CE Physio
Privacy Policy
Last updated: 16 September 2026
Introduction
This privacy policy explains how CE Physio collects, uses and protects your personal information. It applies when you visit our website, enquire about our services, download a free resource, subscribe to our mailing list, buy a course, programme or membership, or receive physiotherapy or Pilates services from us, online or in person.
Because we are a physiotherapy practice, some of what we hold about you is information about your health. Health information is ‘special category’ data under data protection law and is given extra protection. Section 5 explains how we handle it. This policy should be read alongside our terms and conditions and our cookie policy.
Contents
1. Who we are and what this policy covers
2. The personal data we collect about you
3. How your personal data is collected
4. How we use your personal data
5. Health information and other special category data
6. Recordings, messaging and community groups
7. Marketing
8. Who we share your personal data with
9. International transfers and clients outside the UK
10. Data security
11. Data retention
12. Your legal rights
13. Contact details
14. Complaints
15. Changes, third-party links and cookies
1. Who we are and what this policy covers
1.1This policy covers your use of our website at www.cephysio.com, our membership and client portals, our course platforms, our free resources and mailing list, and the services we provide to you.
1.2CE Physio is the trading name of Chloe Evans, a sole-practitioner pelvic health physiotherapist registered with the Health and Care Professions Council (HCPC registration number PH92062) and a Chartered Physiotherapist registered with the Chartered Society of Physiotherapy. In this policy, ‘CE Physio’, ‘we’, ‘us’ and ‘our’ mean Chloe Evans trading as CE Physio.
1.3Chloe Evans is the controller of your personal data and is responsible for this website. We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration reference ZC148999. We have not appointed a data protection officer, as we are not required to. Our contact details are in section 13.
1.4Our services are for adults aged 18 and over. This website is not intended for children and we do not knowingly collect data relating to children. If you believe a child has given us their personal data, please contact us and we will delete it.
2. The personal data we collect about you
2.1Personal data means any information about an individual from which that person can be identified. We collect, use, store and transfer the following kinds of personal data about you.
(a)Identity data: your name, title, date of birth, username and, where relevant to your care, your sex or gender.
(b)Contact data: your email address, postal address, telephone number, the mobile number you use to message us, your social media handle where you contact us that way, and any emergency contact details you give us.
(c)Health data: what you tell us in an enquiry, intake or screening form and in your sessions and messages, including your symptoms, obstetric, gynaecological, surgical and other relevant medical history and medication, together with our assessment findings, clinical notes, your rehabilitation plan and your progress. Health data is special category data: see section 5.
(d)Transaction and financial data: the services you have bought, payments to and from you, your billing address and the last four digits and expiry date of your card. We never receive or store your full card details, which are handled directly by our payment processor.
(e)Account and profile data: your login details for the membership portal, client portal or course platform, your bookings, class attendance, preferences, feedback and survey responses.
(f)Content data: your posts and questions in any community group or Q&A session, testimonials, photographs and videos you send us, and any recording of a class or session in which you appear (see section 6).
(g)Technical and usage data: your IP address, login data, browser, time zone and approximate location, operating system, device identifiers, and information about how you use our website, portals, courses and emails, including which emails you open and which links you click (collected through a small tracking image in our marketing emails: see our cookie policy).
(h)Marketing and communications data: your marketing and communication preferences.
2.2We also use aggregated data, such as statistics about how many visitors use a particular part of our website. Aggregated data is not personal data because it does not identify you. We do not ask you for information about criminal convictions or offences. In rare cases, something disclosed to us in a safeguarding context may include information of that kind; where that happens, we handle it in accordance with section 5.5 and the safeguarding conditions in the Data Protection Act 2018.
2.3Where we need personal data by law or under our contract with you and you do not provide it, we may not be able to deliver the service you have asked for. We will tell you if that is the case.
