Privacy Notice

This notice explains how Unity Health & Performance looks after your personal and health information: what we keep, why we keep it, who else sees it, how long we keep it, and what you can ask us to do.

Last updated: 23 October 2026

A correction. Until 26 August 2026, this website showed a generic app privacy policy that didn’t describe our clinic. It listed information we have never collected and offered choices we can’t actually give. We’re sorry for that. This notice replaced it and describes what really happens. The section “What we don’t collect” puts each of the old statements right.

Who we are

Unity Health & Performance Ltd is the “controller” of your information. That means we decide how it’s used and we’re responsible for keeping it safe. We’re an injury rehabilitation clinic offering physiotherapy, osteopathy, sports therapy and acupuncture at two sites:

Prested Hall Health Centre, Prested Hall Chase, Feering, Colchester, Essex CO5 9EE
Warren Active, Herbage Park Road, Woodham Walter, Maldon CM9 6RW

We’re registered with the Information Commissioner’s Office (ICO), registration number ZC087585.

As a small practice, we don’t have to appoint a formal Data Protection Officer. Instead, the practice owner is your contact for anything in this notice, including any request about your information. Email hello@unityhealthperformance.com or call 01376 310915.

What we hold

Most of what we hold is your clinical record. The law treats health information as needing extra protection, and so do we. It includes:

Your clinical notes. For each appointment: what you told us, what we found when we examined you, our assessment and our plan, along with the date, the clinic and the clinician who wrote them. Once a note is signed it can’t be changed. Any correction is added separately, with its own date.
Your health questionnaire. Before your first consultation you answer some screening questions about your general health, tick any conditions you’ve had and list any medication you take. You do this on our consent and health form, and your clinician goes through your answers with you in the room.
A summary card at the front of your record. This lets the clinician treating you see the important things straight away: allergies and warnings, your conditions and medication, and anything else useful about your care.

Each time we go through this card with you, we note the date, who did it and whether anything changed. That keeps it up to date and shows when it was last checked. It’s a record of the conversation we had with you, not a log of people opening your file.

Your rehab programme. The problem you came to us with, the exercises we’ve set and how long the programme runs.
What you log against your programme. Which sessions you’ve completed and, if you choose to add them, pain and difficulty scores, weights, reps and comments.
Your appointments. The service, clinician, location, date and time, whether you attended, and the name, email address and phone number you gave when booking.
Your payments. How much, when, how you paid and the description from the payment provider, plus any care package you’ve bought and how many sessions are left on it.
Notes about your care arrangements. For example, why a course of treatment ended or why a session was credited back to you.
Your date of birth. We ask for this on the consent and health form and keep it with your clinical record. It helps us make sure we’re treating the right person, and tells us how long we must keep the records of anyone treated as a child.

If an insurer is paying for your treatment, we also need it for billing. Insurers use your date of birth to identify you and settle the claim, so without it you’d need to pay us directly.
Our loyalty programme is separate. It gives birthday points, but only if you choose to add your birthday to your member profile. Your care doesn’t depend on that in any way.

Your loyalty points and how you earned them. Points come from attending appointments and classes, so your points history shows which appointments you attended and when.
Gift cards you’ve bought or received, including who bought each card and who it was for.
Consent forms you’ve signed, including your signature. Before your consultation, and before acupuncture, sports massage or manipulation, you fill in a consent form, usually on a tablet we hand you at reception. It records what you agreed to, your answers to the health questions and the signature you draw on screen. We store it in our clinical records system so that any backup of your records is complete. Forms signed before we had that system are kept in our secure clinic drive, unless we’ve since added a copy to your record.
Details of anyone who consents for you. If a parent or guardian signs on your behalf (for a child, for example), we record who they are, how they’re related to you, and the phone number and email address they give us. That way the record shows who agreed to treatment and how to reach them.
Your home address. We ask for this on the consent and health form and keep it with your record so we can invoice you, write to your GP or insurer, or post things to you.
Your GP practice. We ask for this on the consent and health form and keep it with your record so we can write to your GP when it’s appropriate for your care, and know who to contact if we ever need to. You give us these details. We don’t get them from the practice, and we won’t contact your GP without you knowing.
Your phone number and email address. You give us these when you book, and we ask again on the consent and health form so your clinical record has its own way of contacting you, separate from the booking system. The details on your form are kept with your record; the ones you booked with stay in the booking system too.
Correspondence about your care. Messages between us and you and, where relevant, your insurer, GP or employer. This is usually by email, and occasionally by post.

