Privacy Policy
Privacy Notice
Active Health Solutions Limited
Last updated: August 2026
1. Who we are
Active Health Solutions Limited (“Active Health”, “we”, “us” or “our”) provides physiotherapy, podiatry, rehabilitation, Pilates, exercise and related health and wellbeing services.
Active Health Solutions Limited is the Data Controller responsible for deciding how and why your personal information is used.
Active Health Solutions Limited
10–12 Hibernia Street
Holywood
Co. Down
BT18 9JE
Northern Ireland
Company number: NI058325
Data Protection Contact: Rachel Saligari
Email: rachel@activehealthsolutions.co.uk
Telephone: 028 9042 1188
This Privacy Notice applies to patients, clients, website users, people making enquiries, people referred to us by third parties, and individuals using our booking systems, apps and digital services.
A separate privacy notice may apply to employees, job applicants and contractors.
2. What personal information we collect
Identification and contact details
Name; address; date of birth; telephone number; email address; emergency contact details; and parent or guardian information where appropriate.
Health and clinical information
Where you receive healthcare or take part in services where health information is relevant, we may collect symptoms and reason for attending; medical history; medications; previous injuries or treatment; diagnoses; assessment findings; treatment plans; rehabilitation programmes; progress and clinical outcomes; GP, consultant and other healthcare correspondence; diagnostic reports and imaging information; relevant lifestyle, work, activity and exercise information; information relating to disability, pregnancy or other health circumstances where relevant; consent documentation; clinical photographs, video or other recordings where appropriate; and information required for insurance, occupational health or medico-legal treatment.
Health information is special-category personal data under UK GDPR and is subject to additional legal protection.
Booking, attendance and membership information
We may collect appointments and classes booked; attendance history; cancellations and missed appointments; membership details; class-pack details; waiting-list information; and recurring booking information.
Payment and financial information
We may process invoices; amounts charged and paid; refunds; payment status; health-insurer details; and third-party payer details. Payment-card information is generally processed securely by our payment providers rather than stored directly by Active Health.
Communications
We may keep relevant emails; text messages; telephone notes; online enquiries; complaints; feedback; and correspondence relating to your care or account.
Website and digital information
When you use our website, booking systems or apps, we may collect information such as IP address; browser and device information; website usage data; and cookies and similar technologies. Further details may be provided in our Cookie Notice.
3. Where we get your information from
Most information comes directly from you.
We may also receive information from your GP; consultants; hospitals; other healthcare professionals; diagnostic providers; health insurers; occupational health providers; medico-legal companies; case managers; solicitors; parents, guardians or carers; other practitioners involved in your care; and referring organisations where appropriate.
We may also receive personal information where Active Health acquires or assumes responsibility for another healthcare practice. Where this occurs, relevant patient records may transfer to Active Health so that records remain safely maintained and continuity of care can be preserved.
4. Why we use your information
Providing healthcare and treatment
We use information to assess your needs; provide physiotherapy, podiatry and other clinical services; create treatment and rehabilitation plans; monitor progress; maintain clinical records; provide safe and appropriate care; and communicate with healthcare professionals involved in your care where appropriate.
Providing Pilates, exercise and wellbeing services
We may use information to assess suitability for classes or exercise; identify relevant health considerations; manage memberships and bookings; maintain attendance records; adapt services where appropriate; and respond to incidents or health concerns.
Managing appointments and services
We may use information to book and change appointments; manage classes and waiting lists; send confirmations and reminders; manage cancellations; communicate service information; and administer payments and accounts.
Clinical governance and quality assurance
We may use information for clinical supervision; audits; service quality review; incident investigation; complaints; patient safety; and service improvement. Where possible, wider reporting and analysis will use anonymised or aggregated information.
Legal, regulatory and professional purposes
We may process information where necessary to maintain proper professional records; comply with legal or regulatory obligations; respond to data-protection requests; investigate complaints; establish, exercise or defend legal claims; comply with court orders; and meet safeguarding responsibilities.