3. How your personal data is collected
3.1From you. You give us most of your personal data yourself: when you complete an enquiry or contact form, sign up for a free resource or our mailing list, buy a service, create an account, complete an intake or screening form, attend a session or class, correspond with us by email, WhatsApp, social media, telephone or post, or give us feedback, a testimonial or a complaint.
3.2Automatically. As you use our website and portals we collect technical and usage data through cookies, server logs and similar technologies. Our cookie policy explains this.
3.3From third parties. We receive transaction and limited financial data from our payment processor; technical and usage data from the providers of our website, email system, portals and website security; technical and usage data from advertising and analytics providers, where you have consented to the relevant cookies; clinical information from a healthcare professional who refers you or with whom you have asked us to correspond; and your name and contact details from anyone who books or pays for a service on your behalf.
4. How we use your personal data
4.1The law requires us to have a legal basis for using your personal data. We rely on one or more of the following:
(a)performance of a contract with you, or steps taken at your request before entering into one;
(b)legitimate interests, where the processing is necessary to run our practice and your interests and rights do not override ours, having considered the impact on you;
(c)legal obligation, where we must comply with a legal or regulatory requirement; and
(d)consent, where you have actively agreed to a particular use. You can withdraw your consent at any time.
4.2Where we use health data or other special category data we also need a condition under Article 9 of the UK GDPR. Section 5 sets out the conditions we rely on.
4.3 The information below sets out how we use your personal data, the legal bases we rely on and how long we keep it.
Responding to your enquiry, giving you information about our services, and screening you to decide whether a service is clinically appropriate for you
Type of data: Identity; Contact; Health
Legal basis: Steps taken at your request before entering into a contract; Legitimate interests (to answer enquiries and run our practice). Health data: see section 5.
Retention: Reviewed at least once a year; deleted where there has been no contact for 24 months and you have not bought a service; otherwise kept as part of your clinical record.
Providing 1:1 physiotherapy and rehabilitation, including assessment, clinical notes, rehabilitation plans, referral, and support by email and WhatsApp
Type of data: Identity; Contact; Health; Account and profile; Content
Legal basis: Performance of a contract with you. Health data: see section 5.
Retention: 8 years from the end of your treatment, or 25 years for records relating to pregnancy or postnatal care (see section 11).
Providing the membership, courses, programmes and classes, and managing your account and access
Type of data: Identity; Contact; Account and profile; Content; Usage
Legal basis: Performance of a contract with you.
Retention: For as long as you have access, and 6 years after your last purchase.
Taking payment, managing instalments, issuing receipts and recovering money owed to us
Type of data: Identity; Contact; Transaction; Financial
Legal basis: Performance of a contract with you; Legitimate interests (to recover debts due to us); Legal obligation (tax and accounting).
Retention: 6 years after the end of the tax year to which it relates.
Managing our relationship with you, including telling you about changes to our terms or this policy, and handling your questions and complaints
Type of data: Identity; Contact; Account and profile; Marketing and communications
Legal basis: Performance of a contract with you; Legal obligation; Legitimate interests (to keep our records up to date).
Retention: 6 years after your last purchase or contact, whichever is later.
Sending you marketing about our services and measuring how you engage with it
Type of data: Identity; Contact; Usage; Marketing and communications
Legal basis: Consent, or legitimate interests where the 'soft opt-in' for existing customers applies (see section 7).
Retention: Until you unsubscribe. We also review our marketing list at least once a year and delete contacts who have not engaged with our marketing for 2 years.
Recording live classes for the members' library, and recording 1:1 sessions where you ask us to
Type of data: Identity; Content; Health (where a recording reveals it)
Legal basis: Legitimate interests (to provide the recorded library that members pay for); Explicit consent, where you appear on camera or speak about your health (see section 6).
Retention: While the recording remains in the library; 1:1 recordings, 6 months after your package ends.
Publishing testimonials, case studies and other marketing content about your experience
Type of data: Identity; Content; Health
Legal basis: Explicit consent.
Retention: Until you withdraw your consent.
