Privacy Notice

How we handle your personal and health information at Unity Health & Performance — what we hold, why we hold it, who else is involved, how long we keep it, and what you can ask us to do.

Last updated: 3 September 2026

This notice replaces an earlier one that was wrong. Until 26 August 2026 this website published a general app privacy policy that did not describe this clinic. It said we collect things we have never collected, and offered choices we cannot actually offer. We are sorry. It has been replaced with the notice below, which describes what really happens. The section what we do not collect sets out the specific corrections.

Who we are

Unity Health & Performance Ltd is the controller of your information — the organisation responsible for deciding how it is used and for protecting it. We are an injury rehabilitation clinic, providing physiotherapy, osteopathy, sports therapy and acupuncture from two sites:

Prested Hall Health Centre, Prested Hall Chase, Feering, Colchester, Essex CO5 9EE
Warren Active, Herbage Park Road, Woodham Walter, Maldon CM9 6RW

We are registered with the Information Commissioner's Office (ICO), registration number ZC087585.

We are not required to appoint a statutory Data Protection Officer at our size. The practice owner is the named contact for anything in this notice, including any request about your information: hello@unityhealthperformance.com, or 01376 310915.

What we hold

Most of what we hold is your clinical record, which the law treats as needing extra protection. Specifically:

Your clinical notes — what you told us, what we found on examination, our assessment and our plan, for each appointment, with the date, the clinic and the clinician who wrote it. Once signed, a note cannot be altered; corrections are added as separate, dated amendments.
The health answers you give us before a consultation — the screening questions about your general health, the checklist of conditions you have had, and any medication you take. You answer these on the consent and health form, and a clinician confirms them with you in the room.
A summary card kept at the front of your record, so that the clinician treating you sees the important things first: allergies and warnings, your conditions and medication, and anything useful to know about your care.
We also record each time we go through that card with you — the date, the clinician, and whether anything changed. That is so the summary stays current rather than drifting, and so it is clear when it was last checked. It records the conversation we had with you, not that somebody opened your file.
Your rehabilitation programme — your presenting complaint, the exercises prescribed, and how long the programme runs.
What you record against that programme — which sessions you completed, and, where you choose to enter them, pain and difficulty scores, weights, repetitions and any comment you write.
Your appointments — the service booked, the clinician, the location, the date and time, whether you attended, and the name, email address and phone number you gave when booking.
Your payments — the amount, the date, the method and the description shown by the payment provider, and any care package you have bought and how many sessions of it remain.
Notes about your care arrangements — for example, why a course of treatment ended, or why a session was credited back to you.
Your date of birth. We ask for it on the consent and health form you complete before your first consultation, and it is kept with your clinical record. We need it to be sure we have the right person in front of us, and to apply the rules about how long we must keep the records of someone treated as a child.
If your treatment is funded by an insurer, we also need it to bill them. Your insurer requires a date of birth to identify you and settle the claim, so without it you would have to pay us directly.
Our loyalty programme is separate and optional. It awards birthday points, and you add your birthdate to your member profile yourself only if you want them. Nothing about your care depends on that one.
Your loyalty points, and what earned them. Points are earned by attending appointments and classes, so the record of them shows which appointments you attended and when.
Gift cards you have bought or been given, including who bought a card for whom.
Consent forms you have signed, including your signature. Before a consultation — and before acupuncture, sports massage or a manipulation technique — you complete a consent form, usually on a clinic tablet handed to you at reception. It records what you agreed to, the health questions you answered, and the signature you draw on the screen. It is stored inside our clinical records system, so that a backup of those records is a complete one. Consent forms signed before that system existed are kept in our secure clinic drive, unless we have since added a copy to your record in the patient system.
If someone consents on your behalf — a parent or guardian for a child, for example — we record who they are, their relationship to you, and the telephone number and email address they give us on the form, so the record shows who agreed to the treatment and how to reach them.
Your home address. We ask for it on the consent and health form and keep it with your record, so that we can invoice you, write to your GP or your insurer, or send you something by post.
Which GP practice you are registered with. We ask for it on the consent and health form and keep it with your record, so that we can write to your doctor where your care makes that appropriate, and so that we know who to contact if we ever need to. You tell us — we do not obtain it from the practice, and we do not contact them without your knowing.
Your telephone number and email address. You give these when you book, and we ask for them again on the consent and health form so that the clinical record has a way of reaching you that does not depend on the booking system. The ones you give on the form are kept with your record; the ones you gave when booking stay in the booking system as well.
Correspondence about your care — with you, and where relevant with your insurer, GP or employer. This is normally by email, and occasionally by post.

