Privacy notice

Last updated: October 2026

Who I am

MJL Therapy is run by Miles Larter, a self-employed physiotherapist registered with the Health and Care Professions Council (registration PH118028). I am the data controller for the personal information described in this notice, which means I decide how it is used and I am responsible for protecting it.

I am registered with the Information Commissioner's Office (registration number [ICO REGISTRATION NUMBER]).

Address: Drews Cottage, 20 Biggleswade Road, Potton, Bedfordshire SG19 2LU
Email: MJLtherapy@physiofromhome.com

What I collect

When you book online: your name, email address, mobile number, the type of appointment, the reason for your appointment, and your answers to the health questions (medical conditions, medication and any other health information you choose to give). This is all the online booking system holds.

When you attend: the notes I make while assessing and treating you, which form your clinical record — for example your symptoms, relevant medical history, examination findings, treatment and advice given. These notes are kept separately and are never stored in the online booking system.

Your reason for appointment, health answers and clinical record are health information, which the law treats as a special category of personal data and protects more strictly.

Why I use it, and the legal basis

• To arrange and manage your appointment — confirming bookings and contacting you about changes. This is necessary to provide the service you have asked for (UK GDPR Article 6(1)(b)).
• To assess and treat you, and keep clinical records — necessary for providing healthcare (UK GDPR Article 6(1)(b), and for health information Article 9(2)(h) together with the Data Protection Act 2018, Schedule 1, paragraph 2). As a registered professional I am also required by the HCPC to keep accurate records (Article 6(1)(c)).
• To meet legal, insurance and regulatory obligations — for example responding to a complaint, an insurance claim or a request from my regulator.

I do not use your information for marketing, and I never sell it.

Who I share it with

Your information is only seen by me. I use a small number of service providers to run the booking system, who process data on my behalf and under contract, and may not use it for any other purpose:

• Vercel — hosts this website and booking system.
• Upstash — stores booking details in a secure database.
• Resend — sends booking confirmation emails.

If you contact me on WhatsApp, your messages are sent through WhatsApp (owned by Meta), which processes them under its own privacy policy. Please don't send detailed health information by WhatsApp; it can be discussed at your appointment.

I will only share your information with other people, such as your GP or a consultant, with your agreement or where it is necessary for your care. I may also share it where the law requires me to, for example to protect someone from serious harm, or with my professional indemnity insurer if there is a claim.

International transfers

Some of the service providers above are based in, or use servers in, the United States. Where personal data is transferred outside the UK, it is protected by appropriate safeguards, such as the UK International Data Transfer Addendum or equivalent contractual protections approved under UK data protection law.

How long I keep it

• Your reason for appointment and health answers from the online booking form are automatically deleted from the booking system 90 days after the appointment.
• Your name, contact details and appointment history (dates, appointment types and attendance) are kept for 12 months after each appointment, so I can manage follow-up appointments, and are then automatically deleted.
• Clinical records are kept for 8 years after your last appointment, in line with professional guidance. For patients under 18, records are kept until their 25th birthday, or 26th if they were 17 at the end of treatment, whichever is longer.

After these periods, records are securely deleted or destroyed.

How I keep it secure

The website uses encrypted connections. Booking information is held in a password-protected system that only I can access. Clinical records are stored securely and are not kept in the treatment room.

Children

Appointments for anyone under 16 must be booked by a parent or guardian, who will also need to attend.

Cookies and third-party content

This website does not set its own cookies or use tracking or analytics. The page loads fonts from Google Fonts and shows an embedded Google map, so your browser connects to Google when you visit, and the map may set cookies under Google's own privacy policy. The Facebook and Instagram links take you to those platforms, which have their own privacy policies.

Your rights

You have the right to:

• ask for a copy of the personal information I hold about you;
• ask me to correct information that is wrong or incomplete;
• ask me to delete your information — although I may need to keep clinical records for the period above to meet my professional and legal obligations;
• ask me to restrict how I use your information, or object to it being used;
• ask for your information to be transferred to another healthcare provider.

To make any of these requests, email MJLtherapy@physiofromhome.com. I will respond within one month, and there is normally no charge.

Complaints

If you are unhappy with how I have handled your information, please contact me first so I can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

I may update this notice from time to time. The date at the top shows when it was last changed.