5. Our lawful bases for processing
Contract – Article 6(1)(b)
We process information where necessary to provide a service you have requested or entered into with us. For example, we need relevant personal and appointment information to provide physiotherapy treatment or manage a Pilates membership.
Legitimate interests – Article 6(1)(f)
We may process information where this is necessary for our legitimate interests and those interests are not overridden by your rights and freedoms. These interests may include operating safe healthcare services; preserving and managing clinical records; maintaining continuity of care; clinical governance; quality assurance; managing and improving services; handling complaints; protecting legal rights; and securely taking responsibility for records when another healthcare practice transfers to Active Health.
Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether it could unfairly affect you.
Legal obligation – Article 6(1)(c)
We may process information where necessary to comply with a legal requirement.
Consent – Article 6(1)(a)
We may rely on consent where consent is the appropriate lawful basis. Where processing is based on consent, you may withdraw it at any time. Withdrawing consent does not affect processing that took place lawfully before withdrawal.
6. Special-category health information
Because we provide healthcare services, we routinely process health information.
In addition to an Article 6 lawful basis, we must have an Article 9 condition for processing special-category data.
Our principal condition for clinical care is Article 9(2)(h) – processing necessary for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.
Where information is required for actual or potential complaints, legal proceedings or claims, we may also rely on Article 9(2)(f) – processing necessary for the establishment, exercise or defence of legal claims.
Clinical consent to treatment is separate from GDPR consent. We do not rely on GDPR consent as the routine basis for maintaining necessary clinical records simply because you receive healthcare from us.
7. Sharing your information
We do not sell your personal information.
We only share information where there is a lawful and legitimate reason to do so.
Depending on your circumstances, we may share information with healthcare professionals involved in your care; your GP or consultant; hospitals and diagnostic providers; health insurers; case managers; occupational health providers; medico-legal agencies; solicitors or authorised representatives; safeguarding authorities; professional regulators; insurers and professional indemnity providers; courts; law-enforcement agencies; regulators or other public authorities where legally required.
Where another organisation has referred you to Active Health, we may provide appropriate attendance, treatment or progress information where this is lawful and relevant to the referral arrangement.
We only disclose information reasonably necessary for the relevant purpose.
8. Our service providers and processors
We use selected third-party providers to help us operate our services.
These may include providers of clinical practice-management systems; online booking systems; Pilates and class-management platforms such as TeamUp; Microsoft 365 and business communications; secure cloud storage; email and SMS services; payment processing; accounting systems; CRM and communications platforms; website hosting; IT support; cybersecurity services; and backup services.
Where these organisations process information on our behalf, they are required to protect it appropriately and use it only in accordance with our instructions and applicable law.
9. International transfers
Some technology providers may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to ensure the transfer complies with UK data-protection law. This may include transfers to countries covered by UK adequacy regulations; recognised contractual safeguards; UK data-transfer agreements; or other lawful transfer mechanisms.
You may contact us if you would like more information about safeguards relating to a particular transfer.
10. How long we keep information
We keep personal information only for as long as necessary for the purpose for which it was collected and to meet applicable legal, regulatory, professional and insurance requirements.
Clinical records
As a general guide, adult physiotherapy records are normally retained for at least 8 years following the last episode of treatment. Children’s records are normally retained until at least age 25, depending on the age at which treatment ended and any applicable professional or legal requirements.
Certain records may be retained for longer where necessary because of safeguarding; ongoing or anticipated claims; insurance requirements; regulatory requirements; or the patient’s clinical circumstances.
Financial records
Financial and accounting records are retained for the periods required by applicable tax and accounting law.
Enquiries
Information relating to enquiries that do not progress to treatment is normally retained only for a reasonable period unless another lawful reason applies.
Marketing
Marketing preference information is retained while relevant. Where you unsubscribe, we may retain limited information on a suppression list so that we know not to contact you again for that type of marketing.
