Privacy policy

1. Data we collect

We collect and process the following personal data:

Contact information:

• First name
• Last name
• Contact number
• Email address

Health information:

• Date of birth (DOB)
• Medical history and treatment notes (required for effective treatment and to comply with healthcare regulations)

Payment information:

• Card payment details processed securely via SumUp (we do not store payment card information ourselves; all transactions are handled by SumUp in accordance with their privacy policy)

2. How we use your data

We use your personal data for the following purposes:

• Contact number — to get in touch with you if necessary (e.g. to confirm or amend appointments).
• Email address — to send booking confirmations, reminders, and occasional updates.
• Health information — to ensure safe and effective treatment tailored to your needs.
• Rehabilitation programs — to create tailored rehabilitation programs using Rehab My Patient, which is linked to our Cliniko system.
• Payment information — to process payments securely using SumUp.

3. Data storage and security

Your data is stored securely using:

• Cliniko — a GDPR-compliant platform for managing bookings, storing medical records, and client contact information.
• Rehab My Patient — a secure platform for managing rehabilitation programs, storing names, contact numbers, emails, and DOBs, which integrates with Cliniko.
• SumUp — a secure payment processing service that adheres to industry standards for data protection.

We take all reasonable measures to protect your data, including encryption, secure password management, and limiting access to authorised personnel only.

4. Third-party services

We only share your data with third-party providers (e.g. Cliniko, Rehab My Patient, SumUp) to facilitate the services offered. These providers are GDPR-compliant and committed to safeguarding your data.

On this website:

• Contact form — your name, email address, phone number (if you give it) and message are emailed to us, through Amazon Web Services in the UK, so we can reply. The website doesn’t keep its own copy.
• Spam protection — the contact form uses Cloudflare Turnstile to check that a person, not a program, is sending it. Cloudflare uses your IP address and basic details about your browser for that check only.
• Online booking — our booking page shows Cliniko’s booking system, so the details you enter there go straight to Cliniko (see above).
• Map — the map on our pages is provided by Google Maps. Google receives your IP address when it loads, and Google’s own privacy policy applies to it.
• Usage statistics — we use PostHog to collect anonymous statistics (such as pages visited, device type and which buttons are clicked) on servers in the EU. No cookies are set and the data can’t be used to identify you.
• Security and fault logs — to keep the website secure and fix problems, our servers record each request: the page, the time, your browser type and your IP address. These records are kept for up to 30 days by Amazon Web Services in the UK, and for 3 days by Better Stack, our error-monitoring service, in the EU.

5. Your rights

Under GDPR, you have the right to:

• Access your personal data;
• Rectify any inaccuracies;
• Request the deletion of your data, where applicable;
• Restrict or object to data processing;
• Data portability.

To exercise these rights, contact our contact form.

6. Retention of data

Medical records are kept for 7 years, in line with healthcare regulations.

7. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website and, where appropriate, notified via email.

8. Contact us

David Down Sports Therapy Limited

Message us through our contact form
Phone: 01908 035668

Clinic address: Wolverton Swimming and Fitness Centre, Addington Avenue, Milton Keynes, MK12 5GH

Registered company number: 11345289