Privacy policy
Last updated: 11 November 2026
This policy explains how Summit Physiotherapy Ltd (“Summit Physio”, “we”, “us”) collects, uses and protects your personal information when you use our website, contact us, book an appointment or receive treatment at our clinics.
Who we are
Summit Physiotherapy Ltd is the data controller for the personal information described in this policy. We are a company registered in England and Wales (company number 05651980). Our registered office is Black Bull House, 353–355 Station Road, Bamber Bridge, Preston, PR5 6EE.
We run physiotherapy clinics at David Lloyd Health Club, Moss Lane, Whittle-le-Woods, Chorley, PR6 8AB and Wrightington Hotel & Country Club, Moss Lane, Wigan, WN6 9PB.
If you have any questions about this policy or your information, email getmebetter@summitphysio.co.uk or call 0800 731 2738.
The information we collect
- Enquiries: when you use our contact form, email or phone us, we collect your name, email address, phone number, your preferred clinic and anything you tell us about why you’re getting in touch.
- Bookings: when you book online or by phone, we collect your name, contact details, date of birth, appointment details and payment information. Online bookings are handled through our practice management system, Nookal.
- Clinical records: when you’re treated by us, we keep notes about your health, medical history, symptoms, assessment, treatment and progress. This is special category data under data protection law, and we treat it with extra care.
- Third-party information: we may receive information about you from your GP, consultant, insurer, employer or case manager when they refer you to us.
- Website use: our website uses cookies. See our cookie policy for details.
How we use your information and our lawful basis
- To reply to enquiries and arrange appointments: to take steps at your request before entering into a contract, and our legitimate interest in running our clinics.
- To provide assessment and treatment: to perform our contract with you. For health information, we rely on the condition for the provision of health care and treatment (UK GDPR Article 9(2)(h)).
- To take payment, keep accounts and meet professional and legal duties: our legal obligations, including those set by the Health and Care Professions Council (HCPC).
- To communicate with your GP, consultant or insurer about your care: health care provision, and with your agreement where needed.
- To send appointment reminders: our legitimate interest in running appointments smoothly.
- To send news or offers: only with your consent, which you can withdraw at any time.
Who we share your information with
We never sell your information. We only share it when we need to, with:
- our practice management and online booking provider (Nookal)
- our website hosting, email and IT providers
- payment processors, to take payment
- your GP, consultant or other health professionals involved in your care
- your insurer, employer or case manager if they are funding your treatment
- regulators, courts or law enforcement where we are legally required to
Our suppliers act on our instructions and must keep your information secure.
Transfers outside the UK
Some of our suppliers may store data outside the UK. When they do, we make sure suitable safeguards are in place, such as a UK adequacy decision or the UK International Data Transfer Agreement.
How long we keep your information
- Clinical records for adults: 8 years after your last treatment.
- Clinical records for children: until their 25th birthday, or their 26th if they were 17 when treatment ended, or 8 years after their last treatment if that is later.
- Enquiries that don’t lead to treatment: up to 12 months.
- Financial records: 6 years, as required by law.
These periods follow guidance from the Chartered Society of Physiotherapy. After they end, we delete or destroy your information securely.
Keeping your information secure
We use appropriate technical and organisational measures to protect your information. These include access controls, secure systems and confidentiality obligations for everyone who works with us.
Your rights
You have the right to:
- access a copy of the information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information, where we don’t need to keep it
- ask us to restrict or object to how we use it
- ask for your information to be transferred to another provider
- withdraw consent at any time, where we rely on consent
To use any of these rights, contact us using the details above. We’ll respond within one month.
Complaints
If you’re unhappy with how we’ve handled your information, please talk to us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page.
