful basis is that it is necessary for the provision of health care by a registered health professional who owes you a duty of confidentiality (Article 9(2)(h)).
• To keep clinical records for the required time and meet our professional and legal duties. Our lawful basis is legal obligation (Article 6(1)(c)).
• To take payment and manage our business. Our lawful basis is contract and our legitimate interests in running the practice (Article 6(1)(b) and 6(1)(f)).
We will ask for your consent before we share your information for any other reason, for example sending a report to your employer. You can withdraw that consent at any time. We do not use your information for marketing without your consent, and we never sell it.
WHO WE SHARE YOUR INFORMATION WITH
We only share your information when we need to, and only as much as is needed.
• TM3: our practice management system. TM3 securely stores your patient record, appointments, clinical notes and invoices, and processes online payments on our behalf. TM3 only uses your information on our instructions.
• The payment provider: the secure card payment company that works with TM3 to take payments. It receives the details needed to process your payment.
• Your GP or other health professionals: when it is needed for your care, and usually with your agreement.
• Your insurer: if you are claiming through private medical insurance, we share the details they need to approve and pay for your treatment.
• Others where the law requires it: for example, if we are legally required to, or if there is a serious risk of harm to you or someone else.
All of these organisations must keep your information secure and in line with UK data protection law.
PAYMENTS AND CARD SECURITY
Card payments are handled securely by our payment provider through TM3. We never see or store your full card details. The payment provider is responsible for keeping your card information secure and meets the Payment Card Industry Data Security Standard (PCI DSS).
We keep a record of what you paid and when, which we need for our accounts.
KEEPING YOUR INFORMATION SECURE
We take your privacy seriously and protect your information in line with ICO guidance.
• Your records are kept in TM3's secure, password-protected system.
• Only the clinicians treating you and staff who need it for their job can see your information.
• Any paper records are kept in a locked cabinet and securely shredded when no longer needed.
• If a data breach ever puts your information at risk, we will act quickly and tell you and the ICO where the law requires it.
HOW LONG WE KEEP YOUR RECORDS
We keep clinical records for the length of time recommended for health records in the UK:
• Adults: 8 years after your last treatment.
• Children and young people: until their 25th birthday, or their 26th if they were 17 when treatment ended.
• Payment and accounting records: 6 years, as required for tax purposes.
After that, records are securely deleted or destroyed.
YOUR RIGHTS
Under UK GDPR you have the right to:
• See your information: ask for a copy of the records we hold about you (a subject access request). We will reply within one month, free of charge.
• Correct it: ask us to fix anything that is wrong or incomplete.
• Delete it: ask us to delete your information. We will do this where we can, but we may need to keep clinical records for the time set out above.
• Restrict or object: ask us to limit how we use your information, or object to it being used.
• Move it: ask for your information in a format you can give to another provider.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time.
To use any of these rights, email robertsoncerys@yahoo.co.uk or call 07538505967.
If you are unhappy with how we have handled your information, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
OUR WEBSITE AND COOKIES
Our website is hosted by Wix. If you contact us through the website, we use your details only to reply to you. The website uses cookies to work properly and to help us understand how it is used. You can manage or block cookies in your browser settings.
CANCELLATION POLICY
We have a strict 24-hour cancellation policy. If you need to cancel or rearrange your appointment, please give us at least 24 hours' notice by phone or email.
If you cancel with less than 24 hours' notice, or do not attend your appointment, you will be charged £30 for physiotherapy, £16 for Yoga or Pilates.
CHANGES TO THIS POLICY
We may update this policy from time to time. The latest version will always be on our website.
If you have any questions about this policy or your information, please contact Cerys Robertson at CJRphysio@outlook.com or on 07538505967.