Privacy notice

1. Introduction

Your privacy is a top priority. We’re committed to always being a good custodian of your personal information, handling it in a responsible manner, and securing it with industry standard administrative, technical and physical safeguards.

We follow two guiding principles when it comes to your privacy:

• transparency – we work hard to be transparent about what personal information we collect and process
• simplicity – we try to use easy-to-understand language to describe our privacy practices to help you make informed choices

About us

MSK Practitioner Ltd is a company registered in England and Wales (company number 15972077 ), registered address: The Timbers Lower Icknield Way Marsworth HP234LN.

If you have any queries about this privacy notice or about any aspect of our data management, please contact our Data Protection Lead Ian@MSKpractitioner.com.

We’ll update this privacy notice regularly to ensure it continues to comply with the latest regulations and best practice. This privacy notice was last amended on 12/12/24

2. How we use your information

a) Storage and management of personal information

Our principal data management system Cliniko, which is maintained and developed in the UK. This system enables us to efficiently store any information about our members, patients in a way that ensures adequate security and only allows people who have the right level of authority to access personal information. It also simplifies our responsibilities for data retention and subject access requests.

Cliniko meets or exceeds all regulations of the Australian Privacy Principles, GDPR, PIPEDA, and HIPAA.

Cliniko data is backed up daily. Backups are redundantly stored in multiple physical locations. Data is also constantly streamed to replica databases for up to the second redundancy. We choose our partners carefully. Our hosting partner, Amazon Web Services (AWS), has achieved the following accreditations and certifications:

• PCI DSS Level 1 (Payment Card Industry Data Security Standard)
• ISO 27001 (Information Security Management System)
• FIPS 140-2 (United States Federal Information Processing Standard)

Whenever your data is sent between us, it’s encrypted using HTTPS (end-to-end encryption). We use a 2048-bit SSL certification for encryption in transit. All data is also encrypted at rest and backed up daily, using the industry-standard AES-256 encryption algorithm. For more information see https://www.cliniko.com/security/

b) Visitors to our website and social media platforms

When someone visits our website, MSK practitioner.com, we use our web host One.com and a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

We use Google Analytics so that we can continually improve our service to you – read the Google Analytics privacy notice.

We use WordPress as the content management system for our website.

Like most websites we use cookies to help the site work more efficiently.

If you fill in a form on our website, that data will be temporarily stored on the web host before being sent securely to Cliniko.

Where we provide links to websites of other organisations i.e. YouTube, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

Social media

MSK practitioner ltd has a limited presence on social media platforms. If you engage with us via these platforms we will not usually collect or store your personal data unless you send us a message directly.

Sharing your information

During your contact with us, we’ll tell you how your information will be used and that it may be necessary to share it with other services and organisations.

We will not share your information with any third parties unless:

• you have consented to this (for example by providing information to us after we’ve told you that we will supply the information to a third party)
• it is required for the management of your health.
• it is as part of our duty to protect a child, a vulnerable adult, yourself or the public
• for the prevention and detection of a crime or the assessment of any tax or duty
• we are required to do so by any court or law or any relevant regulatory authority
• to protect the rights, property or safety of MSK practitioner ltd or any third parties (for example for the purposes of fraud protection)
• we transfer our rights and duties to provide products and services to another organisation

Clinical Audit

A clinical audit is managed internally with data remaining on Cliniko systems. Audit data is stored securely. A record of the audit result will be kept securely, We’ll anonymise your personal information as is necessary for the audit process and any follow-up processes

d) Members of the public who make enquiries or complaints

We may record or process data from members of the public who ring us with general enquiries, please refer the section below about phone calls. We retain general queries via email from the general public for a maximum of one year.