When information is no longer required, it will be securely deleted or anonymised where appropriate.
11. Practice acquisitions and transfers of patient records
Active Health may acquire or assume responsibility for another healthcare practice.
Where patient records form part of such a transfer, we assess what information is being transferred; why it was originally collected; whether the transfer is necessary; the relevant Article 6 lawful basis; the relevant Article 9 condition; how the information will be transferred securely; who will have access; and how affected patients will be informed.
Where Active Health becomes Data Controller of transferred records, those records remain confidential. Historic records continue to show which clinician created them and when treatment was provided.
Receiving a patient’s clinical record does not automatically mean that Active Health will use the patient’s details for unrelated marketing. Marketing permissions are assessed separately.
12. Marketing communications
We may occasionally send information about Active Health services, events or offers.
Email and text marketing is managed in accordance with UK GDPR and the Privacy and Electronic Communications Regulations.
Where consent is required, we will obtain it. Where another lawful marketing route is available, we will ensure the relevant requirements are met.
You can unsubscribe from marketing at any time by clicking the unsubscribe link in a marketing email or contacting us.
Opting out of marketing will not stop important service communications relating to appointments, treatment, memberships, bookings or services you use.
We do not use sensitive health information to target unrelated marketing without an appropriate lawful basis.
13. Children and young people
We provide services to children and young people.
We take particular care when processing children’s information and will provide privacy information in an age-appropriate way where appropriate.
Depending on the child’s age, maturity, circumstances and the service provided, information may be obtained from or shared with a parent or guardian.
We will respect the confidentiality and data-protection rights of children and young people in accordance with applicable law and professional obligations.
14. Keeping information secure
We use appropriate technical and organisational measures to protect personal information against unauthorised access; accidental loss; misuse; alteration; inappropriate disclosure; and destruction.
Measures may include passwords; multi-factor authentication; role-based access; secure clinical-record systems; encryption; secure backups; cybersecurity controls; confidentiality requirements; staff training; and documented information-governance procedures.
Staff and contractors are only given access where required for their role.
15. Your data-protection rights
Depending on the circumstances and the lawful basis for processing, you may have the right to access your information; request rectification; request erasure in certain circumstances; request restriction; object to certain processing; request data portability; withdraw consent where consent is relied upon; and exercise rights relating to certain automated decisions.
You have an absolute right to object to direct marketing.
Active Health does not currently make clinical decisions about patients solely through automated decision-making.
To exercise your rights, contact rachel@activehealthsolutions.co.uk. We may need to verify your identity before releasing or changing personal information.
16. Access to clinical records
You may request access to your clinical records through a Subject Access Request.
Requests can be made verbally or in writing.
We will normally respond within the period required by data-protection law.
There are limited circumstances where information may need to be withheld or redacted, for example where disclosure would improperly reveal information about another person or where a legal exemption applies.
We retain the original clinical record and normally provide a copy.
17. Data-protection complaints
If you are concerned about how Active Health has collected, used, shared, stored or protected your personal information, please contact us first.
You can make a data-protection complaint by email to rachel@activehealthsolutions.co.uk or by post to Active Health Solutions Limited, 10–12 Hibernia Street, Holywood, Co. Down, BT18 9JE.
We will provide a clear route for making a complaint; acknowledge a data-protection complaint within 30 days; investigate the complaint appropriately; keep you informed where necessary; and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO). Information about making a complaint is available from the ICO.
18. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services; changes in technology or suppliers; new clinic locations; acquisitions; or changes in law or regulatory guidance.
The current version will be published on our website.
Where a change materially affects how we use existing personal information, we will take reasonable steps to bring it to the attention of affected individuals.
19. Contact us
Active Health Solutions Limited
10–12 Hibernia Street
Holywood
Co. Down
BT18 9JE
Data Protection Contact: Rachel Saligari
Email: rachel@activehealthsolutions.co.uk
Telephone: 028 9042 1188
Company number: NI058325