Privacy Notice
Ascent Physiotherapy & Wellness Limited
Last updated: August 2026
ICO registration number: 00015098662

1. Who we are
Ascent Physiotherapy & Wellness Limited (“Ascent”, “we”, “us” or “our”) provides physiotherapy, rehabilitation and associated health and wellness services.
For the purposes of UK data protection law, Ascent Physiotherapy & Wellness Limited is the data controller for the personal information we collect and use in connection with your care and our services.

2. How to contact us
If you have any questions about this Privacy Notice or how we use your personal information, please contact:
Ascent Physiotherapy & Wellness Limited
Email: info@ascentphysio.co.uk
ICO registration number: 00015098662
You also have the right to raise concerns with the Information Commissioner’s Office (ICO).

3. Information we collect
Depending on how you interact with us and the services you receive, we may collect and process information including:

• your name, telephone number, email address, date of birth and other relevant contact information;

• emergency contact or next-of-kin information where appropriate;

• information about your health, symptoms, medical history, medication, treatment, rehabilitation and clinical progress;

• information provided during assessments, appointments, questionnaires and forms;

• referral information and correspondence from or with other healthcare professionals, insurers or organisations involved in your care where applicable;

• appointment and attendance information;

• communications between you and Ascent;

• payment, invoice, refund and transaction information;

• information required for accounting and financial administration;

• information submitted through our website or online forms; and

• technical information associated with your use of our website where applicable.

Health information is classed as special category personal data under UK data protection law and is given additional protection.
 
4. Where we obtain your information
We usually receive personal information directly from you.
We may also receive relevant information from:

• healthcare professionals or organisations involved in your care;

• referrers;

• insurers or other organisations funding or arranging your treatment;

• parents, guardians or representatives where appropriate;

• booking and clinical-management systems;

• payment service providers; and

• other parties where you have authorised information to be shared with us or where the law permits or requires it.
   

5. How we use your information
We use personal information where necessary to:

• arrange and manage appointments;

• provide physiotherapy, rehabilitation and associated services;

• assess, plan, deliver and review your care;

• maintain appropriate clinical records;

• communicate with you about your appointments, treatment and care;

• provide rehabilitation programmes and relevant clinical information;

• process patient payments, payment requests, invoices and refunds;

• administer late-cancellation or non-attendance charges where applicable under our Booking & Cancellation Terms;

• maintain financial and accounting records;

• manage referrals and communicate with relevant healthcare professionals or organisations where appropriate;

• meet our professional, legal, regulatory, insurance and safeguarding obligations;

• respond to enquiries, complaints or concerns;

• operate, administer and improve our clinic and services; and

• protect the legitimate interests and security of Ascent, our patients and our staff.
   

6. Our lawful bases for using your information
Under UK data protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may process your information because:

• it is necessary to provide services under a contract with you or to take steps at your request before entering into a contract;

• we have a legal obligation;

• it is necessary for our legitimate interests or those of another party, provided those interests do not override your rights and freedoms;

• it is necessary to protect someone’s vital interests; or

• you have given consent where consent is the appropriate lawful basis.

Because clinical records contain health information, we must also have an additional lawful condition for processing special category data.
In providing healthcare services, this will generally be because processing is necessary for the provision and management of health treatment or care by, or under the responsibility of, an appropriately regulated healthcare professional.
Other special category conditions may apply where required by law or in particular circumstances.
 
7. Clinical records
We maintain clinical records to support safe, appropriate and effective care and to meet our professional and legal responsibilities.
Your clinical record may include information about assessments, diagnoses or clinical impressions, treatment, advice, rehabilitation programmes, outcomes, correspondence and other information relevant to your care.
Access to clinical information is restricted to those who require it for legitimate clinical, administrative, professional or legal purposes.
 
8. Appointments and communications
We may use your contact details to communicate with you about matters including:

• appointment confirmations;

• appointment reminders;

• cancellations or changes;

• information relevant to your treatment;

• rehabilitation programmes;

• forms or questionnaires;

• payment or invoice information; and

• other necessary administrative communications.

Where available, you may be able to manage aspects of your appointment through our online booking system.
 
