Privacy Policy

Last updated: 11 November 2026

1. Who we are

This website is run by Back 2 Front Physiotherapy Ltd ("Back2Front", "we", "us"), a company registered in England and Wales (company number 09731209). Our registered office is at 15 Cwmbach Road, Aberdare, CF44 0NF, and our clinic is at 15 Cwmbach Road, Aberdare, CF44 0NG.

We are the data controller for the personal information described in this policy, and we are registered with the Information Commissioner's Office (registration reference ZA201530). If you have any questions about it, or want to use any of your rights, contact us:

• Email: info@back2frontphysio.com
• Phone: 01685 878737
• Post: Data Protection, Back2Front, 15 Cwmbach Road, Aberdare, CF44 0NG

2. The information we collect

Information you give us

• Contact details: your name, email address, phone number and postal address when you make an enquiry, book, buy a voucher or join a membership.
• Health information: your medical history, symptoms, assessment findings, treatment notes, exercise programmes, outcome measures and, where you choose to have one, InBody body composition results. This is "special category" data and we protect it with extra care (see section 4).
• Booking and attendance information: appointments and classes you book, attend, cancel or miss.
• Payment information: what you bought and when. Card payments are processed by our payment providers; we never see or store your full card number.
• Gift voucher information: the buyer's details and, if you add them, the recipient's name and a personal message.
• Communications: messages, emails, calls, form submissions and feedback you send us.
• Marketing preferences: whether you have asked to receive our emails.

Information collected automatically

When you visit our website we, and the companies that host it, collect technical information such as your IP address, browser and device type, the pages you visit and how you arrived. See section 9 for how we use cookies.

Information from other people

We may receive information about you from a GP, consultant, insurer or employer who refers you to us, or from a parent or guardian booking on behalf of a child. We only use it to provide the care you have been referred for.

3. How we use your information and our legal basis

What we use it for	Legal basis
Assessing, treating and coaching you, and keeping clinical records	Contract with you, and for health data the provision of health care (UK GDPR Article 9(2)(h))
Managing bookings, reminders, cancellations, memberships and payments	Contract with you
Selling and delivering gift vouchers and processing orders	Contract with you
Answering enquiries and Discovery Visit requests	Legitimate interests (responding to people who contact us) or steps taken before entering a contract
Running the Rewards Club and member app	Contract with you
Sending you health tips, news and offers by email	Your consent, which you can withdraw at any time using the unsubscribe link
Following up after your care has finished to check on your progress	Legitimate interests (continuity of care); you can ask us to stop at any time
Improving our services, website and patient experience	Legitimate interests
Keeping accounts and meeting professional and legal obligations	Legal obligation
Protecting your vital interests in an emergency	Vital interests

4. Your health information

Your clinical records are confidential. They are kept in our secure clinical system and are only accessed by the clinicians and staff involved in your care. We follow the record-keeping standards of the Health and Care Professions Council (HCPC) and the Chartered Society of Physiotherapy (CSP).

We will not share your health information with anyone outside Back2Front, including your GP, insurer or employer, without your consent, unless the law requires it or there is a serious risk of harm to you or someone else.

We never use your health information for marketing.

5. Who we share your information with

We do not sell your personal information. We use trusted service providers to run the clinic, who process your information only on our instructions and under contracts that require them to keep it secure:

• Cliniko: clinical records, appointment booking and reminders.
• TeamUp: class bookings, memberships and attendance.
• Wix: website hosting, online shop, gift voucher orders and website forms.
• Payment providers (Wix Payments, Stripe and GoCardless): card payments and Direct Debits.
• GoodBarber: the Back2Front member app and Rewards Club.
• Mailchimp: email newsletters, for people who have opted in.
• Microsoft 365: email.
• Google: documents, maps and website search tools.
• Our accountants and IT support: where needed to run the business.

We may also share information with your insurer if they are paying for your treatment and you have agreed, with professional regulators if required, or with the police or other authorities where the law requires us to.

6. International transfers

Some of our providers store data outside the UK, for example in the European Union, the United States or Australia. Where this happens we make sure the transfer is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard.

7. How long we keep your information

• Clinical records (adults): 8 years after your last treatment.
• Clinical records (children): until the patient's 25th birthday, or 26th if they were 17 when treatment ended, or 8 years after the last treatment if that is longer.
• Financial records: 6 years after the end of the financial year they relate to.
• Enquiries that do not lead to a booking: up to 2 years.
• Email marketing lists: until you unsubscribe, after which we keep only enough to make sure we don't email you again.

After these periods your information is securely deleted or anonymised.

8. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information, where we have no legal reason to keep it
• ask us to limit how we use your information
• object to us using your information for legitimate interests or marketing
• ask for information you gave us to be transferred to you or another organisation
• withdraw your consent at any time, where we rely on it

To use any of these rights, contact us using the details in section 1. We will respond within one month and there is normally no charge.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Cookies

Our website uses a small number of cookies and similar technologies. Some are essential to make the site, basket and checkout work. Others, such as analytics cookies, help us understand how the site is used; these are only set if you agree to them through the cookie banner. You can change your choice at any time by clearing your cookies or adjusting your browser settings.

Pages on our site also load fonts from Google Fonts and images from Wix's content network, which means your IP address is shared with those providers so the content can be delivered.

10. Keeping your information secure

We use access controls, strong passwords, two-factor authentication where available, staff confidentiality agreements and regular training to protect your information. Paper records, where we have any, are kept locked away. No system is completely secure, but if a breach ever affects your information we will tell you and the ICO where required.

11. Children

We treat children only with the involvement of a parent or guardian, who will usually provide their information. Young people who are able to understand their own care can make requests about their own information.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.