Privacy Policy

Last updated: 26 August 2026

SR Physio and Pilates Limited, trading as SR Physio & Pilates, respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who we may share it with and the rights you have in relation to your personal data.

For the purposes of data protection law, SR Physio and Pilates Limited is the data controller of the personal information described in this policy.

If you have any questions about this Privacy Policy or how we use your information, please contact us:

SR Physio and Pilates Limited
The Stables, Hillberry Green, Douglas,
Isle of Man, IM2 6DF

Email: hello@physioandpilates.com
Website: www.srphysioandpilates.com

1. Data protection law

We process personal data in accordance with applicable Isle of Man data protection legislation, including the Data Protection Act 2018 and the Applied GDPR.

We aim to ensure that personal information is:

used fairly, lawfully and transparently;
collected for clear and legitimate purposes;
limited to the information we genuinely need;
accurate and kept up to date where appropriate;
retained only for as long as necessary;
kept secure and confidential; and
protected against unauthorised access, loss or misuse.

2. Information we may collect about you

The information we collect depends on how you interact with us and which of our services you use.

Personal and contact information

This may include:

your name;
postal address;
email address;
telephone number;
date of birth;
emergency contact details; and
information required to identify you and communicate with you.

Physiotherapy and health information

When you receive physiotherapy or other clinical services from us, we may collect information about your health and medical history, including:

your symptoms and reason for seeking treatment;
relevant medical conditions;
previous injuries, surgery or treatment;
medication where relevant;
mobility, activity levels and lifestyle information;
pregnancy or other relevant health information;
assessment findings;
treatment provided;
clinical observations and professional reasoning;
exercise or rehabilitation programmes;
progress and outcomes; and
correspondence relating to your care.

Health information is classed as special category personal data and is given additional protection under data protection law.

Pilates and exercise information

If you attend Pilates classes or exercise sessions with us, we may collect information such as:

the classes you book;
participant name;
relevant injuries, medical conditions or physical limitations;
exercise experience and activity levels;
information provided through health screening or Pilates questionnaires;
adaptations or precautions required during a class; and
attendance records.

We collect this information so that our physiotherapists and instructors can provide an appropriate and safe service.

Appointment, booking and order information

When you book an appointment, class or other service, we may collect:

the service or class booked;
appointment dates and times;
booking history;
order details;
payment status;
cancellations or changes;
correspondence relating to your booking; and
account information if you create an online account.

Payment information

Payments made through our website may be processed by third-party payment providers, including SumUp.

We do not normally receive or store your full payment card details. These are processed securely by the relevant payment provider.

We may retain information relating to the transaction, such as:

the amount paid;
date of payment;
payment status;
transaction or order reference; and
refund information.

Website and technical information

When you use our website, certain technical information may be collected automatically, including:

IP address;
browser type;
device type;
operating system;
pages visited;
approximate location information;
referring website;
shopping basket and checkout information; and
cookie or similar technology information.

Some of this information is necessary for the website, online shop and booking functions to operate correctly.

Communications

If you contact us by telephone, email, website form, social media or another method, we may retain information about that communication and any information you choose to provide.

3. How we obtain your information

Most personal information is provided directly by you, for example when you:

book a physiotherapy appointment;
book a Pilates class;
complete a health or screening questionnaire;
complete a contact form;
purchase a product or class through our website;
telephone or email us;
create an online account;
attend an assessment or treatment session; or
subscribe to communications from us.

In some circumstances, information may also be provided by another person or organisation, such as:

your GP;
a consultant or other healthcare professional;
another physiotherapist;
a hospital or healthcare provider;
an insurer;
an employer or occupational health provider; or
a parent, guardian or representative.

Where information is provided by another organisation, we expect it to have an appropriate lawful basis for sharing that information with us.

4. How we use your personal information

We may use your information to:

provide physiotherapy assessment and treatment;
plan and monitor rehabilitation;
provide Pilates and exercise services safely;
manage appointments and class bookings;
process orders and payments;
communicate with you about appointments, bookings or treatment;
send booking confirmations, reminders and service-related messages;
maintain appropriate clinical records;
respond to enquiries;
issue invoices and receipts;
manage refunds and cancellations;
administer our website and online shop;
maintain the security of our systems;
manage complaints or concerns;
meet professional, insurance, accounting, tax and legal requirements;
improve our services; and
send marketing communications where we have an appropriate lawful basis to do so.