If someone contacts us to make a complaint, the data will be processed in accordance with the section below titled “Professional conduct

e) Photography and filming

During an appointment, rarely; you or we may ask to take your photograph or film you for training and clinical notes purposes i.e. taking a picture of a swollen knee. Any images we hold, whether in still photographs or video, may be covered by the definition of personal data in the UK GDPR. We will need your consent in order to take and use these images fairly and lawfully. We will ask your permission to gain consent. Images are stored on Cliniko patient files

f) Products and services

You may use products or services provided by MSK practitioner ltd (some are paid for and some are free). This includes, but is not limited to,ultrasound device, exercise equipment, TENS machine. In order to provide you with these products and services it will be necessary to process a certain amount of personal data about you, i.e. who bought what.

g) Telephone systems

We do not record telephone calls, patient notes will be amended if content of a conversation is relevant and significant to the patients treatment goals.

Our telephone number is 079 79 079 479 and is hosted by O2 Telephonica.

Voice mail recordings will automatically be scored by the recording system.

h) Bulk emails

We use a third-party services to send feedback emails (those that relate directly to service provided) and emails about our products and services to our members and other customers.

3) Professional conduct

MSK practitioner ltd may process individuals’ personal data in order to carry out its protective function (helping to protect the public), to uphold the professional standards of

the Chartered Society of Physiotherapy

https://www.csp.org.uk/publications/code-members-professional-values-behaviour

or the Health and Care Professions Council

https://www.hcpc-uk.org/standards/standards-of-conduct-performance-and-ethics/

4. Complaints and queries

We try to meet the highest standards when collecting and using personal information, and we take any complaints about this very seriously. We encourage you to let us know if you think that our collection or use of information is unfair, misleading or inappropriate. We also welcome any suggestions for improving our procedures.

This privacy notice does not provide exhaustive details of all aspects of our collection and use of personal information. However, we’re happy to provide any additional information or explanation needed. Please send any requests for this to our Data Protection Lead

5. Your rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), you have rights as a data subject which you can exercise in relation to the information we hold about you. You can read more about these rights on the ICO’s website.

Records of treatment

If you have received therapy and require access to information about your treatment or the treatment someone else has received, you will need to contact the appropriate therapist directly.

Correcting mistakes

You can ask us to correct any mistakes in any factual information we hold about you, such as your address, date of birth, contact details etc.

Erasure

The UK GDPR also gives you the right to have the data we hold about you deleted in some circumstances. This is called the ‘right to erasure’ or the ‘right to be forgotten’. The right applies in the following circumstances:

• we no longer need your data
• you originally provided consent and have now withdrawn consent
• you have objected to the use of your data and your interests outweigh ours
• we have collected your data unlawfully
• we have a legal obligation to erase your data

Making a request

If you would like to exercise your above rights, please contact our Data Protection Lead at with details of your request

6. Disclosure of personal information

In many circumstances we will not disclose personal data without consent, but there are circumstances where we might do so. The list below provides some scenarios in which we may disclose personal data. Please be aware that this is not a complete list but serves as an example.

• When we investigate a complaint.
• We may share data with other regulatory bodies or associations.
• We will share personal data with external legal professionals if we need legal advice.
• We may share personal data with law enforcement agencies or government departments where appropriate.

We will only share information that we consider to be necessary and proportionate

7. Data security

We recognise that the information you provide may be sensitive and we will respect your privacy. This means we store it securely and control who has access to it. We sometimes share personal data with third parties where we have contracted them to carry out specific tasks for us. In such cases we carefully select which partners we work with. We take great care to ensure that we have a contract with the third party that states what they are allowed to do with the data we share with them.

We will only share personal data with other organisations where we are satisfied that the other organisation is entitled to receive it. Where relevant, we carry out due diligence checks on other organisations and ensure we have appropriate data protection agreements in place.

We’re committed to holding all personal data on secure systems. We keep any paper-based personal data in locked cabinets to which only appropriate staff have access. We’re working to reduce the amount of paper-based information we hold as it is easier to secure data if it is only held electronically. The majority of personal data is held electronically on our CRM system that is hosted by Microsoft.   

We have invested extensively in ensuring our information systems are secure and that our staff are suitably trained.