A payment record linked to you is health information too. Even with no clinical words in it, it shows that a named person received care at a injury rehabilitation clinic, when, and often which discipline — physiotherapy, osteopathy, sports therapy or acupuncture. We treat it with the same protection as your notes.

What we do not collect

The notice published before this one said we collected several things we do not. Because you may have read it and believed it, we are correcting each one specifically rather than quietly dropping them.

Where you are. We do not track your location. Nothing we run follows your device, knows where you are, or records where you were — which is what the old notice meant by "location data (if enabled)", and it was never true of us.
This is not the same as your address. We do hold that where it is needed to invoice you or to write to your GP or insurer, and it is listed in what we hold above. The difference is that you give us an address for a stated purpose; tracking would be something done to you without your involvement, and we do none of it.
Device information, usage tracking, or crash analytics — our patient system collects none of these, and we use no analytics vendor.
Google Fit, Apple Health or any wearable — we have no connection to any health or fitness app, and never have had.
Anything about your health that you have not told us or that we have not found on examination. We do not buy information about you and we do not obtain it from data brokers.

We also do not hold your password. When you sign in, that is handled by Wix (see below); we never see or store it.

We do send a newsletter, and we do share patient stories with permission — the earlier notice was wrong to describe how that works rather than whether it happens. Both are explained below, under our newsletter and photos, stories and reviews.

We are building our own app, and we expect it to connect to wearables and fitness apps in future. When that happens we will update this notice before it starts, not after, and we will ask you separately before connecting anything of yours.

Why we hold it, and our lawful basis

We hold your record to give you safe care, to keep the record of that care that our professions require, to charge you correctly, and to meet our legal obligations as a company.

We do not rely on your consent to hold your clinical record, and we want to be plain about why, because it is easy to misunderstand. Consent in data protection law has to be freely given and freely withdrawn — and we cannot sensibly treat you while deleting the record of your treatment. So the law provides other grounds, and those are what we use:

To provide your care and keep its record: Article 6(1)(b) — it is necessary to perform our contract with you. Where the contract is with somebody else (a parent, an insurer, an employer or a club), Article 6(1)(f) — our legitimate interest in delivering and recording safe care. Where a professional body requires the record to be kept, Article 6(1)(c).
Because it is health information: Article 9(2)(h) — the provision of health care and the management of health care services, together with the condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Everyone with access to your record is under a duty of confidentiality.
For accounts and tax: Article 6(1)(c) — our legal obligation under the Companies Act 2006 and HMRC record-keeping rules.
For running the practice: Article 6(1)(f) — our legitimate interest in understanding our own activity. We use aggregate figures wherever the question can be answered without naming anyone.
For our newsletter and our loyalty programme: Article 6(1)(f) — our legitimate interest in keeping our own patients informed about our own services and in running a rewards scheme you chose to join. You can stop the newsletter at any time, absolutely and without reason.
For photographs, stories and reviews: your consent — Articles 6(1)(a) and 9(2)(a). This is the one place we do rely on consent, because nothing about your care needs it, so it can be freely given and freely withdrawn. That is what makes it consent rather than something dressed up as it.

Consenting to treatment is a different thing. Your clinician will discuss your treatment with you and seek your agreement to it. That is a clinical and professional matter, and it is separate from the legal grounds above.

Our newsletter and emails about the clinic

We send a newsletter and occasional emails about the clinic's own services to patients, using the email address you gave us when you booked. It is sent through Wix, which is also our booking system. We rely on the rule that lets a business email its own customers about its own similar services — not on your consent, and not on your clinical record.

Every message has an unsubscribe link, and one click is all it takes. You can also just email us and we will take you off. Stopping the newsletter has no effect whatsoever on your care or your appointments, and we will never send you clinical information this way.

Direct marketing is the one thing you can object to absolutely — if you tell us to stop, we must, and there is nothing for us to weigh up.

Photos, stories and reviews

We sometimes share patient stories, photographs or treatment results on our social media, and we sometimes ask patients to leave us a review.

We only ever do this if you have agreed, and we will always ask you first. This is the one part of this notice that genuinely does rest on your consent, because nothing about your care requires it. Saying no changes nothing about your treatment, and you never have to give a reason.

You can change your mind at any time. Tell us and we will take the post down. Please be aware of one honest limit: once something has been public, we cannot guarantee that nobody has already copied, shared or screenshot it. We can remove ours; we cannot reach theirs.

A review you leave on Google or elsewhere is public and is controlled by you, not by us — including whether it identifies you as our patient. You can edit or delete it yourself on that platform at any time.

Our loyalty programme and gift cards

Our loyalty programme awards points for attending appointments and classes, which you can redeem against recovery sessions. It runs in your member account.

Please be aware of what a points balance shows. Because points are earned by attending particular appointments, your points history records which treatments you attended and when — so we treat it with the same care as the rest of your record, even though it looks like a rewards balance.

Adding your date of birth to earn birthday points is entirely optional. If you would rather not, simply do not add it; everything else in the programme works the same.

Gift cards. If you buy a gift card for somebody else, we hold their name and the contact details you give us so that we can issue it. If somebody has bought a card for you, we hold your details because they gave them to us — and you are entitled to know that, which is why it is written here. You can ask us at any time what we hold about you and ask us to remove it, and if you are not otherwise a patient we can normally do so.

Who else is involved

We use a small number of suppliers to run the practice. They act on our instructions, and each is bound by a contract covering data protection.

Render — hosts our patient system and its database. Render is a United States company. Our services are created in its Frankfurt region, but Render states that its primary operations take place in the United States, and it publishes no guarantee about where data is held or where backups are stored. Protection for that transfer comes from the UK extension of the EU–US Data Privacy Framework and from standard contractual clauses — not from geography. We would rather say this plainly than imply a guarantee that does not exist.
Wix — our website and booking system, the service that signs you in, and the tool that sends our newsletter. Your name, email address, phone number, bookings, loyalty points and gift cards are held there.
Google (Google Workspace) — our email, our staff sign-in, and a shared drive holding older patient documents and clinic policies. Emails about your care — including correspondence with insurers or your GP — are held in our email system.
Google Drive, when you open your exercise programme. The exercise videos are hosted on Google Drive and embedded in the page, which means your own browser connects to Google each time you open your programme, and Google will see your IP address and any Google cookies your browser is carrying. The videos themselves contain nothing about you. We are naming this because it is a disclosure to a third party that happens on your device, and you would not otherwise know.
Square, Monzo and GoCardless — payment and banking providers. They tell us about payments made to us, which we match to your record.
Your insurer, if your treatment is funded by one — we send them what they need to authorise and settle your claim, which will include your name, date of birth, policy details, the treatment given and the dates of it. They are a controller in their own right, and their own privacy notice governs what they then do with it.
Your GP or employer, where your care makes that appropriate and you are aware of it.
Facebook, Instagram, YouTube and LinkedIn — where we share clinic content, and where a story or photograph appears if you have agreed to it. Anything published there is subject to that platform's own terms as well as ours.
Our accountant — who prepares the practice's year-end accounts and therefore sees financial records, some of which are linked to named patients. They are bound by professional confidentiality. Our accountant or solicitor also holds a small technical file that proves our records have not been tampered with; it contains dates, counts and check-codes, and no patient information.

Our staff also use a work messaging group on their phones, in which appointments and what needs covering in them are sometimes discussed. We are telling you because it is where some information about you may exist outside the systems above, and it is included in anything you ask to see.

We do not sell your information, and we never will.

Where your information is kept

Your record is held in our patient system, hosted as described above; your bookings, loyalty points and gift cards in Wix; your contact details in both — in Wix from when you booked, and in your clinical record from the consent and health form; email in Google Workspace; and copies of the database on the practice owner's encrypted computer and in the practice's own cloud storage, so that the record survives a failure at any one supplier. Those copies are encrypted.

Your signed consent form is kept inside the patient system, with the rest of your record. That is deliberate: it means a backup of your records is a complete one, rather than leaving the form you signed in a separate place that a backup might miss. Letters and scan reports about your care that we receive from your GP, a hospital or your insurer are kept in the same place, with your record. Consent forms signed before that system existed, and older clinic documents, remain in our secure Google shared drive unless we have since added a copy to your record.

Where we write to your insurer, GP or employer by post, that letter also exists on paper for as long as it is in transit.

How long we keep it

We follow the retention periods in the NHS Records Management Code of Practice. They are not legally binding on a private clinic, but they are the standard our professional bodies point to, and they match how long a claim about treatment can be brought.

Adults: eight years after your last treatment.
Children and young people: until their 25th birthday — or their 26th, if they were 17 when treatment ended.
Financial records: six years, as company and tax law requires. This applies even where the record is linked to you.

Be aware that our system does not delete anything automatically. Records are reviewed and removed by hand, so a record may exist a little beyond its period before that review reaches it.

