Understanding how we manage your information

Privacy Statement

At HJW Therapy Ltd trading as Home Links Physiotherapy Croydon & Sutton, we are committed to protecting your privacy and ensuring the security of your personal information. This privacy notice outlines how we collect, use, disclose and store your data in accordance with UK GDPR and the Data Protection Act 2018, and in line with our professional standards as members of the Chartered Society of Physiotherapy (CSP).

Our Directors have overall responsibility for this notice.

Company Information

Company name: HJW Therapy Ltd (Company Number: 16293433) trading as Home Links Physiotherapy Croydon & Sutton
Registered office: 1 Gemini Court, 42a Throwley Way, Sutton, Surrey, SM1 4AF
Registered in: England and Wales
ICO registration reference: ZB971555

Registered Data Controller

HJW Therapy Ltd trading as Home Links Physiotherapy Croydon & Sutton is registered as a Data Controller with the Information Commissioner's Office (ICO), registration reference ZB971555.

Information We Collect

The information we collect may include your name, address, date of birth, contact details, disability, ethnicity, gender, occupation and hobbies. We may also collect information relating to:

• Your health and any medical condition
• Treatment you are receiving or that is recommended by us or another healthcare professional
• Your personal circumstances shared with us by you or a third party (such as a relative or carer)

How We Use Your Information

Your personal information is used solely for the purpose of providing you with physiotherapy services from Home Links Physiotherapy Croydon & Sutton, including scheduling appointments, assessing your condition, developing treatment plans, and recording your patient information. We do not use your data for any other purpose without your consent.

Sharing Your Information

We will only share your personal information where you have given your consent or where we are required to do so by law. This may include sharing relevant information with other healthcare professionals involved in your care where you have consented to this.

Where we deliver or co-deliver classes or group sessions in partnership with other organisations, we will ask for your consent before sharing any information necessary for your safe participation. We only share what is necessary and do so in line with data protection requirements.

Data Security

We employ robust security measures including encryption, access controls and regular system monitoring to protect your personal information from unauthorised access, disclosure, alteration or destruction.

Data Retention and Storage

We do not retain paper records. Any paper documents are immediately uploaded to your electronic record and securely destroyed. We adhere to NHS guidelines for data retention — in most instances a minimum of 8 years.

Once your treatment is complete, your record will be moved to a restricted-access archived area of Cliniko. After the minimum retention period, it will be securely disposed of or retained in a non-live archive in accordance with GDPR.

Third-Party Systems

We use secure third-party systems to deliver our services. Your data may be stored in:

• Cliniko — clinical records and appointment management
• GoHighLevel — contact management and communications
• Microsoft 365 — email and secure collaboration between practitioners involved in your care
• Rehab My Patient — exercise prescription programmes
• Xero — accounting and invoicing

Each system has its own privacy policy and we regularly audit their compliance with UK GDPR.

Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct any inaccurate or incomplete data
• Erasure — request deletion of your data, where we are not legally required to retain it
• Restrict processing — ask us to limit how we use your data in certain circumstances
• Data portability — request your data in a structured, machine-readable format
• Object — object to certain types of processing

To exercise any of these rights, please contact us using the details below.

Contact Us

The Data Controller
HJW Therapy Ltd trading as Home Links Physiotherapy Croydon & Sutton
1 Gemini Court, 42a Throwley Way, Sutton, Surrey, SM1 4AF
Email: [email protected]

Complaints

If you have any concerns about how we process your personal information, please visit our Compliments & Complaints page in the first instance. You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

Changes to This Privacy Notice

We reserve the right to update or amend this privacy notice to reflect changes in our practices or legal requirements. Any updates will be posted on our website.

Last updated: 24 April 2026