Privacy and cookies notice

1. Introduction

Book a Physio is an online physiotherapy platform for adults in Ireland, operated by [entity name to be confirmed], a company registered in Ireland. We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Irish Data Protection Act 2018.

This notice explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have regarding your data.

What is actually live today is narrow, and worth stating plainly: this site is a set of information pages, a waitlist form, and optional analytics that load only if you agree to them. There are no accounts, no bookings, no payments and no health information yet. The sections below describe the platform as it will work when booking opens, because those are the terms that will apply then, and we would rather publish them for review now than write them in a hurry later.

2. Data controller

The data controller responsible for your personal data is:

We have not appointed a data protection officer. We are not required to and we do not have one, so we are not naming a role that does not exist. Data protection questions go to the email address above and are answered by a person.

3. What personal data we collect

3.1 Waitlist data, which is live today

If you join the waitlist we store your email address, the area of the body you said was bothering you if you chose one, whether you ticked the box for occasional updates, and the time you signed up. We use the address for exactly one purpose, to tell you when booking opens, and for updates only if you ticked that box. The box starts unticked and we do not tick it for you. To be removed, email us from that address and we will delete the row.

3.2 Account and profile data

Full name, email address, phone number, date of birth, and for physiotherapists: CORU registration number, qualifications, specialisms, and professional biography. Date of birth is collected because this service is for adults only and we enforce that rather than merely stating it.

Phone number. You need to give a phone number to create an account. We use it to contact you about your account or your sessions, as part of providing the service to you, and to reach you quickly if your health screening answers suggest you may need urgent care, which is in your vital interests and our legitimate interest in keeping patients safe. Only Book a Physio staff can see it; your physiotherapist cannot. We do not use it for marketing and we do not pass it to our video provider. If we begin using it for sign-in security, such as a code sent by text message, we will update this notice before we start. It is kept with your account data and deleted within 30 days of your account closing, unless the law requires us to keep it longer.

3.3 Health information

Booking details (scheduled date, time, physiotherapist chosen), session notes and the written plan your physiotherapist prepares for you, and documents you choose to upload to share with them, such as a previous report or a scan.

This is information about your own musculoskeletal problem and your own health, and it is special category data under Article 9 of the GDPR. We process it on the basis of your explicit consent, given at registration, at booking, and again whenever you choose to share something further. You can withdraw that consent, and section 9 explains how.

Documents you upload are stored securely and shared only with the physiotherapist you are working with, under the same access rules as the rest of your record. Please upload only what is relevant to your care.

3.4 Payment and billing data

Payment transaction records (amount, date, status) and Stripe customer identifiers. We do not store your credit or debit card numbers. All payment processing is handled by Stripe, which acts as an independent data controller for card data.

3.5 Technical data

IP address, browser type and version, device information, and pages visited. Some of this is processed by our host in order to serve pages at all. Analytics beyond that are optional and covered in section 11.

We keep a record of the transactional emails we send you, such as booking confirmations, including delivery status, so we can confirm messages were sent and troubleshoot delivery problems.

4. How we use your data

We use your personal data to tell you when booking opens if you asked us to, create and manage your account, facilitate bookings between patients and physiotherapists, process payments through Stripe, run video sessions through our video provider, send you the written plan after a session, communicate with you about your bookings and account, comply with legal obligations, improve the platform, and keep the service secure and prevent fraud.

5. Legal basis for processing

We process your personal data under the following legal bases as defined by Article 6 and Article 9 of the GDPR:

Contract (Article 6(1)(b)): processing necessary to provide our services, including account management, bookings, and payments.

Consent (Article 6(1)(a) and Article 9(2)(a)): for the processing of health information as special category data, for waitlist and marketing emails, and for non-essential analytics where you have opted in. You may withdraw consent at any time.

Legitimate interest (Article 6(1)(f)): for platform security, fraud prevention, service improvement, and contacting you about your safety.

Vital interests (Article 6(1)(d)): contacting you urgently if your screening answers suggest you may need emergency care.

Legal obligation (Article 6(1)(c)): where we are required to retain data for tax, accounting, or regulatory purposes.

6. Who else sees it

We share your personal data only with the following recipients, and only to the extent necessary:

• Supabase (database hosting), which stores waitlist entries and, when booking opens, account and booking data. Our projects are in Supabase's EU region.
• Stripe (payment processing), which processes payment card details and transaction data as an independent controller for card data.
• Resend (transactional email), which processes email addresses to deliver booking confirmations and the one waitlist email.
• Our video provider (video sessions), which processes video and audio during a session. It receives an opaque identifier for each person in the call, never your name or email address.
• Google Analytics (GA4), only if you consent to it, and only for aggregated site usage. Nothing Google-related loads at all until you agree.
• Microsoft Clarity, only if you consent to it, and only on the public information pages. It records how those pages are used and can replay a visit as a recording. Nothing from Microsoft loads at all until you agree.
• Vercel (hosting), which processes the technical request data any web host does, such as IP addresses, in order to serve pages, and, only if you consent to it, counts page views through Vercel Web Analytics.

Your physiotherapist can see your clinical record from when your booking is confirmed until 30 days after your last session with them, and again whenever you book with them. A physiotherapist you book later can see notes written by physiotherapists you saw before on the platform.

Each time a member of our staff opens a patient record, it is logged with the reason.

[entity name to be confirmed] does not sell, rent, or trade your personal data. There is no advertising on this site and no advertising or conversion tracking of any kind.

7. International data transfers

Some of our service providers, including Stripe, Google, Microsoft and Vercel, may process data outside the European Economic Area. Where this occurs we rely on the safeguards available under GDPR, including European Commission adequacy decisions, EU-approved Standard Contractual Clauses, and where applicable the EU-US Data Privacy Framework. Our database is hosted in the EU. Live video and audio may be routed through servers outside the European Economic Area by our video provider.