We will not use your personal information for purposes that are incompatible with the reason it was originally collected unless permitted or required by law.

5. Our lawful basis for using your information

Data protection law requires us to have a lawful reason for processing personal data.

Depending on the circumstances, we may rely on one or more of the following:

Contract

We may process information where it is necessary to provide a service you have requested or to take steps at your request before providing that service.

For example, this may include processing an appointment booking, Pilates class booking, online order or payment.

Legal obligation

We may process information where this is necessary to comply with a legal, regulatory, tax, accounting or professional obligation.

Legitimate interests

We may process information where this is necessary for the legitimate operation of our practice, provided those interests do not override your rights and freedoms.

This may include:

managing our business;
maintaining appropriate records;
preventing fraud;
protecting our website and IT systems;
responding to enquiries;
improving our services; and
establishing, exercising or defending legal claims.

Consent

In some circumstances we will ask for your consent.

For example, this may apply to certain marketing communications, optional website cookies or particular uses of your information.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Health and special category information

Information relating to your physical or mental health receives additional protection under data protection law.

We process health information where this is necessary for the provision and management of healthcare, physiotherapy, rehabilitation or related services by appropriately qualified professionals.

Depending on the circumstances, we may also process health information:

with your explicit consent;
where necessary for the establishment, exercise or defence of legal claims;
where required by law; or
under another condition permitted by data protection legislation.

Clinical information is treated confidentially and access is restricted to those who have a legitimate reason to use it.

7. Sharing your information

We do not sell your personal information.

We may share personal information where reasonably necessary to provide our services or operate the practice.

This may include sharing information with:

physiotherapists, instructors and other members of the SR Physio & Pilates team who require the information;
healthcare professionals involved in your care, where appropriate;
your GP, consultant or other healthcare provider where you have agreed to this or where another lawful basis applies;
insurers or healthcare funding providers where applicable;
accountants, auditors and professional advisers;
IT, website hosting and technical support providers;
appointment and booking system providers;
email and communications providers;
payment processors such as SumUp;
providers involved in operating our WooCommerce online shop;
professional indemnity insurers;
regulatory or professional bodies where required;
courts, law enforcement agencies or public authorities where we are legally required to provide information; and
other organisations where you have asked or authorised us to share information.

Third-party service providers acting on our behalf are expected to process personal information securely and only for the purposes for which it has been provided.

8. Online purchases and payments

Our website uses WooCommerce to provide online shopping and booking functionality.

When you purchase a class or other service through the website, information such as your name, contact details, order details and payment status may be processed through WooCommerce and associated systems.

Payments may be processed through SumUp. Payment providers operate their own secure systems and may process personal information in accordance with their own privacy notices.

We do not normally have access to your complete debit or credit card details.

9. Marketing

We may occasionally send you information about services, classes or other news from SR Physio & Pilates where:

you have consented to receive marketing; or
we have another lawful basis to contact you.

You can unsubscribe from marketing communications at any time by using the unsubscribe option in the communication or by contacting us.

Service-related communications — for example appointment reminders, booking confirmations or important information relating to a service you have purchased — are not considered marketing and may still be sent where necessary.

We do not sell or provide our mailing lists to third parties for their own marketing purposes.

10. Cookies and website technologies

Our website uses cookies and similar technologies.

Cookies are small files stored on your device that can help websites function correctly and remember certain information.

We may use:

Essential cookies

These are necessary for functions such as:

online shopping baskets;
checkout;
website security;
account login;
booking functionality; and
remembering certain choices.

These cookies are required for the website to function and may not require consent.

Functional cookies

These may remember preferences and make the website easier to use.

Analytics cookies

Where enabled, analytics cookies help us understand how people use our website so that we can improve it.

Marketing cookies

Where used, marketing or advertising cookies may be used to understand the effectiveness of advertising or provide more relevant content.

Where consent is required, non-essential cookies will not be used until you have made your choice through our cookie controls.

You can also control or delete cookies using your browser settings. Disabling certain cookies may affect the operation of the website, particularly the shopping basket, checkout or account functions.