9. Payments and financial information
Ascent uses SumUp to process patient payments.
Routine patient treatment fees are processed using SumUp. Where a charge becomes payable under our Booking & Cancellation Terms, we may also use SumUp to issue an invoice or payment request.
If a payment or cancellation fee is subsequently refunded, the refund may also be processed through SumUp.
When you make a payment, SumUp processes the information necessary to complete and administer the transaction in accordance with its own data-processing arrangements.
Ascent may receive and retain appropriate transaction information, including the amount charged or paid, payment status, transaction date, refunds and information required for invoicing, accounting and financial administration.
Ascent does not need to retain your full payment-card details within your clinical record.
Ascent does not require patients to make full treatment payment through Rehab Guru when booking an initial appointment. Rehab Guru is used for appointment, clinical and administrative functions and is not used by Ascent to process patient treatment payments.
 
10. Sharing your information
We do not sell your personal information.
We may share information where reasonably necessary with:

• healthcare professionals involved in your care;

• organisations or professionals who have referred you or are funding or arranging your treatment, where appropriate;

• service providers supporting our clinical, booking, communication, payment, accounting and business systems;

• accountants, bookkeepers, legal advisers, professional indemnity insurers and other professional advisers;

• regulators, professional bodies, law-enforcement agencies or public authorities where required or permitted by law; and

• other parties where you have authorised us to share information.

We only share information that is appropriate and necessary for the relevant purpose.
 
11. Keeping your information secure
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
This includes appropriate controls around access to clinical and business systems and limiting access to information to people who require it for legitimate purposes.
No system can guarantee absolute security, but we take our responsibilities for protecting patient information seriously.
 
12. How long we keep information
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet our clinical, professional, legal, regulatory, insurance, taxation and accounting obligations.
Clinical records are retained in accordance with applicable professional, legal and insurance requirements.
Different categories of information may therefore be retained for different periods.
When information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
 
13. Your data protection rights
Depending on the circumstances, UK data protection law may give you rights including the right to:

• request access to personal information we hold about you;

• ask us to correct inaccurate or incomplete information;

• ask us to erase information in certain circumstances;

• ask us to restrict how information is used in certain circumstances;

• object to certain types of processing;

• request transfer of certain information where the right to data portability applies; and

• withdraw consent where processing is based on consent.

These rights are not absolute and may not apply in every circumstance. For example, we may need to retain clinical records despite a request for deletion where we have professional or legal reasons for doing so.
To exercise a data protection right, please contact us using the details in this Privacy Notice.
 
14. Service providers and professional advisers
We use carefully selected third-party services to help us operate the clinic.
Our current key providers include:

• Rehab Guru — clinical records, appointments, forms, rehabilitation programmes and patient communications associated with those services;

• Google Workspace — business email and associated business services;

• Wix — website, website forms and email marketing;

• SumUp — patient payment processing, payment requests, invoicing and refunds; and

• FreeAgent — accounting and financial administration.

These providers perform different functions and do not all receive the same categories of personal information.
Ascent does not use Rehab Guru to process routine patient treatment payments. Patient payments, payment requests, invoices and associated refunds are handled through SumUp as appropriate.
We may also provide necessary information to our accountants, bookkeepers, legal advisers, professional indemnity insurers and other professional advisers where required for accounting, taxation, legal, insurance, regulatory or legitimate business purposes.
Such advisers do not routinely receive access to your clinical record.
We may update or change service providers as our business develops. Where a material change affects how your personal information is used, we will update this Privacy Notice as appropriate.
 
15. Information processed outside the UK
Some of the service providers we use may store or process information outside the United Kingdom or use systems or subprocessors located in other countries.
Where personal information is transferred internationally, we will take appropriate steps to ensure that relevant safeguards required by UK data protection law are in place.
 
16. Website and cookies
Our website may use cookies and similar technologies for essential website functionality and, where applicable, analytics or other services.
Where required, you will be provided with information and choices regarding non-essential cookies through our website.
Our website may also contain links to third-party websites. We are not responsible for the privacy practices of external websites.
 
17. Marketing
Where we send direct marketing communications, we will do so in accordance with applicable data protection and electronic marketing requirements.
Where consent is required, we will obtain it.
You can ask us to stop sending marketing communications at any time.
Stopping marketing communications will not prevent us from sending necessary communications relating to your appointments, treatment, payments or care.
 
18. Children and young people
Where we provide services to children or young people, we may process information about them and, where appropriate, their parent, guardian or person with parental responsibility.
We will handle this information in accordance with applicable professional and legal requirements and take account of the young person’s age, understanding and capacity where relevant.
 
19. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, systems, legal obligations or how we process personal information.
The latest version will be published on our website with the date it was last updated.
 
20. Questions or concerns
If you have questions or concerns about how Ascent uses your personal information, please contact:
Ascent Physiotherapy & Wellness Limited
Email: info@ascentphysio.co.uk
ICO registration number: 00015098662
 
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).