8. Data retention and account closure

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Waitlist entries: until booking opens and the one email has been sent, or until you ask to be removed, whichever comes first.
• Account data: for the duration of your account and deleted within 30 days of account closure, unless legal retention obligations apply.
• Booking and session data: 7 years, to comply with Irish tax and accounting obligations.
• Payment records: 7 years, as required by Irish Revenue regulations.
• Technical logs: up to 12 months, for security and troubleshooting.
• Clinical records: Book a Physio holds clinical records for 8 years after your last consultation, or 8 years after death.
• Uploaded documents: for as long as needed for your care and your account, then deleted, subject to legal retention obligations.

You have the right to request access to, correction of, or deletion of your personal data at any time by contacting hello@bookaphysio.ie. An erasure request removes your account details (your name, email address, contact details and marketing consent) and keeps the clinical record for the retention period above, as the law allows for health care records and for legal claims. We will respond within 30 days.

9. Your rights under GDPR

Under the GDPR you have the following rights:

• Right of access (Article 15): you may request a copy of the personal data we hold about you.
• Right to rectification (Article 16): you may request correction of inaccurate or incomplete data.
• Right to erasure (Article 17): you may request deletion of your data, subject to legal retention requirements.
• Right to restrict processing (Article 18): you may request that we limit how we use your data.
• Right to data portability (Article 20): you may request your data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): you may object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@bookaphysio.ie. We will respond within 30 days. Today, unless you have joined the waitlist or opted into analytics, the honest answer to most such requests is that there is nothing to return.

You also have the right to lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie.

10. Data security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit, row-level security policies on database tables, secure authentication and session management, secrets held outside the codebase and never exposed to the browser, and regular review of access controls.

While we take all reasonable steps to protect your data, no method of electronic transmission or storage is completely secure and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials and for any activity that occurs under your account.

11. Cookies and analytics

The site sets no cookies of its own. There are no advertising cookies.

If you say yes to the banner, Google Analytics records how pages are used: which pages are opened, roughly where in the world the visit came from, and what kind of device it was. We have IP anonymisation switched on, and advertising and personalisation signals switched off. If you say no, none of it loads at all: the scripts are not on the page, not merely inactive.

A yes also loads Vercel Web Analytics, from our host Vercel, on any page. It records the page opened, with booking and profile identifiers removed and without the query string, the site that linked to it, the kind of browser, operating system and device, and an approximate location, as close as the city. It counts visitors with a value derived from the request, which Vercel discards after 24 hours, and it sets no cookies. Like Google Analytics, it does not load at all unless you say yes.

The same yes also loads Microsoft Clarity, a Microsoft service, on the public information pages only: the home page, the guides, resources, conditions and author pages, physiotherapist profiles, and the legal pages. It records how those pages are used, including scrolling, clicks and other interactions, and produces heatmaps and session recordings, which means it can replay a visit as a recording. It never loads on account, booking or clinical pages. Anything typed into a form, and the text on the page, is masked before a recording leaves your browser. Like Google Analytics it does not load at all unless you say yes. After a yes it sets its own first-party cookies on this site, so it can recognise a returning visit.

Your answer to the banner is kept in your browser's local storage, not in a cookie, so it is never sent to us with a request. It is there only so we stop asking. Clearing your browser data clears it.

You can change or withdraw your answer at any time using the control at the bottom of this page. Withdrawing reloads the page, because clearing the stored answer alone would not stop a script that is already running in the tab.

When booking opens, the platform will also need cookies that are strictly necessary to keep you signed in. Those do not require consent, and this section will be updated to describe them when they exist.

12. Adults only

This service is for adults. Patients must be 18 or over and booking for themselves. We do not offer physiotherapy to children through this platform, and there is no parent or guardian route: you cannot book a session here for someone else.

We collect date of birth at sign-up so this is enforced rather than assumed, and where we find a booking has been made by or for someone under 18 we cancel it and refund it in full. We do not knowingly collect personal data about children. If you believe we hold data about a child, tell us and we will delete it.

13. Physiotherapist data

Physiotherapists who join the platform provide their name, CORU registration number, qualifications, specialisms, biography and profile image. Their name, specialisms, biography and profile image are displayed publicly so that patients can choose who to see. Their registration number is not displayed publicly; we verify it against the CORU register, and it appears on the receipt of a patient who has paid for a session with them.

We also hold their professional indemnity insurance certificate and its expiry date, in order to verify cover, their qualification document, and records of the verification checks we carried out. We keep every copy of a document a physiotherapist has supplied, not only the latest. We hold a postal address for each physiotherapist, for formal notices and for our records; it is never published and never given to a patient. On termination of an account, profile information is removed from the platform within 30 days, or sooner on request to hello@bookaphysio.ie.

14. Marketing and anonymised data

Marketing communications go only to people who have given explicit consent, and the consent box always starts unticked. You can withdraw at any time using the unsubscribe link in any such email, or by emailing hello@bookaphysio.ie. Withdrawing marketing consent does not affect transactional messages about your bookings and account, which are part of providing the service.

We may use anonymised and aggregated data, which does not identify any individual, for service improvement. We do not publish anything about an individual without their explicit consent.

15. Changes to this notice

We may update this notice to reflect changes in our practices, technology, or legal requirements. When we make material changes we will notify account holders by email or by a prominent notice on the platform. This notice will be replaced in full, and reviewed by a solicitor, before the first booking is taken.

16. Contact us

If you have any questions, concerns, or requests regarding this notice or your personal data, please contact:

You may also contact the Irish Data Protection Commission at www.dataprotection.ie.