Privacy Policy

1. Introduction

GoMove Physio respects your privacy and is committed to protecting your personal data. This privacy policy outlines how we handle your personal information, your rights and how the law protects you.

GoMove Physio may update this policy from time to time. You should review this page periodically to ensure you are happy with any changes. This policy is effective from 16 Oct 2026.

2. Important Information & Who We Are

Purpose of This Privacy Notice

This Privacy Notice explains how GoMove Physio collects, processes, and protects your personal data, including information provided via our website or during the initial booking process.

This website is not intended for children, and we do not knowingly collect personal data relating to children via our website without appropriate parental or legal guardian consent.

GoMove Physio Booking & General Administration

David Cabiong (trading as GoMove Physio) acts as the Data Controller for all general administrative and booking information collected across the business (such as name, contact details, and appointment scheduling).

• ICO Registration Number: ZB451509

Patients Seen by David Cabiong & Employed Staff (Full-Time or Part-Time): For patients treated directly by David Cabiong or any employed staff (whether full-time or part-time) working for GoMove Physio, David Cabiong acts as the Data Controller responsible for the collection, processing, secure storage, and statutory retention of all clinical records, medical notes, and health data.

Self-Employed Associate Practitioners

Clinicians operating as self-employed associates with GoMove Physio act as independent Data Controllers for the clinical care they deliver:

• Clinical Records & Medical Data: Each self-employed associate clinician is solely and independently responsible for the collection, storage, processing, security, and retention of all clinical notes and health data for their respective patients.
• ICO Registration: Each associate practitioner maintains their own individual registration with the UK Information Commissioner’s Office (ICO).
• Data Transfer: GoMove Physio collects only the necessary contact, payment and booking details during the appointment process and transfers these details securely to the assigned associate clinician to enable care delivery.

Contact Us

If you have any questions about this Privacy Notice or your data protection rights:

• Owner / Lead Physiotherapist: David Cabiong (GoMove Physio)
• Email: info.torbay@gomovephysio.com
• Phone: +44 7380 863650

Note: If you are seen by a self-employed associate clinician, requests or inquiries regarding your detailed clinical notes should be directed to your specific treating clinician.

Third Party Links

Our website may contain links to third-party websites, plug-ins, or applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When leaving our website, we encourage you to read the privacy notice of every website you visit.

3. The Data We Collect About You

We collect personal data that identifies you, including:

• Identity Data: Name, title, date of birth, address, GP details.
• Contact Data: Billing address, email, phone number.
• Financial Data: Bank account and payment card details.
• Transaction Data: Payment details and service history.
• Usage Data: Information on how you use our website and services.
• Special Categories of Data: Health information relevant to physiotherapy treatment.

We do not collect criminal records or other sensitive personal data unless required by law.

If you fail to provide required personal data, we may be unable to offer our services and we will notify you if this occurs.

4. How Is Your Personal Data Collected?

We collect data through:

• Direct interactions: Filling out forms, booking appointments, email, phone or during treatment.
• Automated interactions: Cookies, website analytics and server logs.

5. How We Use Your Personal Data

We will only use your data when legally permitted. The main reasons include:

• To perform a contract (e.g. physiotherapy treatment).
• To comply with legal obligations (e.g. maintaining medical records).

Marketing & Communications

We do not share your data with third parties for marketing purposes. However, we may send:

• Essential service updates.
• Promotional offers if you have subscribed. You can opt out anytime by emailing info.torbay@gomovephysio.com with "STOP."

Cookies

You can adjust your browser settings to refuse cookies, but this may affect website functionality.

Change of Purpose

We will only use your data for the purpose collected unless a related and lawful reason arises.

6. Disclosures of Your Personal Data

We may share your personal data with:

• Your GP, consultant or other healthcare professionals.
• Any third party you request, such as a sports coach or family member.

7. International Data Transfers

We do not transfer your personal data outside the European Economic Area (EEA).

8. Data Security

We implement appropriate security measures to prevent unauthorised access, use or disclosure of your data. These include:

• Secure storage systems for medical and financial data.
• Restricted access to patient records only to authorised personnel.
• Encryption of sensitive data where applicable.
• Regular security reviews to ensure compliance.

In the event of a data breach, we will notify affected individuals and relevant authorities in accordance with legal requirements.

9. Data Retention

We retain personal data as follows:

• Adults (18+): Records kept for 8 years after last treatment.
• Children (under 18): Records kept until their 25th birthday (or 26th if aged 17 at the last treatment).

You may request data deletion beyond legal retention periods if applicable.

10. Consent for Different Age Groups

Adults (18+): Individuals aged 18 and above are considered adults with full legal capacity. They can provide consent for their physiotherapy treatment, and we process their health data under the lawful bases mentioned above. They have full rights to access, rectify, or request the erasure of their data, though legal requirements for health record retention will always take precedence over the right to erasure.

Young People (16-17): Individuals aged 16 and 17 are legally presumed to have the capacity to consent to their own medical treatment and the associated data processing. They hold the same data rights as adults. We must respect their confidentiality entirely and will only involve parents or guardians where appropriate, or with the young person's explicit consent.

Children (Under 16): For children under the age of 16, the rules vary depending on the context of data processing:

1. Clinical Data (Assessments and Medical Records):

• Consent for Treatment & Records: We rely on the child's "Gillick competence" (or Fraser competence) to determine their capacity to consent.

• Competent Children: If a physiotherapist assesses a child as having sufficient understanding to fully appreciate the proposed treatment and data implications, that child can provide their own valid consent. 

• Non-Competent Children: If the child is not deemed Gillick competent, then a person with parental responsibility must provide consent for the treatment and the associated data collection.

2. Online Services Data (e.g., website registration, online booking systems):

• For online services where we rely on user consent (e.g., signing up for a newsletter or using a specific patient portal), the UK GDPR sets the digital age of consent at 13 years old.
  • Children Aged 13-15: Can provide their own consent to use our online services.
  • Children Under 13: A parent or guardian’s verifiable consent is required before they can use these specific online services.

11. Your Legal Rights

You have the right to:

• Request access to your data.
• Request correction of inaccurate data.
• Request erasure of personal data (within legal limits).
• Object to processing where data is used for legitimate interests.
• Request restriction of processing under certain circumstances.
• Request data transfer to another provider.
• Withdraw consent at any time where processing relies on consent.

Accessing your data is free, but we may charge for excessive, repetitive or comprehensive requests.

We may request additional information to verify your identity before processing any data requests.

We aim to respond within one month. If requests are complex, we will notify you of any delays.

12. Complaints & Concerns

If you have any concerns about how we handle your personal data, please contact us using the details provided. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

13. Glossary

• Legitimate Interest: Necessary for running our business while ensuring minimal impact on your rights.
• Performance of Contract: Processing required to fulfil a contract.
• Legal Obligation: Processing necessary for legal compliance.

If you have concerns or wish to exercise your rights, please contact us at info.torbay@gomovephysio.com. GoMove Physio respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website and tell you about your privacy rights and how the law protects you. 

GoMove Physio may change its privacy policy from time to time by updating this page. You should check this page to ensure that you are happy with any changes.