Privacy Notice

1. What information do we collect?

We collect personal information that you voluntarily provide when you express an interest in obtaining information about us or our services, or when you contact us via email or booking forms. This includes names, email addresses, and professional details such as clinic names.

2. How do we process your information?

We process your information to provide, improve, and administer our services, to communicate with you, for security and fraud prevention, and to comply with the law. We may also process your information for marketing purposes where you have given your consent.

3. What is our legal basis for processing?

We process your personal data on the following legal bases under UK GDPR: performance of a contract (where you have requested our services), legitimate interests (to operate and improve our business), compliance with a legal obligation, and consent (for marketing communications).

4. Do we share your information?

We do not sell your personal data. We may share information with trusted third-party service providers (such as our website host and booking platform) who are contractually required to keep it confidential and use it only to provide services on our behalf.

5. Google account data for clinic clients

This section applies only to physiotherapy clinics who engage us for marketing or reporting services. It does not apply to visitors to this website.

To produce a clinic's monthly reporting dashboard, we access data from the clinic's own Google accounts. Where the clinic connects its Google Business Profile, it authorises that access itself through Google's sign-in screen. We never ask for, receive, or store a clinic's Google password.

We access the following, and only the following:

• Google Analytics: visitor numbers and the channels visitors arrived through
• Google Search Console: the search terms the clinic's website appears for, and its position for them
• Google Business Profile: performance metrics only, being the number of searches that displayed the profile, clicks through to the website, calls, and direction requests

Access is read only. We do not edit a clinic's Business Profile, publish posts, change business information, or write or reply to reviews.

We use this data for one purpose: to produce and display that clinic's own reporting dashboard and monthly written report. We do not sell it, share it with other clinics or third parties, use it for advertising or ad targeting, or use it to develop, improve or train artificial intelligence or machine learning models. Human access is limited to what is needed to provide and support the service, or where the clinic asks us to, or where the law requires it.

A clinic can withdraw this access at any time from Google Account permissions, without contacting us first. On withdrawal, or when an engagement ends, we stop collecting new data and delete the stored authorisation. Figures already published in past monthly reports remain in that clinic's dashboard history unless the clinic asks us to remove them.

PhysioGrow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. International transfers

Our services are hosted via Netlify. Your information may be transferred to, stored, and processed in the UK, the EU, and the United States. We ensure all data transfers comply with UK GDPR standards, including reliance on appropriate safeguards where required.

7. How long do we keep your information?

We retain your personal data only for as long as is necessary to fulfil the purposes outlined in this notice, or as required by law. When your data is no longer needed, we will securely delete or anonymise it.

8. Cookies and tracking technologies

Our website may use cookies and similar tracking technologies to improve your browsing experience and analyse site traffic. You can control cookie settings through your browser preferences. A full cookie policy is in preparation and will be published shortly.

9. Your privacy rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your personal data
• Object to or restrict processing of your data
• Request portability of your data
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details below. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) .

10. Updates to this notice

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised date at the top of this page. We encourage you to review this notice periodically.

11. Contact us

If you have questions or concerns about this notice or our data practices, please contact us at: