Policies
Privacy Policy
Last updated: 6 August 2026
Who we are
Havoheal Physiotherapy UK LTD (company number 17089677) is the data controller for personal data collected through havohealphysiotherapy.co.uk. Our registered office is 124–128 City Road, London, England, EC1V 2NX. That is our registered office address, not a clinic — appointments take place at your own home.
You can contact us about anything in this policy by calling or messaging +44 7469 334067, or by emailing bookings@havohealphysiotherapy.co.uk.
What we collect
When you request a home visit
- Your full name
- Your phone number and email address
- The full address and postcode where the visit should take place, including any flat or building name
- Access and parking details you choose to give us, such as a buzzer code, which entrance to use, or where a vehicle can be left
- The date and time you have requested
- Anything you choose to write in the “important message” field. We ask you not to include detailed medical histories there
- A record that you ticked each consent and confirmation box, and when
Because this is a home-visit service, your address is not optional extra information — it is what allows the appointment to happen at all. We treat it accordingly: it is never shown in a web address, never repeated back in the acknowledgement email we send you, and is shared internally only with the person attending.
When you use the contact form
- Your name, email address and (optionally) phone number
- The subject and content of your message
Technical information
To protect the booking form from automated abuse we record a one-way hashed fingerprint derived from your IP address and browser user agent. We do not store your IP address in a readable form, and the hash is not used to identify or profile you.
Data minimisation
We ask for the smallest amount of information needed to arrange an appointment. We do not request detailed medical histories, health records or special category health data through the general booking form. Any clinical information needed for your care is discussed with you directly and handled separately from this website.
Why we use your data, and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Responding to your booking request and arranging an appointment | Steps taken at your request prior to entering into a contract, and performance of that contract — Article 6(1)(b) |
| Replying to an enquiry sent through the contact form | Legitimate interests — responding to people who contact us — Article 6(1)(f) |
| Keeping records of appointments and consents | Legal obligation and legitimate interests — Articles 6(1)(c) and 6(1)(f) |
| Protecting the website from spam and abuse | Legitimate interests — keeping our systems secure — Article 6(1)(f) |
| Optional analytics cookies | Your consent — Article 6(1)(a) — which you can withdraw at any time |
Placeholder for legal review: if any information you provide amounts to health data (special category data under Article 9), an additional condition is required — typically Article 9(2)(h), the provision of health care by or under the responsibility of a professional subject to a duty of confidentiality. Your adviser should confirm the correct basis and record it here.
Who we share it with
We do not sell your personal data, and we do not share it for marketing. We use a small number of service providers who process data on our behalf under written terms:
- Hosting provider — Serving this website and running the booking application. PLACEHOLDER — record the hosting provider (for example Vercel) and the region your data is served from once deployment is confirmed.
- Database provider — Storing booking requests and enquiries. PLACEHOLDER — record the managed PostgreSQL provider and region once provisioned.
- Transactional email provider — Sending booking acknowledgements and internal notifications. Resend is supported out of the box, sending from bookings@havohealphysiotherapy.co.uk. Record the provider actually configured and the data-processing terms you have accepted.
- Mailbox provider — Receiving and storing email sent to bookings@havohealphysiotherapy.co.uk. PLACEHOLDER — record the mailbox provider (for example Titan) and where mail is stored. This is separate from the transactional sending provider above.
- Analytics provider — Understanding which pages are useful. Analytics is disabled by default on this website. If it is switched on, a privacy-friendly, cookie-light provider is used and it only runs after you consent.
We may also disclose information where we are required to do so by law, or where it is necessary to protect someone’s vital interests.
How long we keep it
- Booking records: 7 years from the date of the appointment (placeholder — confirm with your adviser, taking healthcare record-keeping guidance into account).
- Contact form enquiries: 24 months from the date of your enquiry.
- Abuse-protection fingerprints: retained with the booking record and never used for any other purpose.
Retention periods are configurable in the application so they can be adjusted once your adviser has confirmed them.
Where your data is stored
Our database and hosting are provided by the suppliers listed above. Before launch we will confirm the storage region and, where any provider processes data outside the UK, the safeguards relied on (such as the UK International Data Transfer Addendum). This paragraph must be completed with the actual arrangements before the site goes live.
Your rights
Under UK GDPR you have the right to:
- Ask what personal data we hold about you and get a copy of it
- Ask us to correct information that is wrong or incomplete
- Ask us to delete your data, where there is no overriding reason to keep it
- Ask us to restrict how we use it, or object to our use of it
- Ask for your data in a portable format
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, contact us using the details above. We will respond within one month. Asking us to delete your booking data may mean we can no longer provide the appointment.
How to ask us to delete your data
Call or message +44 7469 334067, or email bookings@havohealphysiotherapy.co.uk, quoting your booking reference if you have one. We will confirm your identity, delete the records we are not required to keep, and confirm in writing what has been removed and what has been retained (and why).
Cookies
This website uses only the cookies it needs to function, plus optional analytics cookies that are never set unless you agree to them. See our Cookie Policy for the full list.
Security
The website is served over an encrypted connection, submissions are validated on the server, the booking form is rate limited and protected against automated abuse, and administrative access is restricted and requires authentication. Booking references are never placed in web addresses, so your booking details do not appear in browser history, referrer headers or server logs.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (opens in a new tab), whose helpline is 0303 123 1113.
Changes to this policy
We will update this page whenever our processing changes, and the “last updated” date at the top will change with it.