top of page

Privacy Policy

Last updated: 18 August 2026
 

1. Who we are

The Physio Ward Limited is the controller of your personal data.

Our contact details are:

  • Email: info@thephysioward.com

  • Telephone: +353 1 687 0302

  • Address: Unit 4, Delvin Court, Stamullen, Co. Meath, Ireland

Please contact us using these details if you have a privacy question or wish to exercise any of your data-protection rights.
 

2. What this notice covers

This Privacy Notice explains how we collect, use, store, share and protect personal information when you:

  • Visit our website;

  • Contact us;

  • Make, manage or cancel an appointment;

  • Receive physiotherapy or related services from us;

  • Complete an intake, consent or clinical form;

  • Communicate with us by email, SMS, telephone or website message;

  • Use our online booking or patient services; or

  • Otherwise interact with The Physio Ward.

Health information is treated with particular care. It is special category personal data under data-protection law and is subject to additional protections.
 

3. The information we collect

Depending on how you interact with us and the care you receive, we may collect:

  • Your name, date of birth, sex, address, email address and telephone number;

  • Emergency contact, next-of-kin, guardian and family information where relevant;

  • Appointment, attendance, cancellation and booking information;

  • Referral source information, including how you heard about us;

  • Health-insurance and billing information;

  • Clinical information, including symptoms, injuries, medical history, medications, assessments, treatment plans, progress notes, exercise programmes, reports and correspondence with other healthcare professionals;

  • Information contained in forms, questionnaires and consent records;

  • Communications with us, including emails, SMS messages, website enquiries and attachments;

  • Payment status, invoice information and transaction references. We do not store full card numbers or CVV details;

  • Audio recordings and transcripts where our optional clinical transcription service is used;

  • Technical and security information required to operate, protect and troubleshoot our website and systems;

  • Limited operational information about the use of our booking and practice-management services; and

  • Website analytics and advertising information where the relevant technologies are used in accordance with your cookie choices.

Please avoid sending sensitive clinical or payment information through ordinary email or SMS unless we have asked you to do so.
 

4. How we collect information

We collect information directly from you when you:

  • Book or manage an appointment;

  • Complete a form;

  • Attend an appointment;

  • Make a payment;

  • Contact us;

  • Use our website or online services; or

  • Otherwise provide information to us.

We may also receive relevant information from:

  • Your parent or guardian, where appropriate;

  • Other healthcare professionals involved in your care;

  • Your GP, consultant or referring professional;

  • Insurers or other organisations you ask us to deal with;

  • Booking, payment and communication providers acting on our behalf; and

  • Website, analytics and advertising services where applicable and permitted by your cookie choices.

If you give us another person's details, such as an emergency contact, please make sure they know that you have done so.
 

5. Why we use your information

We use personal and health information to:

  • Arrange, deliver and manage your physiotherapy care;

  • Assess your condition and support your treatment;

  • Maintain accurate and appropriate clinical records;

  • Manage appointments and our booking system;

  • Communicate with you about appointments, care, payments and service updates;

  • Prepare clinical notes, reports, exercise plans and correspondence;

  • Coordinate care with other healthcare professionals where appropriate;

  • Process payments, invoices and insurance-related administration;

  • Respond to enquiries and requests;

  • Protect the safety, security, reliability and continuity of our services;

  • Operate and improve our booking and administrative processes;

  • Understand aggregated or non-clinical service performance;

  • Understand website traffic and advertising performance where you have provided the required cookie consent;

  • Meet legal, professional, regulatory, insurance, tax and record-keeping obligations;

  • Establish, exercise or defend legal claims where necessary; and

  • Send marketing communications where permitted by law and in line with your preferences.
     

6. Our legal bases for processing

We process ordinary personal data under one or more of the following legal bases.

Contract and steps before entering into a contract

We process information where it is necessary to arrange and provide services that you have requested, including appointments, treatment, payments and related administration.

Legal obligations

We process information where necessary to comply with legal, regulatory, professional, tax, insurance and record-keeping obligations.

Legitimate interests

We may process information where necessary for our legitimate interests in operating a secure, efficient and well-managed healthcare practice, provided those interests do not override your rights and interests.

These legitimate interests may include:

  • Managing our practice and services;

  • Protecting our systems and information;

  • Preventing misuse or fraud;

  • Troubleshooting technical problems;

  • Maintaining appropriate business and administrative records; and

  • Understanding and improving non-clinical operational performance.

