The Functional Care Clinic
Privacy policy
This notice explains how Nicola Clubbe uses personal information for The Functional Care Clinic under the UK GDPR and Data Protection Act 2018, as amended.
1. Who is responsible for your information?
Nicola Clubbe, trading as The Functional Care Clinic
4 Monet Close, Connah’s Quay, Flintshire
Functionalcareclinic@gmail.com · 07359 287323
Nicola Clubbe is the data controller for clinic client records. Contact her using the details above for privacy questions or to exercise your rights.
2. Information used
- Full name, date of birth, email address, phone number and booking information, and parent/guardian or emergency contact details where needed. Enquiry details are used to identify the patient, respond and set up a Cliniko record where appropriate.
- Health history, symptoms, relevant conditions, medication, allergies, assessment findings, treatment notes, consent records, exercise programmes and progress information.
- Appointment, payment and invoice records, correspondence and complaints.
- Photographs, recordings or testimonials only where separately agreed.
- Technical information processed by website hosting, email, payment, exercise or video service providers, such as IP address and connection information.
Information normally comes directly from you. With your permission, relevant information may also come from your treating team or an agreed referral source. Please give emergency contacts only the information necessary and let them know their details have been provided.
3. Why information is used & the lawful bases
- Enquiries, bookings and delivering your agreed service: steps at your request before a contract and performance of that contract (Article 6(1)(b)).
- Necessary clinic administration, security, complaints and establishing or defending legal claims: legitimate interests (Article 6(1)(f)), balanced against your rights. Applicable legal obligations, such as tax records, use Article 6(1)(c).
- Health information for assessment, treatment planning and digital rehabilitation: in addition to the relevant Article 6 basis, explicit consent under Article 9(2)(a) is obtained and recorded separately before this use. Consent to treatment is separate from consent to process health information.
- Information necessary for legal claims: Article 9(2)(f) may apply to relevant health records where retaining or using them is necessary for establishing, exercising or defending a claim.
- Optional photographs, recordings, testimonials or marketing: separate consent (Article 6(1)(a), and explicit consent under Article 9(2)(a) if health information is involved).
You can withdraw consent by contacting Nicola. Withdrawal does not invalidate earlier lawful processing. If necessary health information cannot be processed, safe treatment or digital rehabilitation may not be possible; alternatives can be discussed. After withdrawal, information will be deleted unless a separate, applicable lawful basis and special-category condition justify retaining specific records, for example for a legal claim. No decisions about your care are made solely by automated processing.
4. Who information may be shared with
Cliniko is used to store clinical notes and manage client records online. Rehab Guru is used to deliver home exercise plans and exercise prescriptions. Relevant identity, contact and clinical information is processed through these services where needed for your care. Nicola remains responsible as the clinic’s data controller.
Read the providers’ privacy information: Cliniko and Rehab Guru.
Information is accessed only where needed for its purpose. Provider categories include clinic-record and digital exercise services, video consultation services, email and communications providers, payment providers, and website hosting providers (this site is hosted through OpenAI Sites). The enquiry helper opens your own email app with the name, date of birth, email address, phone number and appointment preferences you enter. Review these before sending. Details are not saved in your browser by the clinic form, submitted to a clinic database, automatically sent or automatically imported into Cliniko. Nicola enters relevant details into Cliniko manually.
The exercise and video platforms used for your appointment, and relevant privacy information, are explained before your account or appointment is set up. You may request details of the current providers from Nicola. Providers may act as processors under appropriate agreements or as independent controllers for their own services, depending on their role.
Relevant information may be shared with your GP or treating clinician with your permission, or with insurers, legal advisers, regulators or public authorities when there is a lawful and necessary reason. Safeguarding or serious safety concerns may justify a limited disclosure where a valid legal basis applies. Information is not sold.
5. Security & international processing
Client information, consultation notes and treatment records are stored and recorded online and treated confidentially. Digital records are handled in accordance with the UK GDPR and Data Protection Act 2018.
Clinic information is handled with access restrictions and appropriate organisational and technical safeguards, with records accessible only to authorised people. Please avoid detailed medical information in website enquiries or social-media messages; the appropriate intake route will be explained.
Some digital service providers may process information outside the UK. Before a provider is used for clinic data, applicable transfer arrangements must be established, such as UK adequacy regulations or approved contractual safeguards. Ask Nicola for details of the providers, locations and safeguards relevant to your care. A provider’s own notice also applies to information it controls.
6. How long information is retained
Adult assessment and treatment records are normally retained for eight years from the last appointment. Records for clients treated while under 18 are normally retained until their 25th birthday or eight years from the last appointment, whichever is later. Necessity is reviewed, and relevant information may be kept longer where a specific legal claim, legal obligation or insurer requirement justifies this. These are clinic retention periods, not a claim that UK GDPR itself requires eight years.
Enquiries that do not lead to treatment are normally deleted within 12 months of the last contact, unless needed for an unresolved complaint or legal matter. Financial records are kept for the applicable statutory accounting and tax period. Optional promotional materials are reviewed when consent is withdrawn and removed from channels controlled by the clinic where practicable. Records are securely deleted or destroyed when no longer needed.
7. Your rights
Depending on the information and legal basis, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent. These rights are subject to legal conditions; for example, erasure may not apply where records are necessary for a legal claim. Contact Nicola to make a request. A response is normally provided within one month; any lawful extension or request to confirm identity will be explained.
8. Website privacy & external links
The clinic page does not add advertising trackers, analytics scripts or non-essential cookies. Hosting or sign-in services may use technical logs or essential session technologies subject to their own notices. Fonts and clinic images are served with the website. Maps and other external links open third-party services with their own privacy notices. This site does not take payments or make bookings automatically.
9. Concerns & complaints
Please contact Nicola first if you have a privacy concern. You can also complain to the Information Commissioner’s Office (ICO) at any time. Further information about your rights is available at ico.org.uk.
10. Updates
This notice is reviewed when clinic practices change. Material changes will be explained before information is used for a new purpose.