Privacy policy


Last updated: October 2026

  1. Who I am

Rehab PT Ltd ("I", "me", "my") provides one-to-one sports rehabilitation, exercise and lifestyle coaching from a treatment room in Soho, London, and related online programmes. I am the "data controller" for your personal information, which means I decide how and why it is used.

• Company: Rehab PT Ltd, registered in England and Wales, No. 7541286
• Contact for anything in this policy, including data requests: info@rehabpt.co.uk
• Information Commissioner's Office (ICO) registration: ZC273393 

I am a member of BASRaT, and I treat everything you tell me as confidential.


  1. What information I collect

When you enquire. Your name, email address, phone number (optional), what you'd like help with, a short description of your problem, whether you prefer online or in-person sessions, and how you heard about me.

Before and during your treatment - Two questionnaires (medical and lifestyle) covering your health history, injuries, medication, symptoms, goals, sleep, nutrition, stress and activity. This is "special category" health information, which the law treats as more sensitive. I also keep session notes, assessment findings, exercise programmes, progress and test results.

Payments - Your name, email, billing details and payment history. Card and bank details are handled by Stripe, and I never see or store your full card number.

Communications - Emails and messages you send me (for example by email or WhatsApp).

Website - This website uses Framer’s built-in analytics to count visits and page views. It doesn’t use cookies and doesn’t identify you personally. The details you type into the enquiry form are sent to me by email.


  1. How I use it, and why

Replying to your enquiry and arranging your assessment
Information used: Enquiry details
Legal basis: Taking steps at your request before a contract; my legitimate interest in running my practice

Assessing you, treating you and planning your programme
Information used: Questionnaires, session notes, programmes
Legal basis: Providing health care under a contract with you. For health information, the law allows this where it's provided by a professional bound by confidentiality

Invoicing, taking payments and keeping accounts
Information used: Billing and payment details
Legal basis: Contract; legal obligation to keep financial records

Keeping your records safe and secure, and running the business
Information used: All of the above
Legal basis: Legitimate interests

Preparing an AI-assisted summary of your questionnaires (see section 4)
Information used: De-identified questionnaire answers
Legal basis: Your explicit consent

Contacting you about a programme you registered interest in
Information used: Name, email
Legal basis: Your consent

I do not sell your information, and I do not use it to send marketing unless you've asked me to.


  1. AI-assisted summaries

If you agree on the intake form, I use an AI tool (Claude, provided by Anthropic) to help with admin and note-keeping: turning your questionnaire answers into a short briefing before your first session, tidying my own session notes, and helping me word routine emails.

• Only with your consent. The form asks you. If you say no, nothing is sent to the AI tool and I read your answers myself.
• Identifying details removed first. Before anything is sent, I remove your name, email address and date of birth, and send only your age and gender alongside your health and lifestyle answers. Your written answers are sent as you wrote them, so please avoid including names or other identifying details in them. For session notes and emails I leave out your name.
• Provider. The tool is Claude, provided by Anthropic. Under Anthropic's commercial terms, information sent to it this way isn't used to train its AI models, and it is kept only for a limited period before being deleted.
• It supports me, it doesn't decide. The summary doesn't diagnose anything or make decisions about you. I read your original answers and make every clinical decision myself.

You can withdraw your consent at any time by emailing me.


  1. Who I share your information with

I only share information with the services that help me run my practice, and each is bound by its own data protection terms:

• Google - Workspace: email, forms, sheets and storage
• Stripe - payments and invoicing
• Make.com - automation between my systems
• Anthropic - AI summaries, with your consent, as above
• Framer - website hosting and enquiry forms
• Cloudflare - website and domain services
• Rehab Guru - exercise programme software
• WhatsApp - messages between you and me, if we use it

I also use a dictation tool to help me write session notes. I don't put anything that identifies you into it.

I'll share information with another health professional, such as your GP, a physiotherapist or a surgeon, only if you agree, or if the law requires it, or if it's necessary to protect you or someone else from serious harm.

My accountant may see billing and payment records.


  1. Transfers outside the UK

Some of these services store or process information outside the UK, including in the United States. Where that happens, I rely on approved safeguards such as the UK's international data transfer arrangements, or the provider's certification under the UK-US data bridge, so your information keeps a similar level of protection.


  1. How long I keep it

Clinical records (questionnaires, notes, programmes): 8 years after your last session. For clients under 18, until they turn 25.

Financial records: At least 6 years, as required for company accounts and tax

Enquiries that don't become clients: 12 months

Programme interest list: Until you ask to be removed, or the programme launches and you decide not to proceed

After that I delete or anonymise it.


  1. Keeping it secure

I use password-protected, access-controlled systems and take reasonable steps to protect your information. No system is completely secure, so please avoid sending sensitive details by unsecured routes if you can.


  1. Your rights

You have the right to:
• ask for a copy of the information I hold about you
• ask me to correct anything that's wrong
• ask me to delete your information (I may need to keep some records, such as clinical and financial ones, for the periods above)
• ask me to restrict or stop using your information in certain ways
• receive your information in a portable format
• withdraw consent at any time, where I rely on it

To use any of these, email info@rehabpt.co.uk. I'll respond within one week.


  1. Under 18s

If you're under 18, a parent or guardian should complete forms and agree to this policy on your behalf.


  1. Complaints

If you're unhappy with how I've used your information, please talk to me first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113).


  1. Changes to this policy

I may update this policy from time to time. The date at the top shows when it was last changed.