Consent

We use consent where this is the appropriate legal basis, including for certain marketing activities, optional website analytics or advertising technologies and specific optional clinical activities.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawfully carried out before consent was withdrawn.

Health information is special category personal data.

We process health information where this is necessary for the provision and management of healthcare and where it is handled by, or under the responsibility of, professionals subject to duties of confidentiality. This includes processing under Article 9(2)(h) of the GDPR where applicable.

For certain activities we may instead rely on your explicit consent, including where explicit consent is appropriate for a particular disclosure or optional service.
 

7. Information we need from you

Certain information is necessary for us to arrange and provide physiotherapy services, maintain appropriate clinical records, communicate with you and process payments.

This may include your contact information and relevant health information.

If you do not provide information that is necessary for these purposes, we may be unable to provide some or all of our services safely or effectively.

Information identified as optional does not have to be provided.

You can also refuse or withdraw consent for optional marketing or analytics activities without affecting your access to physiotherapy care.
 

8. Ester, clinical records, transcription and AI-assisted drafting

We use Ester, provided by Ester Labs Limited, as our practice-management and clinical administration system.

Ester may be used to manage:

  • Patient records;

  • Appointments and bookings;

  • Intake and clinical forms;

  • Clinical documentation;

  • Exercise and rehabilitation information;

  • Communications;

  • Invoices and payment administration; and

  • Other practice-management functions.

Where enabled by the clinician, Ester may also provide:

  • Audio transcription to assist with creating a written record of a consultation; and

  • AI-assisted drafts of clinical notes, letters, reports, summaries, exercise plans or patient communications.

Where consultation audio is recorded for transcription, we obtain your explicit consent before recording.

These tools support our healthcare team. They do not replace professional judgement.

A qualified clinician remains responsible for reviewing, correcting and approving clinical records, communications and care decisions.

We do not use automated systems to make solely automated decisions about your diagnosis, treatment or access to physiotherapy care.

Clinical content is not used for advertising, Google Ads or marketing profiling.

We take steps to ensure that clinical notes, consultation audio and clinical form answers are not sent to website advertising or marketing analytics services.
 

9. Operational analytics and technical monitoring

Our systems may process limited technical and operational information where necessary to operate, secure, troubleshoot and improve our services.

This may include information such as:

  • Login and session activity;

  • System events and error logs;

  • Security information;

  • Feature or workflow usage;

  • Booking-process events;

  • Device or browser information where technically necessary; and

  • Aggregated service-performance information.

We use data minimisation when carrying out operational monitoring.

Operational monitoring and website marketing analytics are kept separate from clinical content wherever possible.
 

10. Who we share information with

We share personal information only where it is necessary, lawful and proportionate.

This may include:

  • Members of The Physio Ward team involved in your care or administration;

  • Other healthcare professionals involved in your care where appropriate;

  • Your GP, consultant or referring professional where appropriate;

  • Insurers, solicitors or other organisations where you ask us to share information, where this is necessary in connection with your care or a legal claim, or where required by law;

  • Ester Labs Limited, which provides Ester and related practice-management and technical services;

  • Transcription and AI service providers used through Ester where the relevant optional feature is used;

  • Google Workspace for email and related business communications;

  • Twilio for SMS and communication services;

  • Stripe for secure online payment processing;

  • Wix for hosting and operating our public website and website enquiry facilities;

  • Google Analytics and Google Ads where the relevant technologies are used in accordance with your cookie choices;

  • Secure hosting, backup, security, infrastructure and technical-support providers acting on our behalf;

  • Professional advisers such as accountants, insurers and legal advisers where necessary; and

  • Regulators, law-enforcement bodies, courts or other authorities where disclosure is required or permitted by law.

Where a service provider processes personal information on our behalf, we require appropriate data-protection arrangements to be in place.

We do not sell your personal information.
 

11. International transfers

Some of the service providers we use may process personal data outside Ireland or the European Economic Area.

Where personal data is transferred outside the European Economic Area, we take steps to ensure that an appropriate legal transfer mechanism and safeguards are in place.

Depending on the circumstances, these may include:

  • A European Commission adequacy decision;

  • Standard Contractual Clauses;

  • Additional contractual or technical safeguards; or

  • Another transfer mechanism permitted under data-protection law.

You may contact us if you would like further information about the safeguards relevant to your personal information.
 

12. Security

We use appropriate technical and organisational measures to protect personal information against accidental or unlawful loss, alteration, disclosure, misuse or unauthorised access.

