Privacy notice

Who we are

Klario Health provides physiotherapy and home-independence support to older adults in London. We decide how and why your information is used, which in data protection law makes us the “controller”.

• Registered with the Information Commissioner’s Office, registration number ZC099748
• HCPC-registered physiotherapist, registration number PH144190
• Email karam@klariohealth.co.uk

This notice covers two different people

Most of the time, the person who contacts us is not the person we are being asked about.

If you are a family member or friend — you get in touch, fill in the Check, or book a call about someone you care for. We hold your contact details, and we hold what you have told us about them.

If you are the older person being cared for — someone who cares about you may have contacted us before you knew about it, and told us things about how you are managing. This notice explains what we do with that, and what you can ask us to do.

Both of you have the same rights. Either of you can contact us.

What we collect

From the person who contacts us

Name, email address, phone number, postcode, your relationship to the person you are asking about, and anything you choose to write to us.

About the person being cared for

Their first name or how you refer to them, their approximate age, and information about how they are managing at home — mobility, balance, falls, stairs, washing and dressing, memory and confusion, recent hospital stays or operations, pain, medication, and what has changed recently.

This is health information. The law calls it “special category data” and gives it extra protection.

If we go on to see the person

A clinical record: assessment findings, measurements, the plan we agree, visit notes, progress over time, correspondence with their GP or other services, and payment records.

Technical information

Standard web server logs when you visit the site. What the site stores on your device is set out in our cookie notice.

Where we get it from

Most of it comes from you directly.

Some of it comes from someone else — specifically, when a family member tells us about a parent who has not yet spoken to us. We set out below how we handle that.

If we agree it with the person concerned, we may also receive information from their GP, hospital team, or another service involved in their care.

The Check

The Check is a set of questions on this website about how someone is managing at home. Your answers stay on your own device while you fill it in. Nothing reaches us unless you press send at the end. If you close the page without sending, we never see any of it.

If you do send it, the answers arrive in our email inbox and become the starting point of our record.

Telling someone that we hold information about them

If a family member gives us health information about you, the law requires us to tell you we have it. Here is how we do that.

We ask the person contacting us to let you know they are getting in touch. We also give you this notice ourselves — at or before the first time we speak to you, and in any case within one month of receiving the information, whichever comes first.

Until we have spoken to you, we use what we have been told only to decide whether we are the right service and to prepare for that first conversation. We do not contact your GP, share it with anyone else, or start any assessment without your involvement.

If you would rather we did not hold it, tell us. Unless we have a legal reason to keep it — for example a safeguarding concern about someone at risk — we will delete it and confirm that we have.

Why we use it, and our legal basis

To decide whether we can help, and to arrange a call. UK GDPR Article 6(1)(b) — steps taken at your request before entering a contract.

To assess, treat and support the person we are seeing, and to keep proper clinical records. Article 6(1)(b), and for health information Article 9(2)(h) — the provision of health or social care and treatment, read with Schedule 1, paragraph 2 of the Data Protection Act 2018.

We do not rely on consent for this. Consent can be withdrawn at any moment, and a clinician cannot lawfully delete a treatment record simply because they were asked to. Article 9(2)(h) is the honest basis, and it comes with a duty of confidentiality equivalent to any other health professional’s.

To share information with a GP or another service. We ask permission before we do this, and record that we asked. Article 6(1)(b) and Article 9(2)(h).

To raise a safeguarding concern about an adult at risk. Article 6(1)(c) or 6(1)(f), and Article 9(2)(b) or the substantial public interest condition at Schedule 1, paragraph 18 of the Data Protection Act 2018. We may do this without permission where someone is at risk of harm. It is rare, and we will normally tell the person first unless doing so would increase the risk.

To run the practice — invoicing, insurance, complaints, our own legal obligations. Article 6(1)(c) and 6(1)(f), and Article 9(2)(f) where health information is involved in a legal claim.

To send you information about our services. Only if you have asked us to. Article 6(1)(a) — consent. You can withdraw it at any time. Withdrawing it does not affect any care you receive.

Who we share it with

We do not sell information, and we do not share it for advertising.

• A GP, hospital team, or another service — where it is needed for someone’s care, with their agreement.
• A local authority safeguarding team or emergency services — where someone is at risk of serious harm.
• Suppliers who help us operate — website hosting, email, our booking system, clinical record keeping, and payments. Each is bound by a written contract that stops them using the information for their own purposes. Our booking calendar is provided by Cal.com, which you can see for yourself when you book.
• A regulator, insurer or court — where the law requires it.

Where a supplier stores or accesses information outside the UK, we rely on the safeguards permitted by UK data protection law — an adequacy decision, or the ICO’s International Data Transfer Agreement or Addendum.

How long we keep it

• Enquiries that do not lead to care — 12 months from your last contact, then deleted. Sooner if you ask.
• Clinical records for an adult we have seen — 8 years after the last contact, in line with the NHS Records Management Code of Practice. We cannot delete these earlier, even on request.
• Financial records — 6 years, as tax law requires.
• Marketing contacts — until you unsubscribe.

If we stop trading, clinical records are transferred to an appropriate custodian or securely destroyed once the retention period has passed. We will tell affected people before this happens.

Keeping it safe

Information is held in access-controlled systems, protected by strong authentication, and encrypted in transit and at rest. Only people who need to see a record can see it. We keep the number of systems small on purpose.

Your rights

You can ask us to:

• Confirm what we hold about you, and give you a copy
• Correct anything inaccurate or incomplete
• Delete it — though we cannot delete a clinical record before its retention period ends
• Stop or limit how we use it
• Give you a copy in a portable format
• Stop sending you marketing

Email karam@klariohealth.co.uk. We reply within one month, and we do not charge.

We may need to check who you are first. If you are asking on someone else’s behalf, we will need evidence that you are entitled to — a lasting power of attorney, or the person’s own confirmation.

Complaints

Tell us first. Email karam@klariohealth.co.uk and we will respond as quickly as we can.

If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.

Concerns about clinical practice can go to the Health and Care Professions Council at hcpc-uk.org.

Changes

We update this notice when what we do changes. The current version is always on this page, with the date it was last updated. If a change materially affects you, we will tell you before it takes effect.