Running, securing and improving our website and portals, including troubleshooting, analytics, hosting and preventing fraud and spam
Type of data: Technical; Usage; Account and profile
Legal basis: Legitimate interests (to keep our website secure, available and relevant); Consent, for any cookie that requires it.
Retention: As set out in our cookie policy; server and security logs for 12 months.
Complying with our professional, regulatory, insurance, tax and legal obligations, and establishing, exercising or defending legal claims
Type of data: Any of the above
Legal basis: Legal obligation; Legitimate interests (to protect our position). Health data: Article 9(2)(f) UK GDPR and section 5.
Retention: While the obligation applies or a claim may be brought.
5. Health information and other special category data
5.1Information about your health is special category data under Article 9 of the UK GDPR. We can only use it where we have both a legal basis under section 4 and a further condition under Article 9.
5.2Providing care. Where we use your health data to screen you, assess you, plan and deliver treatment, keep clinical records, refer you on or support you during a programme, we rely on Article 9(2)(h) of the UK GDPR (provision of health care or treatment) with paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018 (health or social care purposes). That condition applies because your data is processed by, or under the responsibility of, Chloe Evans, a health professional registered with the HCPC who owes you a duty of confidentiality.
5.3Explicit consent. We rely on your explicit consent under Article 9(2)(a) where we share information about your health with your GP, midwife, consultant or another healthcare professional; use your story, words or image in a testimonial, case study or other marketing; or include you in a class recording in circumstances where it reveals information about your health. We ask for that consent separately and record it, and you can withdraw it at any time by emailing us. Withdrawal does not affect anything we lawfully did beforehand.
5.4Legal claims. Where it is necessary to establish, exercise or defend a legal claim, or to respond to a regulatory investigation or an insurance claim, we rely on Article 9(2)(f).
5.5Confidentiality. Your clinical records are confidential. We will only disclose information about your health outside our practice where you have consented, where the law or a court requires it, where it is necessary to protect you or another person from a risk of serious harm, or for safeguarding purposes. If we ever have to disclose without your consent we will tell you, unless it would be unlawful or unsafe to do so.
5.6Please do not post information about your health in a public comment on social media or in a community group if you would rather it stayed private. If you send us health information by direct message, we may ask you to email it to us instead.
6. Recordings, messaging and community groups
6.1Class recordings. Live online classes and Q&A sessions are recorded so members who cannot attend live can watch later, and are made available only to members through the portal. When you join the membership, we ask for your explicit consent, by a tick-box, to being included in recordings where your camera or microphone is on. You do not have to consent: you can take part fully by attending with your camera off, your microphone muted and your display name changed, and we ask you to attend that way if you have not given consent. You can withdraw your consent at any time by emailing us and, if you change your mind about a recording you appear in, we will edit or remove it so far as we reasonably can.
6.21:1 recordings. Where you ask us to record a 1:1 session so you can watch it back, the recording forms part of the record of your care, is shared with you only, and is kept for 6 months after your package ends unless you ask us to delete it sooner. We encourage you to download your recordings if you want to keep them for longer.
6.3Recordings are our intellectual property and you must not share them. This is dealt with in our terms and conditions.
6.4WhatsApp. Where WhatsApp support is included in a service you have bought, we use WhatsApp to communicate with you. It is provided by Meta and your use of it is subject to Meta’s own terms and privacy policy: message content is encrypted in transit, but Meta processes information about your use of the service. Where a message is clinically relevant we record its substance in your clinical record. WhatsApp support is not an emergency service.
6.5Community groups and social media. Anything you post in a community group we run can be seen by us and by every other member of that group. We are responsible for how we run the group and what we post in it; the platform provider is responsible for the platform and processes your data under its own privacy policy. If you comment on our social media accounts, other people may see your public comments. We may reply publicly, but we will not discuss your health in public.
