Privacy Policy

Who we are

Monageer Physiotherapy Clinic Ltd ("the clinic", "we", "us") is the data controller for the personal information described in this policy.

What information we collect

To provide you with physiotherapy treatment, we collect: Personal details: name, date of birth, address, phone number, email address
Medical and clinical information: your medical history, subjective and objective assessment notes, rehabilitation plans, and any imaging or specialist reports sent to the clinic
Details of your appointments and any correspondence with the clinic

Why we collect it, and the legal basis for processing it

Treatment records: The main purpose of collecting your personal and medical information is to allow your physiotherapist to consider your full history and provide you with safe, appropriate treatment. Because this involves health data, it is "special category data" under Article 9 of the GDPR. We process it on the basis that it is necessary for the provision of health care by a health professional, under Article 9(2)(h) GDPR and Section 47 of the Data Protection Act 2018. We also use your contact details to send appointment reminders or to contact you in an emergency, which we do on the basis that it is necessary to perform our contract with you and to protect your vital interests. We do not rely on your consent as the legal basis for holding your clinical or contact records. This means that asking us to "withdraw consent" does not result in your treatment records being deleted or your reminders/contact stopped — we are professionally and legally required to keep accurate records (see How long we keep your data, below).

Anonymised research and audit: Where we use anonymised data for physiotherapy research, publication, conference presentation, or retrospective clinical audit, this is done in a way that no individual can be identified from it. Because no identifiable personal data is used for this purpose, no separate consent is required, but you are welcome to ask us more about this at any time.

Marketing: Where we send you marketing communications, we do so only with your consent, which you may withdraw at any time by contacting the practice in writing. Withdrawal of consent does not affect the lawfulness of anything done based on your earlier consent.

Confidentiality and access to your data

Your data is treated as strictly confidential. Only staff at Monageer Physiotherapy Clinic Ltd who need it to provide or support your care have access to your personal and clinical records, and all staff have received training in data protection law and practice. We do not share your data with any third party without your knowledge, we will let you know if we need to share your data in these cases:

  • If it is required to refer you for imaging, to a consultant, or to another healthcare provider involved in your care;

  • If it is required by law or to protect someone's vital interests;

How long we keep your data

We keep clinical and financial records for the following minimum periods, in line with professional and medico-legal record-keeping guidance for healthcare practitioners in Ireland:

  • Adult patients: at least 8 years from the date of your last appointment with the clinic.

  • Patients who were under 18 at the time of treatment: until their 25th birthday, or their 26th birthday if they were 17 years old at their last appointment.

After these periods, your records are securely deleted or fully anonymised, unless we are required to keep them for longer — for example, because of an ongoing complaint, claim, or legal proceedings, or because our professional indemnity insurer requires a longer period.

Where your data is stored

Your data is stored electronically, in encrypted form, using Cliniko practice management software. Cliniko acts as our data processor, and Monageer Physiotherapy Clinic Ltd remains the data controller responsible for your data.
Cliniko is an Australian company. It hosts EU customer data within EU-based data centres. You can ask us for more information about the safeguard used at any time.

Your rights

Under the GDPR and the Data Protection Act 2018, you have the right to:

  • Access the personal data we hold about you;

  • Rectification of inaccurate or incomplete data;

  • Erasure of your data in certain circumstances — note that this is limited for clinical records, which we are generally required to retain for the periods set out above, even if you ask us to delete them sooner;

  • Restriction of how we use your data in certain circumstances;

  • Object to processing carried out for certain purposes;

  • Data portability, where processing is based on consent or contract and carried out by automated means;

  • Not be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects (we do not currently carry out any such automated decision-making);

  • Withdraw consent at any time, where consent is the basis for processing (see above) — withdrawal will be as easy as giving consent, and will not affect the lawfulness of processing carried out before withdrawal;

  • Lodge a complaint with the Irish Data Protection Commission if you believe we have not handled your data properly. The DPC can be contacted at: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 www.dataprotection.ie

To exercise any of these rights, please contact the practice in writing using the details below.

Security

All data is encrypted and access is restricted to staff who require it to provide your care. Staff receive training in data protection law and practice.

Changes to this policy

We may update this policy from time to time.

CCTV

The clinic operates CCTV cameras covering the indoor waiting area and the clinic's own entrance/exterior. Cameras do not record audio except the doorbell camera for the purpose of the physiotherapist answering the door remotely to communicate with the person ringing the doorbell. The cameras are positioned so as not to capture public footpaths, roads, or neighbouring properties. Footage is used only for the protection of clinic property, the safety of staff and patients, and to control access to the premises, and is processed on the basis of our legitimate interests under Article 6(1)(f) GDPR. Given the sensitivity of a healthcare setting, we have carried out a data protection impact assessment for our CCTV system.

Footage is securely stored locally and access is restricted to authorised personnel only. Footage is retained for 30 days, after which it is securely deleted, unless a longer period is needed for a specific legitimate reason (for example, an ongoing incident investigation which may involve the Gardai).

Clearly visible signage is displayed inside and outside the clinic. You have the same rights over CCTV footage of you (including access) as set out under Your rights, above.

For any questions, feel free to get in touch:
Oleg Irlin
Monageer Physiotherapy Clinic Ltd
The Old School House
Monageer
Enniscorthy
Y21 A5D0
County Wexford
0896156110

Back To Main Page