Patient Privacy Policy

Southside Physiotherapy Clinic Last Updated: 04/03/26

1. Introduction
At Southside Physiotherapy Clinic, your privacy is our priority. We understand that you are trusting us with highly sensitive personal and medical information.
This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and the Irish Data Protection Commission (DPC). It also explains your rights regarding your data.

2. Who We Are

Southside Physiotherapy Clinic is the “Data Controller” of personal data you provide to us.

  • Clinic Address: 60 Clonkeen Dr, Deansagrange, Dublin, D18 AH60
  • Contact Email: info@southsidephysio.com
  • Phone Number: 01 289 7171

3. What Information We Collect
To provide you with safe and effective physiotherapy treatment, we need to collect specific information about you. This includes:

  • Basic Personal Details: Name, date of birth, address, email address, and phone number.
  • Special Category (Health) Data: Medical history, details of your current injury/condition, GP details, scan reports (e.g., MRI, X-rays), subjective and objective clinical treatment notes, and details of any medications you are taking.
  • Financial Data: Payment details for billing and invoicing purposes.

4. Why We Collect It & Our Legal Basis
Under GDPR, we must have a valid legal reason to process your data. We use your data for the following purposes:

  • To provide healthcare (Medical Diagnosis and Treatment): We need your health history to safely assess, diagnose, and treat your condition. (Legal basis: Provision of Healthcare / Contractual Necessity).
  • To communicate with you: To send you appointment reminders, exercise programs, and invoices. (Legal basis: Legitimate Interest / Contractual Necessity).
  • To communicate with your healthcare team: We may need to send referral letters or progress reports to your GP or consultant, but we will always inform you before doing so. (Legal basis: Provision of Healthcare).
  • Marketing (Only with your permission): We may occasionally send you newsletters or clinic updates. We will only do this if you give us your explicit, opt-in consent. (Legal basis: Consent).

5. Who We Share Your Data With
We will never sell your data. We only share your data with trusted third parties when absolutely necessary to provide your care or run our clinic. These may include:

  • Medical Professionals: Your GP, consultants, or other allied health professionals (only with your prior knowledge).
  • Health Insurance Companies: If you are claiming treatment through a provider (e.g., Laya, VHI, Irish Life) and they request billing verification.
  • Our Practice Management Software: Cliniko, which securely hosts our encrypted patient database on compliant servers.
  • Financial Processors: Secure payment gateways (e.g., Stripe) to process your payments.

6. How Long We Keep Your Data
By law, we cannot delete medical records immediately upon request if you have received treatment. In line with Irish legal requirements and the guidelines of the HSE and the Irish Society of Chartered Physiotherapists (ISCP):

  • Adult Records: We retain your clinical notes for a minimum of 8 years after your last date of treatment.
  • Minor Records (Under 18): We retain records until the patient reaches the age of 25 (or 8 years after the last treatment, whichever is longer).
    Once this mandatory retention period expires, your data is permanently and securely destroyed.

7. How We Keep Your Data Safe
We take strict security measures to protect your data:

  • All digital patient records are stored on encrypted, password-protected, and GDPR-compliant cloud software.
  • Any paper records are stored in locked filing cabinets inside our secure clinic.
  • All staff are legally bound by strict confidentiality agreements and undergo regular data protection training.

8. Your Rights Under GDPR
You have several rights regarding how your data is handled:

  • Right of Access: You can request a copy of your complete clinical file (Subject Access Request). We will provide this within 30 days, free of charge.
  • Right to Rectification: You can ask us to correct any factually inaccurate personal details.
  • Right to Erasure: You can ask us to delete your data. (Note: This right is limited regarding medical records due to our statutory obligation to retain them for 8 years).
  • Right to Withdraw Consent: If you have opted into marketing emails, you can unsubscribe at any time without it affecting your clinical care.
    If you wish to exercise any of these rights, please email us at info@southsidephysio.com

9. Complaints
If you feel that your data has been mishandled, we encourage you to contact us first so we can resolve the issue. However, you also have the right to lodge a formal complaint with the Data Protection Commission (DPC) in Ireland (www.dataprotection.ie).

Patient Declaration & Consent
By accepting the privacy policy, you acknowledge and consent to the following:
1. Acknowledgment of Privacy Policy (Required for Treatment)
I have read and understood the Privacy Policy above. I understand that Southside Physiotherapy Clinic must collect and process my personal and medical data to safely provide me with physiotherapy treatment. I understand that my medical records will be retained securely for 8 years in line with Irish law.
2. Communication for Treatment (Required for Treatment)

I consent to receiving appointment reminders, invoices, and home exercise programs via email or SMS.