Even a payment record counts as health information. It may not mention anything clinical, but it shows that a named person was treated at an injury rehabilitation clinic, when, and often what type of treatment they had. So we protect it in the same way as your clinical notes.

What we don’t collect

Our old notice said we collected several things that we don’t. In case you read it, here’s each one put right.

Your location. We don’t track where you are. Nothing we use follows your device or records where you’ve been. The old notice mentioned “location data (if enabled)”, but that was never true of us.

This is different from your home address, which we do keep (see above) to invoice you or write to your GP or insurer. You give us your address for a clear reason. Tracking would be something done without your involvement, and we don’t do it.

Device information, usage tracking or crash reports. Our patient system collects none of these, and we don’t use any analytics company.
Data from Google Fit, Apple Health or wearables. We aren’t connected to any health or fitness app and never have been.
Health information from anywhere else. We only know what you tell us and what we find when we examine you. We don’t buy information about you or get it from data brokers.

We don’t hold your password either. Signing in is handled by Wix (see below), and we never see or store it.

We do send a newsletter, and we do share patient stories when people have agreed. The old notice got the details of both wrong. The sections on our newsletter and on photos, stories and reviews explain how they actually work.

We’re building our own app and expect it to link to wearables and fitness apps in future. Before that happens we’ll update this notice, and we’ll ask you separately before connecting anything of yours.

Why we hold it, and the legal basis

We hold your record so we can treat you safely, keep the records our professions require, charge you correctly and meet our legal duties as a company.

We don’t rely on your consent to keep your clinical record, and it’s worth explaining why. Under data protection law, consent has to be something you can freely give and freely take back. We couldn’t safely treat you and then delete the record of that treatment on request, so the law provides other grounds instead. These are the ones we use:

To provide your care and keep a record of it: Article 6(1)(b), because it’s needed to carry out our contract with you. If someone else has the contract with us (a parent, insurer, employer or club), Article 6(1)(f), our legitimate interest in providing and recording safe care. Where a professional body requires us to keep the record, Article 6(1)(c).
Because it’s health information: Article 9(2)(h), the provision of health care and the management of health care services, together with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Everyone who can see your record has a duty of confidentiality.
For accounts and tax: Article 6(1)(c), our legal obligations under the Companies Act 2006 and HMRC’s record-keeping rules.
For running the practice: Article 6(1)(f), our legitimate interest in understanding how the practice is doing. Whenever we can answer a question using overall figures rather than names, we do.
For our newsletter and loyalty programme: Article 6(1)(f), our legitimate interest in telling our patients about our own services and running a rewards scheme you’ve chosen to join. You can stop the newsletter at any time, for any reason.
For photos, stories and reviews: your consent, under Articles 6(1)(a) and 9(2)(a). This is the only area where we rely on consent. None of it is needed for your care, so you’re free to say yes or no and to change your mind later.

Agreeing to treatment is a separate matter. Your clinician will talk your treatment through with you and ask for your agreement. That’s part of good clinical practice and has nothing to do with the legal grounds above.

Our newsletter and emails about the clinic

We send patients a newsletter and the occasional email about our own services, using the email address you gave when you booked. These are sent through Wix, which also runs our bookings. The law allows a business to email its own customers about similar services it offers, and that’s what we rely on, not your consent. We don’t use your clinical record for this.

Every email has an unsubscribe link, and one click is enough. You can also just email us and ask to be taken off. Unsubscribing won’t affect your care or your appointments in any way, and we’ll never send clinical information by newsletter.

You have an absolute right to stop marketing. If you ask us to stop, we will, no questions asked.

Photos, stories and reviews

Now and then we share patient stories, photos or treatment results on social media, and sometimes we ask patients to leave us a review.

We’ll only do this if you’ve agreed, and we’ll always ask first. Saying no makes no difference to your treatment, and you don’t need to give a reason.

You can change your mind at any time. Just tell us and we’ll remove the post. Please bear in mind that once something has been public, we can’t guarantee nobody has copied, shared or screenshotted it. We can take down our own post, but not copies other people have made.

A review you leave on Google or anywhere else is public and is under your control, not ours, including whether it shows you’re our patient. You can edit or delete it on that site whenever you like.

Our loyalty programme and gift cards

Our loyalty programme gives you points for attending appointments and classes, which you can put towards recovery sessions. It runs through your member account.