11. Information security

We take reasonable technical and organisational measures to protect personal information from:

unauthorised access;
loss;
misuse;
alteration;
accidental disclosure; or
destruction.

Measures may include password protection, access controls, secure website connections, appropriate software security and secure storage systems.

Only people who have a legitimate reason to access confidential information should be able to do so.

While we take reasonable precautions, no internet-based or electronic system can be guaranteed to be completely secure.

12. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet any professional, regulatory, insurance, accounting, tax or legal requirements.

Clinical physiotherapy records may need to be kept for longer periods because they form part of your healthcare record and may be required for professional, clinical or legal reasons.

The appropriate retention period may vary depending on:

the type of information;
your age;
the type of treatment or service provided;
professional guidance;
insurance requirements; and
applicable legal obligations.

When information is no longer required, we will take reasonable steps to delete, destroy or anonymise it securely.

13. Children and young people

We may provide services to children and young people where appropriate.

Where a child is unable to provide valid consent or make decisions regarding their information themselves, information may be obtained from and shared with a parent, guardian or person with appropriate parental responsibility.

We will only collect information that is reasonably necessary for the child’s treatment, participation or care.

Information about children is treated with the same high level of confidentiality and security as other health information.

14. International transfers

Some organisations providing IT, website, email, analytics or other services may store or process information outside the Isle of Man.

Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate level of protection is in place in accordance with applicable data protection law.

This may include using providers located in jurisdictions recognised as providing adequate protection or using appropriate contractual safeguards.

15. Your data protection rights

Depending on the circumstances, you may have the right to:

Be informed

You have the right to understand how your personal information is collected and used.

Access your information

You can ask us for a copy of the personal information we hold about you.

Correct inaccurate information

You can ask us to correct information that is inaccurate or incomplete.

Request deletion

In certain circumstances, you may ask us to delete your personal information.

This right is not absolute. For example, we may be required to retain clinical records because of professional, regulatory, insurance or legal requirements.

Restrict processing

You may ask us to restrict how your information is used in certain circumstances.

Object to processing

You may have the right to object to particular uses of your information, including direct marketing.

Data portability

In certain circumstances, you may be entitled to receive personal information you have provided to us in a commonly used electronic format or ask for it to be transferred to another organisation.

Withdraw consent

Where processing is based on your consent, you can withdraw that consent at any time.

Automated decision-making

You have rights in relation to decisions made solely through automated processing where those decisions produce legal or similarly significant effects.

SR Physio & Pilates does not ordinarily make clinical or service decisions about you solely through automated processing.

If you wish to exercise any of these rights, please contact us using the details at the beginning of this policy.

We may need to verify your identity before releasing personal information.

16. Confidentiality and disclosure of clinical information

Information provided during physiotherapy assessment or treatment is treated confidentially.

We will normally seek your agreement before sharing clinical information with another healthcare professional or organisation unless there is another lawful reason to disclose it.

There may be exceptional circumstances where we are permitted or required to share information without consent, for example:

where required by law or a court order;
where necessary to protect someone from serious harm;
where required by an appropriate regulatory or statutory authority; or
where necessary for the establishment, exercise or defence of a legal claim.

Any such disclosure will be considered carefully and limited to what is reasonably necessary.

17. Data breaches

If a personal data breach occurs, we will assess the circumstances and take appropriate action.

Where required by data protection law, we will report the breach to the Isle of Man Information Commissioner and, where appropriate, inform affected individuals.

18. Third-party websites

Our website may contain links to websites operated by other organisations.

We are not responsible for the privacy practices or content of third-party websites. We recommend reviewing the privacy policy of any external website before providing personal information.

19. Complaints

If you have concerns about the way we have handled your personal information, please contact us first so that we have an opportunity to investigate and resolve the matter.

You also have the right to raise a concern with the Isle of Man Information Commissioner.

Isle of Man Information Commissioner
P.O. Box 69
Douglas
Isle of Man
IM99 1EQ

Telephone: +44 (0)1624 693260
Email: ask@inforights.im
Website: www.inforights.im

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, website, technology, business practices or legal requirements.

The latest version will be published on our website with the date of the most recent update shown at the top of the policy.