1. Who we are
Physico Health Limited (company no. 13499224), "Physico", is the data controller for your personal data. Registered office: King’s House, 9 - 10 Haymarket, London SW1Y 4BP. For data protection queries, email info@physi.co with the subject "Data Protection".
2. The data we collect
Identity and contact: name, date of birth, gender, address, email, phone.
Financial: payment details (full card numbers not stored), insurance information.
Health (special category): medical history, presenting symptoms, examination findings, clinical notes (including consent discussions, assessment, diagnosis, treatment plan, progress and outcomes), test results and imaging where provided, and correspondence about your care.
Technical: IP address, browser and device information collected via our website.
Communications and preferences: records of interactions, marketing preferences, feedback.
We collect data directly from you, from your insurer (where you authorise it), from referring healthcare professionals, and through our website.
3. How we use your data, and on what legal basis
We use your data to provide healthcare, manage appointments and billing, process insurance claims, maintain clinical records, meet safeguarding and other legal obligations, market our own services to existing patients, and establish or defend legal claims. Our lawful bases are Article 6(1)(b) UK GDPR (contract) for healthcare delivery, appointments, billing and insurance; Article 6(1)(c) (legal obligation) for record-keeping and safeguarding; and Article 6(1)(f) (legitimate interests) for marketing (with the soft opt-in under PECR regulation 22(3)) and legal claims. For health data we additionally rely on Article 9(2)(h) UK GDPR and Schedule 1 paragraph 2 DPA 2018 (healthcare), 9(2)(b)/(g) for safeguarding, and 9(2)(f) for legal claims. You may object to legitimate-interests processing and unconditionally to direct marketing.
4. Who we share data with
• Healthcare professionals involved in your care (your GP, referees) — Article 9(2)(h), with you able to object
• Your insurer or third-party payer — only with your authorisation
• Our processors under Article 28 agreements: practice management software, payment processor, IT support, accountants
• Regulators, courts and safeguarding authorities where required by law
• Legal and professional advisers, where necessaryWe do not sell your data or share it for third parties' marketing.
5. International transfers
Data is stored on UK or EEA systems where possible. Where data is transferred outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Agreement. Copies of the safeguards are available on request.
6. How long we keep your data
Data Period
Adult clinical records 8 years from your last Session
Child clinical records Until age 25 (or 26 if you were 17 at last contact)
Financial records 6 years from end of relevant tax year
Marketing data 3 years from last engagement, or until you object
Website analytics 13 months
CCTV 30 days (longer for specific incidents)
7. Security
We use role-based access controls and audit logging, encryption in transit and at rest, staff training, written processor agreements, and an incident response plan. We notify the ICO of reportable breaches within 72 hours under Article 33 UK GDPR.
8. Your rights
Access (Art. 15); rectification (Art. 16); erasure subject to our duty to retain clinical records (Art. 17); restriction (Art. 18); portability (Art. 20); objection to legitimate-interests processing (Art. 21(1)) and unconditional objection to direct marketing (Art. 21(2)); withdrawal of consent (Art. 7(3)).To exercise any right, email info@physi.co. We will respond within one month. There is no fee unless a request is manifestly unfounded or excessive.
9. CCTV
We operate CCTV at our premises for security only. Footage is retained for 30 days unless required for a specific incident, accessible only to authorised personnel, and not used for any other purpose without your separate consent.
10. Recording of consultations for transcription
With your prior knowledge, your Healthcare Professional may record audio of your consultation to produce your clinical notes through a medical transcription service operating as our processor under a written Article 28 agreement. The recording and transcript are part of your clinical record under Article 9(2)(h) UK GDPR; audio is deleted once the transcript is verified, and the transcript is retained as set out in clause 6. You may ask not to be recorded for any particular consultation.
11. Cookies
Our website uses strictly necessary cookies for session management and security, set without consent under PECR regulation 6(4). Other cookies, including Google analytics, are set only with your consent via the cookie banner.
12. Children
We process data of patients under 18 in line with their capacity to consent (see our Terms). Where a patient lacks capacity, a person with parental responsibility may exercise data rights on their behalf.
13. Automated decision-making
We do not make decisions about you based solely on automated processing.
14. Complaints
Contact us first at info@physi.co. You may also complain to the Information Commissioner's Office at www.ico.org.uk.
15. Changes
We may update this Notice. The current version is always at www.physi.co/privacy. Material changes will be notified with reasonable noticeOur website uses strictly necessary cookies for session management and security, set without consent under PECR regulation 6(4). Other cookies, including Google analytics, are set only with your consent via the cookie bannerOur website uses strictly necessary cookies for session management and security, set without consent under PECR regulation 6(4). Other cookies, including Google analytics, are set only with your consent via the cookie banner.
Last updated: 29/05/2026. Version: 2