7. Marketing
7.1We send marketing emails where you have given us your consent, for example by ticking the box to receive CE Physio tips and updates or signing up to a free resource, or where you have bought a service and we may rely on the ‘soft opt-in’ in regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 to tell you about similar services. Our marketing emails include a small tracking image that tells us whether an email was opened and which links were clicked; our cookie policy explains this and how to avoid it.
7.2Every marketing email contains a free and simple unsubscribe link, and you can ask us to stop at any time by emailing us. If you unsubscribe you will still receive the service emails we have to send you, such as booking confirmations, receipts, class links and notices about changes to our terms.
7.3We do not sell your personal data, and we do not share it with any third party for that third party’s own marketing purposes.
7.4Online advertising. We advertise on platforms including Facebook and Instagram. Where you have consented to advertising cookies on our website, information about your visit may be shared with the advertising platform so we can measure how our advertising performs and reach people likely to be interested in our services. You can withdraw that consent at any time through the cookie settings on our website. Our cookie policy explains this in more detail.
8. Who we share your personal data with
8.1Where it is necessary for the purposes in section 4, we share your personal data with:
the provider of our website, funnels, email system, portals and customer records system;
our payment processor, which handles card payments, instalments and refunds;
the provider of the video conferencing platform used for live classes and online sessions;
the providers of our online forms, file storage and email tools;
the messaging and social media platforms we use to communicate with you and run community groups;
our website hosting, security and performance provider, and our advertising and analytics providers where you have consented to the relevant cookies;
our accountant and bookkeeper, and our insurers, insurance brokers and legal advisers where we need advice or must notify a claim;
a GP, midwife, consultant or other healthcare professional, with your explicit consent or where it is necessary to protect someone from a risk of serious harm;
our regulators, including the HCPC and the ICO, and other authorities where we are required to disclose information; and
a buyer of our practice or its assets, who would be required to use your personal data in the same way as this policy describes.
8.2Where a provider acts as our processor we have a written contract with it, we permit it to process your personal data only for specified purposes and on our instructions, and we do not allow it to use your data for its own purposes. A list of the specific providers we currently use is available on request.
9. International transfers and clients outside the UK
9.1Some of our providers are based, or store data, outside the United Kingdom, in particular in the United States and the European Economic Area, so your personal data may be transferred outside the United Kingdom.
9.2Whenever we do so we make sure a similar degree of protection is given to your data, by relying on a country, territory or scheme the United Kingdom has assessed as adequate, which includes the European Economic Area and the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it; or on the standard contractual terms approved for use in the United Kingdom, namely the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses, with a transfer risk assessment where one is required; or on another safeguard permitted by Chapter V of the UK GDPR. Email us if you would like details of the safeguards that apply to a particular transfer.
9.3If you are in the European Union. We offer our services to clients in the European Union as well as the United Kingdom, so the EU GDPR also applies to some of our processing. Your rights under it are materially the same as those described in this policy, and you can exercise them in the same way (section 12). You can also complain to the data protection authority in the country where you live (section 14). We have not appointed a representative in the European Union under Article 27 of the EU GDPR: our processing of EU clients’ data is occasional and small in scale, and we keep the position under review.
10. Data security
10.1We have appropriate technical and organisational measures in place to prevent your personal data from being lost, misused, accessed without authorisation, altered or disclosed. These include password protection and multi-factor authentication on our accounts and devices, encryption of devices and of data in transit, keeping clinical records on access-controlled systems, storing any paper records in locked storage, and keeping our software up to date. Access is limited to Chloe Evans and to those of our providers who have a business need to know, who are subject to a duty of confidentiality.
10.2We have procedures to deal with any suspected personal data breach and will notify the ICO, and you, where we are legally required to do so. No transmission of information over the internet is completely secure, and anything you send us over the internet is sent at your own risk.
11. Data retention
11.1We keep your personal data only for as long as we reasonably need it for the purposes we collected it for, including to meet legal, regulatory, professional, tax, accounting and insurance requirements. The retention periods for each purpose are in the table in section 4. Because some of our systems cannot delete data automatically, we operate these periods by reviewing the data we hold at least once a year and deleting what has passed its period.