Because points are earned by attending particular appointments, your points history shows which treatments you’ve had and when. So although it looks like a simple rewards balance, we look after it as carefully as the rest of your record.

Adding your date of birth for birthday points is completely optional. If you’d rather not, just leave it out. Everything else works the same.

Gift cards. If you buy a gift card for someone, we keep their name and the contact details you give us so we can send it to them. If someone has bought a card for you, we have your details because they gave them to us, and you have a right to know that. You can ask at any time what we hold about you and ask us to remove it. If you’re not otherwise a patient, we can usually do that.

Who else is involved

We use a small number of suppliers to help run the practice. They only act on our instructions, and each has a contract with us covering data protection.

Render hosts our patient system and its database. Render is a US company. Our services are set up in its Frankfurt region, but Render says its main operations are in the US, and it doesn’t guarantee where data or backups are stored. Your information is protected by the UK extension to the EU–US Data Privacy Framework and by standard contractual clauses, not by where it’s physically kept. We’d rather tell you that clearly than suggest a guarantee that doesn’t exist.
Wix runs our website and bookings, handles signing in and sends our newsletter. Your name, email address, phone number, bookings, loyalty points and gift cards are held there.
Google Workspace provides our email, staff sign-in and a shared drive that holds older patient documents and clinic policies. Emails about your care, including those with insurers or your GP, are kept in our email system.
Google Drive, when you open your exercise programme. Our exercise videos are stored on Google Drive and shown within your programme page. This means your browser connects to Google each time you open it, and Google can see your IP address and any Google cookies in your browser. The videos themselves contain nothing about you. We mention this because it happens on your own device and you wouldn’t otherwise know.
Square, Monzo and GoCardless are our payment and banking providers. They tell us about payments you make, which we match to your record. Square may process payment information outside the UK and Europe. Square has told us that when it does, it uses the safeguards UK law requires. For countries whose data protection laws the UK hasn’t recognised, that usually means UK-approved standard contractual clauses. You can ask us for a copy.
Your insurer, if they’re paying for your treatment. We send them what they need to authorise and settle your claim: your name, date of birth, policy details, the treatment you had and when. Your insurer is a controller in its own right, and its own privacy notice covers what it does with your information.
Your GP or employer, when it’s appropriate for your care and you know about it.
Facebook, Instagram, YouTube and LinkedIn, where we post clinic content and, if you’ve agreed, your story or photo. Anything posted there is also covered by that platform’s own terms.
Our accountant, who prepares our year-end accounts and so sees financial records, some of them linked to named patients. They have a professional duty of confidentiality. Our accountant or solicitor also keeps a small technical file that lets us prove our records haven’t been tampered with. It holds dates, counts and check codes, and no patient information.

Until 8 September 2026, our staff used a work messaging group on their phones, and appointments were sometimes discussed there. They’ve stopped using it, but older messages may still be on their phones. These are included if you ask to see what we hold.

We don’t sell your information, and we never will.

Where your information is kept

Your clinical record is in our patient system, hosted as described above.
Your bookings, loyalty points and gift cards are in Wix.
Your contact details are in both: in Wix from when you booked, and in your clinical record from your consent and health form.
Emails are in Google Workspace.
Encrypted copies of the database are kept on the practice owner’s encrypted computer and in the practice’s own cloud storage, so your record survives if any one supplier fails.

We keep your signed consent form in the patient system with the rest of your record. We do that on purpose, so a backup always includes it. Letters and scan reports about your care from your GP, a hospital or your insurer are kept there too. Consent forms signed before we had this system, and older clinic documents, are in our secure Google shared drive unless we’ve since added a copy to your record.

If we post a letter to your insurer, GP or employer, it also exists on paper while it’s in the post.

How long we keep it

We follow the retention periods in the NHS Records Management Code of Practice. Private clinics aren’t legally bound by it, but it’s the standard our professional bodies point to, and it matches the time limits for bringing a claim about treatment.

Adults: 8 years after your last treatment.
Children and young people: until their 25th birthday, or their 26th if they were 17 when treatment ended.
Financial records: 6 years, as company and tax law requires, even where they’re linked to you.

Our system doesn’t delete anything automatically. We review and remove records by hand, so a record may be kept a little past its date before we get to it.

Your rights, and their limits

You have rights over your information. We’d rather be clear about what we can and can’t do than promise things we can’t deliver.

