Privacy notice

1. Who we are

FitMove is a Home Links Physiotherapy brand. JLinks Physiotherapy Limited, trading as Home Links Physiotherapy (company number 11843830) is the data controller for information collected through FitMove, including our medical questionnaire. Our ICO registration number is ZA534821.

Contact us about your information at [email protected] or on 020 3834 8471.

2. What we collect

• Your name, date of birth, phone number and email address
• Your GP surgery and emergency contact
• Your class and venue
• Your answers to our medical questionnaire, including health conditions, medications, mobility and falls
• Your consent choices and typed signature

3. Why we use it, and our legal basis

4. How your information is processed

1. You complete the medical questionnaire on our website.
2. It is sent over an encrypted connection (HTTPS) to a secure connector, which passes it on within seconds. The connector does not store your answers or keep a log of them.
3. Your answers are saved as a document on your record in Cliniko, our clinical records system. Only authorised clinical and admin staff can see them.
4. Your first and last name, email, phone number, class, venue, the date you completed the form, your email preference, whether you are happy to be in photos or videos and, for Thrive, whether you agree to sharing with Walfinch are saved in our customer system (HighLevel). We also record a simple review level (high, moderate or low), so our team knows whether the physiotherapist needs to speak with you before you start. We use these to manage classes, arrange that review, remind you when your yearly update is due, and send newsletters if you have agreed. Your questionnaire answers are never kept there.
5. Our admin team receives an email so they can add you to the class register. It contains no health information.

If you complete a paper form, it is kept securely and added to your record in Cliniko.

5. Who processes it for us

We use trusted suppliers who process information only on our instructions, under data processing agreements.

Why we are confident in Cloudflare

• Cloudflare acts only as our processor, under a data processing agreement that specifically covers special category information such as health data.
• It is certified under the EU-US Data Privacy Framework and its UK extension (the UK-US data bridge), which the UK government recognises as giving adequate protection for personal information.
• Its agreement also includes the UK International Data Transfer Addendum, as a back-up safeguard.
• Your form only passes through it in encrypted form, for a few seconds, and is never stored or logged.

Where any supplier holds information outside the UK, we rely on approved safeguards, such as the UK-US data bridge, the UK International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses.

6. How we keep it safe

• Encryption - information is encrypted when it is sent, and stored encrypted by our suppliers.
• Separation - your questionnaire answers are stored only in our clinical records system, never in email or marketing systems. Our customer system holds only a review level (high, moderate or low), with access limited to staff who need it.
• Restricted access - only staff who need it can see health information, and accounts are protected with two-factor sign-in.
• No unnecessary copies - the connector keeps no copy of your answers, and logging is switched off.
• Protected forms - our forms only accept submissions from our own website, and use Cloudflare Turnstile to block automated misuse.
• Secure keys - system passwords and keys are kept in encrypted storage and changed regularly.
• Professional confidentiality - our physiotherapists are HCPC-registered and bound by a duty of confidentiality.
• Incidents - if a data breach happens, we will act quickly and report it to the ICO within 72 hours where the law requires it.

7. The laws we follow

We handle your information, and especially your health information, in line with:

• UK GDPR and the Data Protection Act 2018 - the main UK data protection laws. Health information is special category data. We process it to provide healthcare (UK GDPR Article 9(2)(h), and Data Protection Act 2018 Schedule 1, Part 1, paragraph 2), under the responsibility of health professionals who owe you a duty of confidentiality.
• The common law duty of confidentiality - information you share with our clinicians is kept confidential, and only shared when needed for your care or safety, or where the law requires it.
• HCPC Standards of conduct, performance and ethics - our physiotherapists must protect your confidentiality and keep accurate, secure records.
• The Chartered Society of Physiotherapy's professional standards - which include standards for record keeping and information governance.
• The Privacy and Electronic Communications Regulations 2003 (PECR) - we only send marketing emails if you have agreed, and every email lets you unsubscribe.

We are registered with the Information Commissioner's Office (ICO), registration number ZA534821.

8. Who we share it with

• The physiotherapist leading your class
• A partner organisation that helps run your class, and only what is needed for safe participation (for example Walfinch for Thrive Club)
• Your GP or the emergency services, if needed to keep you safe

We never sell your information.

9. How long we keep it

• Medical questionnaires and clinical records: 8 years after you are discharged from the service
• Contact details: while you attend classes, and no longer than 8 years after you are discharged from the service
• Marketing preferences: until you unsubscribe

10. Your rights

You can ask us to:

• See the information we hold about you
• Correct anything that is wrong
• Delete your information, where we are not required to keep it
• Limit or object to how we use it
• Stop sending you marketing, or stop using your photos

Contact [email protected] or call 020 3834 8471. We will respond within one month.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

11. More information

This notice covers FitMove. Our main Home Links Physiotherapy privacy policy covers our other services. Our FitMove terms and conditions explain how classes work.