Your rights — and where they are limited

You have rights over your information. We would rather tell you honestly what we can and cannot do than list rights we could not deliver.

To see what we hold (a subject access request). Yes. Ask us and we will provide it, normally within one month and free of charge. We do this by hand across every system listed above, including email and the staff messaging group, so please allow us the full month.
To have mistakes corrected. Yes — ask us. There is no way to edit your own details in an app, and the previous notice was wrong to say there was. Note that a signed clinical note is never overwritten: a correction is added as a dated amendment alongside it, which is how clinical records are required to work.
To have your record deleted. Usually we cannot, and we will normally refuse. We are required to keep clinical records for the periods above, and financial records for six years. The previous notice offered deletion of "your account and associated data" on request; that was wrong, and we are sorry it said so. You can always ask, and we will explain our decision.
To object, or ask us to restrict what we do. Ask us, and we will consider it properly and explain the outcome.
One point of detail that is easy to get wrong, so we will be precise. A formal right to object applies where we rely on "legitimate interests" — which, for the clinical record, means patients whose care is funded by somebody else: a parent, an insurer, an employer or a club. If that is you, you can object and we must either stop or show compelling grounds to continue. If you contract with us directly, your record is held to perform our contract with you, and that formal right does not attach to it — though you can still ask, and we will still explain ourselves.
It also applies to our management reporting, and to the use of financial figures in legal proceedings the practice is involved in.
To stop our newsletter — absolutely. This one is not a balancing exercise. Tell us, or click unsubscribe, and it stops. We do not have to be persuaded and you do not have to explain.
To withdraw your consent for a photograph, story or review. Yes, at any time, and it is as easy to withdraw as it was to give. We will take our post down — bearing in mind we cannot recall what others may already have copied.
To receive a copy to take elsewhere (portability). This applies to the information you gave us that we hold under our contract with you, and we will provide it in a common format on request. It does not extend to our clinicians' own notes and assessments.

To exercise any of these, contact hello@unityhealthperformance.com. We may need to confirm who you are first — a sensible protection, given what the record contains.

Children and young people

We treat children and young people. Where the patient is a child, the contract for their care is usually with a parent or guardian, and their record is kept until their 25th birthday (or 26th, if they were 17 when treatment ended). We ask for a date of birth on the consent and health form and keep it with the record, so that we can tell which records that rule applies to.

Where a parent or guardian completes the consent and health form on a child's behalf, we record their name and their relationship to the child, so that the record shows who agreed to the treatment. A young person old enough to understand what they are agreeing to can complete it themselves.

Please note that nothing is deleted automatically when a date is reached. As the section on how long we keep it explains, records are reviewed and removed by hand, so a record may exist a little beyond its period before that review reaches it.

If you are a member of staff's emergency contact

Most of this notice is about our patients. This short section is for somebody else: a person one of our staff has named as the contact we should ring in an emergency. If that is you, we hold your name, your relationship to that member of staff, and one telephone number — and nothing else about you at all. We — Unity Health & Performance Ltd — hold it so that we can reach somebody on their behalf if they are taken ill or injured at work, and for nothing else. Our lawful basis is Article 6(1)(f) of the UK GDPR: our legitimate interest in being able to reach somebody in an emergency.

We did not get your details from you. The member of staff gave them to us. We ask them to give you a short written note when they name you, and we check with them once a year that your details are still right. We have not written to you separately, because the only way we could reach you is the very number we hold for emergencies, and ringing you out of the blue to read you a privacy notice would be intrusive for the little we hold. This page is here instead.

Who else sees it. Your details are held in our staff records system — at present one run for us under contract by an outside supplier, and from later this year our own. The sections above headed "Who else is involved" and "Where your information is kept" apply to you as well. The only people we would ever give your number to are the emergency services, and only if we were calling them for that member of staff, or the police where the law required it.

How long we keep it. We remove your details within one month of that member of staff leaving us, or of them naming somebody else in your place — though, as the section above on how long we keep it says, nothing on our system deletes itself, so removal by hand can take a little longer. A record of what we held and what was changed then stays in our secure activity log for as long as we keep that member of staff's employment record, which is six years after they leave, and a copy may sit in one of our monthly backups. Neither is used to look anything up about you, and a backup is opened only to restore the whole system.

Your rights. The section above headed "Your rights — and where they are limited" describes patient records; these are your rights. You can ask us what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, and object to our holding it at all. Email hello@unityhealthperformance.com or ring 01376 310915. The section below on how to complain, including your right to go to the Information Commissioner's Office, applies to you as it does to a patient.