To see what we hold (a subject access request). Just ask. We’ll normally respond within one month, free of charge. We search every system listed above by hand, including email and the old staff messaging group, so please allow us the full month.
To have mistakes corrected. Yes, just ask us. (Our old notice said you could edit your own details in an app. You can’t.) A signed clinical note is never overwritten. Instead, we add a dated correction alongside it, which is how clinical records have to work.
To have your record deleted. We usually can’t do this and will normally have to say no, because we must keep clinical records for the periods above and financial records for 6 years. Our old notice wrongly said we would delete “your account and associated data” on request, and we’re sorry it did. You can always ask, and we’ll explain our decision.
To object, or ask us to limit what we do. Ask us and we’ll consider it properly and let you know the outcome.

To be precise about this: the formal right to object applies where we rely on “legitimate interests”. For clinical records, that means patients whose care is paid for by someone else, such as a parent, insurer, employer or club. If that’s you, you can object, and we must either stop or show strong reasons to continue. If you pay us directly, we hold your record to carry out our contract with you, so the formal right doesn’t apply. You can still ask, though, and we’ll still explain.
The right to object also applies to our management reporting and to the use of financial figures in any legal proceedings the practice is involved in.

To stop our newsletter, at any time. This one is absolute. Tell us or click unsubscribe and it stops. You don’t need to explain.
To withdraw consent for a photo, story or review. You can do this at any time, and it’s as easy as giving it was. We’ll take our post down, though we can’t recall copies others may have made.
To get a copy to take elsewhere (data portability). This covers the information you gave us that we hold under our contract with you. We’ll provide it in a common format on request. It doesn’t include our clinicians’ own notes and assessments.

To use any of these rights, email hello@unityhealthperformance.com. We may need to check your identity first, to protect your record.

Children and young people

We do treat children and young people. When the patient is a child, the contract for their care is usually with a parent or guardian, and we keep their record until their 25th birthday (or 26th if they were 17 when treatment ended). We ask for a date of birth on the consent and health form and keep it with the record so we know which records this applies to.

If a parent or guardian fills in the consent and health form for a child, we record their name and relationship to the child so the record shows who agreed to treatment. A young person who’s old enough to understand what they’re agreeing to can fill it in themselves.

As with all our records, nothing is deleted automatically when the date arrives. We review and remove records by hand, so a record may be kept a little longer before we get to it.

If you’re a staff member’s emergency contact

This short section isn’t about patients. It’s for anyone one of our staff has named as their emergency contact.

If that’s you, we hold your name, your relationship to the staff member and one phone number, and nothing else about you. Unity Health & Performance Ltd holds this only so we can contact you if they’re taken ill or injured at work. Our legal basis is Article 6(1)(f) of the UK GDPR: our legitimate interest in being able to reach someone in an emergency.

Your details came from the staff member, not from you, and we check with them once a year that they’re still correct. We haven’t contacted you directly, because the only way we could is the emergency number itself, and calling you out of the blue just to read you a privacy notice would be intrusive given how little we hold. This section is here instead.

Who sees it. Your details are kept in our staff records system. At the moment an outside supplier runs this for us under contract; later this year we’ll move to our own. The “Who else is involved” and “Where your information is kept” sections above apply to you too. We would only ever pass your number to the emergency services if we were calling them about the staff member, or to the police if the law required it.

How long we keep it. We remove your details within a month of the staff member leaving or naming someone else instead. Because nothing deletes itself automatically, it can occasionally take a little longer. A record of what we held and any changes stays in our secure activity log for as long as we keep that staff member’s employment record (6 years after they leave), and a copy may be in one of our monthly backups. Neither is used to look you up, and backups are only opened to restore the whole system.

Your rights. The “Your rights” section above is about patient records. Your rights are to ask what we hold about you, to have it corrected, to have it deleted, to ask us to limit what we do with it, and to object to us holding it at all. Email hello@unityhealthperformance.com or call 01376 310915. The complaints section below, including your right to go to the ICO, applies to you as well.

You can object to us holding your details at all, without giving a reason. Just tell us and we’ll remove them.

How to make a complaint

Please let us know first at hello@unityhealthperformance.com and we’ll look into it properly.

You also have the right to complain directly to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. You don’t have to come to us first.

Changes to this notice

If we change how we handle your information, we’ll update this page and the date at the top. If it’s a significant change, we’ll tell patients directly rather than expecting you to check.