Privacy Policy

JU Physiotherapy

Milton Keynes

Privacy Notice

Updated: 15 September 2026

Review: Annually

About This Notice

This Privacy Notice explains who we are, what personal information we collect about you,
how we use it, how long we keep it, and what rights you have.

JU Physiotherapy is a sole trader physiotherapy practice based in Milton Keynes,
providing in-clinic and mobile physiotherapy services to adults, children (ages 8–16),
and vulnerable adults including care home residents.

We are committed to protecting your privacy and handling your personal data
in an open and transparent way, in line with the UK General Data Protection Regulation
(UK GDPR) and the Data Protection Act 2018.

01: Who We Are

Data Controller	James PG Underwood, trading as JU Physiotherapy
Address	Milton Keynes
Phone	+44 7971 818756
Email	contactus@juphysiotherapy.co.uk
Website	www.juphysiotherapy.co.uk
ICO Registration	ZC170466

As a data controller, we are responsible for deciding how and why we hold and use your personal
information. We are registered with the Information Commissioner’s Office (ICO) as required by
the Data Protection (Charges and Information) Regulations 2018.

2. What Personal Information We Collect

2.1 Contact and Identity Information

When you contact us or book an appointment, we collect:

First name and last name
Mobile telephone number
Email address
Home address (for mobile visit patients)

2.2 Health and Clinical Information

As a healthcare provider, we collect and process special category health data, including:

Medical history, current symptoms, and presenting condition
GP details and relevant medical correspondence
Medications, allergies, and contraindications
Clinical assessment findings and diagnosis
Treatment records and clinical notes
Outcome measures and progress notes
Referral letters from other healthcare professionals
Audio transcriptions of clinical consultations (where consent has been given — see Section 6)

Health information is classified as special category data under UK GDPR and is given a higher level of protection. We only process it for the purpose of providing your physiotherapy care.

2.3 Additional Information for Children (Ages 8–16)

Where we treat patients aged 8–16, we also collect:

Name and contact details of the parent or legal guardian
Written consent from the parent or legal guardian
School or GP details if relevant to treatment

2.4 Additional Information for Vulnerable Adults and Care Home Residents

Where we treat vulnerable adults, we may also collect:

Name and contact details of their care home or residential facility
Name and contact details of their key worker or care coordinator
Details of any Lasting Power of Attorney (Health and Welfare) holder
Mental capacity assessment records where applicable
Relevant information from their care plan, provided by the care home

2.5 Website Enquiries

If you contact us through the website contact form at www.juphysiotherapy.co.uk, we collect your name, email address, telephone number, and the content of your message.

3. How We Collect Your Information

We collect your information in the following ways:

Directly from you when you contact us by phone, email, text message, or through our website contact form
From you at your first appointment when completing a new patient assessment form
From your GP or other healthcare professional if they refer you to us (with your knowledge)
From a parent or legal guardian where the patient is a child
From care home staff where relevant to your treatment, with appropriate authority
Via audio transcription during your consultation, where you have given explicit consent (see Section 6)

4. Why We Use Your Information and Our Lawful Basis

UK GDPR requires us to have a lawful basis for processing your personal data. We use different bases depending on the type of information and the purpose.

Purpose	Type of Data	Lawful Basis
Booking and scheduling appointments	Contact details	Contractual obligation (Article 6(1)(b))
Providing physiotherapy assessment and treatment	Health data, contact details	Healthcare provision (Article 9(2)(h)); Contractual obligation (Article 6(1)(b))
Maintaining clinical records	Health data, clinical notes	Legal obligation (Article 6(1)(c)); Healthcare provision (Article 9(2)(h))
Audio transcription of consultations via Rehab Guru	Health data, voice recording	Explicit consent (Article 6(1)(a); Article 9(2)(a))
Communicating with your GP or referring clinician	Health data	Healthcare provision (Article 9(2)(h))
Processing payments and invoices	Contact details, financial info	Contractual obligation (Article 6(1)(b))
Responding to website or phone enquiries	Contact details	Legitimate interests (Article 6(1)(f))
Safeguarding children and vulnerable adults	Health data, identity data	Vital interests / Legal obligation (Articles 6(1)(c), 9(2)(c))
Complying with HCPC regulatory requirements	Health data, clinical notes	Legal obligation (Article 6(1)(c))

5. How We Store Your Information

5.1 Where Your Data is Stored

Your personal and clinical information is stored securely using the following:

Password-protected personal computer and/or mobile device
Rehab Guru — a secure, UK-based clinical management platform used for treatment notes, exercise programmes, and consultation transcriptions (see Section 6)
Locked physical storage for any paper records

We do not store your information on systems based outside the UK or European Economic Area (EEA) unless adequate protections are in place.

5.2 How Long We Keep Your Information

Type of Record	Retention Period	Reason
Adult clinical records (incl. transcriptions)	8 years from last treatment	NHS Code / Limitation Act
Children’s records	Until patient’s 26th birthday	NHS Records Management Code
Website enquiry / contact data only (no treatment)	12 months	Legitimate interests
Accident / incident records	10 years minimum	NHS Code
Financial / invoice records	6 years	HMRC requirements

When your data is no longer required, it will be securely deleted from electronic devices and any paper records will be confidentially shredded.

6. Rehab Guru — Transcription and Clinical Notes

What is Rehab Guru?

Rehab Guru is a UK-based clinical management platform used by JU Physiotherapy to manage treatment notes, exercise programmes, and — with your explicit consent — audio transcriptions of consultations.

Rehab Guru holds ISO 27001 and Cyber Essentials Plus certifications and operates GDPR and HIPAA-ready infrastructure. Patient data is encrypted in transit and at rest using AES-256 encryption.

Rehab Guru is trusted by the NHS and UK Ministry of Defence.

6.1 Transcription of Consultations

With your explicit consent, we may use Rehab Guru’s AI-assisted transcription feature during your consultation. This means:

Audio from your appointment is transcribed to help create accurate clinical notes
The transcription is reviewed and edited by the practitioner before being saved to your records
No clinical decisions are made automatically — all AI outputs are reviewed by the practitioner before use
The transcription becomes part of your clinical record and is subject to the same retention and security standards as all other notes

6.2 Your Consent for Transcription

We will always ask for your explicit consent before using the transcription feature. You have the right to:

Decline transcription at any time, without it affecting the care you receive
Withdraw your consent for future sessions at any time by notifying the practitioner
Request a copy of any transcription held as part of your clinical record
Request deletion of transcription data, subject to our legal obligation to retain clinical records

Where transcription is used with a child patient, consent will be obtained from the parent or legal guardian as well as the child’s own assent where appropriate. Where a vulnerable adult lacks capacity to consent to transcription, this will not be used unless a best interests decision supports it and is documented.

6.3 Rehab Guru as Data Processor

Under UK GDPR, JU Physiotherapy remains the Data Controller for all patient data processed through Rehab Guru. Rehab Guru acts as a Data Processor on our behalf, meaning they process your data only under our instruction and in accordance with a Data Processing Agreement.

Rehab Guru does not use your data for their own purposes, does not communicate directly with patients for marketing, and does not share your data with third parties except as required to deliver their service.

For further information about how Rehab Guru handles data, including their Data Processing Officer contact details, visit: www.rehabguru.com/gdpr

7. Who We Share Your Information With

We do not sell or share your personal information with third parties for marketing purposes. We may share your information only in the following limited circumstances:

Rehab Guru (Data Processor) — for secure storage of clinical notes, exercise programmes, and transcriptions under a Data Processing Agreement
Your GP or another healthcare professional involved in your care, where clinically appropriate and with your knowledge
A specialist or consultant if we refer you for further assessment or treatment
Our professional indemnity insurer if a claim is made relating to your treatment
The Health and Care Professions Council (HCPC) if required as part of a fitness to practise investigation
The Information Commissioner’s Office (ICO) if required by law
Milton Keynes Children’s Social Care or Adult Social Care if we have a legal duty to share information for safeguarding purposes — in these circumstances we may share without your consent if required to protect your safety or the safety of others

In all other cases, we will ask for your consent before sharing your information.

8. Cookies and Website

Our website (www.juphysiotherapy.co.uk) may use cookies to improve your experience. We use cookies for:

Essential website functionality
Understanding how visitors use our website (analytics)

You can control cookie settings through your browser. Our website contact form collects the personal data you submit; this data is used only to respond to your enquiry.

9. Your Data Protection Rights

Under UK GDPR you have the following rights. You can exercise any of these by contacting us using the details in Section 1. We will respond within one calendar month. There is no charge.

Your Right	What This Means
Right of Access	You can ask for a copy of all the personal information we hold about you, including any transcription data held in Rehab Guru.
Right to Rectification	You can ask us to correct information that is inaccurate or incomplete, including transcription errors in your clinical notes.
Right to Erasure	You can ask us to delete your personal information in certain circumstances. Note: we may be unable to erase clinical records we are legally required to retain.
Right to Restrict Processing	You can ask us to limit how we use your information in certain circumstances.
Right to Object	You can object to us processing your personal data in certain circumstances, including where we rely on legitimate interests.
Right to Data Portability	You can ask us to transfer your personal information to you or to another organisation in a commonly used format.
Right to Withdraw Consent	You may withdraw consent for transcription at any time. This will not affect your care or the lawfulness of any processing already carried out.

10. Children's Data

Where we treat patients aged 8–16, the parent or legal guardian is the primary point of contact for data protection purposes. Parents and guardians have the right to access their child’s records and exercise data protection rights on their behalf, subject to the child’s best interests.

Where a child is assessed as Gillick competent (under 16 but sufficiently mature to make their own decisions), we will consider the child’s own wishes when responding to data requests. Young people aged 16 and over may exercise their own data protection rights.

11. Automated Decision-Making

We do not use automated decision-making in your care. Rehab Guru’s transcription and AI features are used as clinical support tools only. All outputs — including transcriptions and any AI-generated note drafts — are reviewed and approved by the practitioner before being used. No decision about your care is made automatically without meaningful human involvement.

12. How to Complain

If you have any concerns about how we use your personal information, please contact us first:

Email: contactus@juphysiotherapy.co.uk
Phone: +44 7971 818756

If you remain unsatisfied, you have the right to complain to the ICO:

Information Commissioner’s Office (ICO)

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: www.ico.org.uk

13. Changes to This Privacy Notice

We review this Privacy Notice at least once a year and following any significant changes to how we process personal data. The current version will always be published on our website. If we make significant changes that affect your rights, we will notify you directly where we hold your contact details.

Last updated: 9^th June 2026 | Version 2.0

JU Physiotherapy, Milton Keynes | contactus@juphysiotherapy.co.uk | www.juphysiotherapy.co.uk