You can object to us holding your details at all. You do not have to give a reason. Tell us and we will take your details off the record.

How to complain

Please tell us first — hello@unityhealthperformance.com — and we will look into it properly.

You also have the right to complain directly to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint, or on 0303 123 1113. You do not have to come to us first.

Changes to this notice

If we change how we handle your information, we will update this page and change the date at the top. Where a change is significant, we will tell patients directly rather than relying on you to check.

Cancellation & Refund Policy

Last Updated: 18th March 2025

At Unity Health & Performance, we value your commitment to your health and fitness journey. This policy outlines our subscription cancellation and refund terms to ensure transparency and clarity.

1. Subscription & Payment Details

We offer both monthly and yearly subscription plans, as well as one-time payment options, depending on the offer selected by the customer. All payments are processed directly through our website and not via Google Play or the Apple App Store.

2. Cancellation Policy

Users may cancel their subscription at any time by sending a request via email to hello@unityhealthperformance.com.
Once a cancellation request is received, it will take effect immediately and access to the service will be revoked.
There will be no refunds for any remaining time left in the billing cycle after cancellation.
If users cancel during a free trial period, they will not be charged.

3. Refund Policy

No refunds will be issued for subscriptions or one-time purchases.
Once a payment has been processed, it is considered final and non-refundable.
Failure to use the service does not qualify for a refund.

4. Free Trial Policy

We offer a 7-day free trial for new users.
After the trial period ends, users will be automatically charged for their selected subscription plan unless they cancel before the trial expires.
If a user cancels during the free trial period, no charges will be applied.

5. Contact Us

For any questions or assistance regarding cancellations, please contact us at:

Unity Health & Performance
Email: hello@unityhealthperformance.com
Website: www.unityhealthperformance.com

By subscribing to our services, you agree to this Cancellation & Refund Policy.

Terms & Conditions

Last Updated: 18th March 2025

Welcome to Unity Health & Performance Ltd! These Terms & Conditions govern your access to and use of our services, including our website and mobile application ("App"). By using our services, you agree to these Terms.

1. General Information

Company Name: Unity Health & Performance Ltd
Business Registration: Registered with Companies House

2. User Eligibility

Our services are available to individuals aged 16 and above.
Users must be medically fit and able to participate in physical activities. We strongly recommend consulting a doctor or healthcare professional before starting any health or fitness programme.

3. Account Registration & Use

To access our services, users must create an account and either purchase a subscription or sign up for a free trial.
Users are responsible for maintaining the confidentiality of their account credentials.
Accounts are non-transferable and must not be shared with others.

4. Subscription & Payments

Payments for subscriptions and one-time purchases are processed exclusively through our website.
Subscriptions are automatically renewed unless cancellation is requested via email at hello@unityhealthperformance.com.
Receipts for payments will be provided via email.

5. Service Usage & Guidelines

We expect all users to interact with our services in a respectful and responsible manner. The following behaviours are strictly prohibited:

Harassment, bullying, or discrimination against other users or staff.
Hate speech, threats, or offensive content.
Unauthorised redistribution of our content for personal or commercial gain.
Attempting to hack, disrupt, or misuse the App or website.

Violations of these policies may result in immediate termination of your account without a refund.

6. Health Disclaimer

Our services are designed for informational and educational purposes only.
We do not provide medical advice. Any fitness, nutritional, or health-related guidance should not be taken as professional medical advice, diagnosis, or treatment.
We strongly encourage users to consult a doctor or healthcare professional before beginning any fitness or health programme.

7. Intellectual Property & Copyright

All content on our platform, including workouts, educational materials, branding, and designs, is owned by Unity Health & Performance Ltd.
Users may share their progress and achievements but are not allowed to redistribute, resell, or use our content for business purposes.

8. Limitation of Liability

Unity Health & Performance Ltd is not responsible for any injuries, health issues, or other damages that may occur from using our services.
Users acknowledge that all physical activity carries inherent risks and accept full responsibility for their participation.

9. Cancellations & Refunds

Our Cancellation & Refund Policy applies to all subscription and payment-related matters. Please refer to the Cancellation & Refund Policy on our website.

10. Modifications to Terms

We reserve the right to update these Terms & Conditions at any time.
Users will be notified via email of any significant changes.

11. Contact Information

For any questions or concerns regarding these Terms, please contact us:

Unity Health & Performance Ltd
Email: hello@unityhealthperformance.com
Website: www.unityhealthperformance.com

By using our services, you agree to these Terms & Conditions.