Depending on the system and information involved, these measures may include:

  • Individual user accounts;

  • Access controls based on user responsibilities;

  • Authentication and session-security measures;

  • Encryption in transit;

  • Secure handling of system credentials and integrations;

  • Backup and recovery measures;

  • Logging and security monitoring;

  • Restrictions on access to clinical information; and

  • Data-minimisation practices.

Access to personal and clinical information is limited to people and providers who require it for an appropriate purpose.

No system can be guaranteed to be completely secure, but we continually take reasonable steps to protect the confidentiality, integrity and availability of the information entrusted to us.
 

13. How long we keep information

We keep personal information only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal, clinical, professional, insurance, tax, patient-safety and operational requirements.

Retention periods depend on the type of information involved and the circumstances in which it was collected.

In particular:

  • Clinical records are retained for an appropriate period having regard to clinical, legal, professional, insurance and patient-safety requirements;

  • Financial, invoice and payment records are retained for the period required under applicable accounting and tax obligations;

  • Booking information, forms and communications are retained where needed for care, administration, safeguarding, complaint handling, dispute resolution or legal obligations;

  • Audio and transcription information is retained only for as long as necessary for the relevant clinical and operational purpose;

  • Aggregated or anonymised service-performance information may be retained for longer where it no longer identifies an individual; and

  • Security and technical records are retained only for as long as reasonably necessary for security, troubleshooting and operational purposes.

We may retain information for longer where necessary to establish, exercise or defend legal claims or where we are legally required to do so.
 

14. Website cookies, Google Analytics and advertising

Our Wix website uses essential technologies that are necessary for the website to operate securely and correctly.

We also use Google Tag Manager to manage website tags and consent-related configurations.

Subject to your cookie choices, we may use:

  • Google Analytics 4 (GA4) to understand how visitors use our website and booking journey; and

  • Google Ads technologies to understand advertising performance and whether advertising leads to relevant website or booking activity.

These technologies may process information such as:

  • Page views;

  • Website interactions;

  • Referral or traffic source;

  • General device and browser information;

  • Approximate location derived from technical information;

  • Advertising or analytics identifiers where permitted; and

  • Booking-funnel or conversion events.

We configure these services to avoid sending clinical notes, medical information, consultation audio or clinical form answers to Google Analytics or Google Ads.

Non-essential analytics or advertising cookies and similar technologies are not stored or accessed on your device unless the required consent has been provided.

You can accept, reject or change your optional cookie choices through the cookie controls available on our website.

Rejecting optional analytics or advertising cookies will not prevent you from accessing our physiotherapy services.
 

15. Marketing

We may send marketing communications only where permitted by law and in line with your communication preferences.

Marketing may include information about services, offers or relevant updates from The Physio Ward.

You can opt out of marketing emails or SMS messages at any time by:

Opting out of marketing will not prevent us from sending essential communications about your appointments, care, payments, account or important service changes.
 

16. Children and young people

We process children's and young people's information where necessary to arrange and provide appropriate care.

A parent or guardian may provide information or act on behalf of a child where legally appropriate.

Children and young people also have their own data-protection rights, and the way these rights are exercised may depend on their age, understanding and circumstances.

We take particular care when processing children's health and personal information.

Please contact us if you have any questions about how we handle information relating to a child or young person.
 

17. Your data-protection rights

Subject to applicable law and any relevant restrictions, you may have the right to:

  • Request access to your personal information;

  • Ask us to correct inaccurate or incomplete information;

  • Request deletion of your information in certain circumstances;

  • Ask us to restrict the way we process your information;

  • Object to certain processing;

  • Request portability of information you have provided to us where applicable;

  • Withdraw consent where our processing relies on consent; and

  • Make a complaint to the Irish Data Protection Commission.

Some of these rights are not absolute.

For example, we may need to continue retaining clinical information where this is necessary for legal, professional, insurance, patient-safety or other lawful reasons.

To exercise a right or make a privacy request, contact:

Email: info@thephysioward.com

We may need to take reasonable steps to verify your identity before responding to a request.

You can also contact the Irish Data Protection Commission through www.dataprotection.ie.
 

18. Changes to this Privacy Notice

We may update this Privacy Notice from time to time where our services, systems, providers, legal obligations or data-processing practices change.

The most recent version will be made available on our website and the Last updated date at the top of this notice will be changed accordingly.
 

The Physio Ward logo

© 2026 by The Physio Ward.

bottom of page