11.2Clinical records. We keep the clinical record of an adult client for 8 years from the end of your treatment. Where your record relates to care during pregnancy or postnatal care, we keep it for 25 years from the birth of your last child. These periods reflect the retention periods for adult health records and maternity records in the NHS Records Management Code of Practice, which the Chartered Society of Physiotherapy recommends physiotherapists in private practice follow.
11.3By law we must keep basic customer information, including identity, contact, transaction and financial data, for 6 years after the end of the tax year to which it relates. We may keep data for longer where there is a complaint, a regulatory investigation, an insurance claim or a realistic prospect of a legal claim, until the matter is resolved and the time limit for bringing a claim has expired.
11.4We may anonymise your personal data, so that it can no longer be associated with you, and use the anonymised information indefinitely for statistical purposes. In some circumstances you can ask us to delete your data: see section 12.
12. Your legal rights
12.1Under data protection law you have the right to:
(a)request access to your personal data, commonly known as a ‘subject access request’, so you can receive a copy of what we hold and check we are processing it lawfully;
(b)request correction of data that is incomplete or inaccurate, although we may need to verify the accuracy of what you give us. Where a clinical record contains a professional opinion you disagree with, we can add a note recording your view but cannot delete the opinion itself;
(c)request erasure of your personal data where there is no good reason for us to keep processing it. We cannot always comply, for example where the law or our professional obligations require us to keep a clinical record, and we will tell you if that is the case;
(d)object to processing where we rely on legitimate interests, although we may be able to show compelling grounds that override your objection. You have an absolute right to object at any time to the use of your data for direct marketing;
(e)request restriction of processing while the accuracy of your data is checked, where our use is unlawful but you do not want the data erased, where you need us to keep it for a legal claim, or while we consider an objection;
(f)request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format. This applies only to automated information you consented to us using, or which we used to perform a contract with you; and
(g)withdraw your consent at any time where we rely on consent. This does not affect the lawfulness of anything we did beforehand, and we will tell you if it means we can no longer provide a particular service.
12.2To exercise any of these rights, contact us using the details in section 13. You will not have to pay a fee, although we may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded, repetitive or excessive. We may need to ask you for information to confirm your identity before we act, as a security measure. We try to respond within one month, and will tell you if a complex or repeated request will take us longer.
12.3We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you.
13. Contact details
13.1If you have any question about this policy or how we use your personal data, or you want to exercise your rights, please contact:
Chloe Evans, CE Physio
Fit2Go, 65 Clumber Road, West Bridgford, Nottingham NG2 6DP
Email: [email protected]
14. Complaints
14.1If you are unhappy with how we have handled your personal data, please tell us first so we have the chance to put it right. Email [email protected]: we will acknowledge your complaint within 5 working days and aim to give a full response within 20 working days.
14.2You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at www.ico.org.uk. The ICO would expect you to have raised your complaint with us first. If you live in the European Union, you may instead complain to the data protection authority in your own country.
14.3If your complaint is about the clinical care you have received rather than your data, our terms and conditions explain how to complain and how to contact the HCPC and the Chartered Society of Physiotherapy.
15. Changes, third-party links and cookies
15.1We keep this policy under regular review. This version was last updated on the date at the top. Where we make a material change we will tell active clients and members by email. Please also keep us informed if your own details change, in particular your contact details and anything relevant to your health that affects your care.
15.2Our website and communications may include links to third-party websites, plug-ins and applications. Clicking those links may allow third parties to collect or share data about you. We do not control those websites and are not responsible for their privacy policies, so we encourage you to read the privacy policy of every website you visit.
15.3Our website uses cookies and similar technologies. Our cookie policy, at www.cephysio.com/cookie-policy, explains which ones we use, what they do and how to change your preferences at any time.
End of privacy policy. Last updated 16 September 2026.
Copyrights 2026 | CE Physio™ | Terms & Conditions