OptiMoveTherapy Privacy Notice
Privacy notice for website and online booking
This privacy notice explains how OptiMoveTherapy collects, uses, stores and shares personal information about people who visit our website, contact us, enquire about or book appointments, and receive treatment.
Contents — click a section to jump to it
1. Who we are and how to contact us
2. What information we collect
3. Where information comes from
4. Why we use information and our lawful bases
We use personal information where we have a lawful basis under UK data protection law. The lawful basis may differ depending on why we are using the information.
For ordinary personal information, we may rely on legitimate interests under Article 6(1)(f) where this is necessary to run the clinic, manage appointments and provide our services, and those interests are not overridden by your rights and freedoms. We will assess this for each purpose.
We may also rely on taking steps at your request before entering into an agreement, performing our agreement with you, or complying with a legal obligation, where those bases apply.
Clinical records contain health information, which is special-category personal data. Article 6 legitimate interests alone is not sufficient: a separate Article 9 condition must also apply. The ICO identifies health or social care under Article 9(2)(h) as a possible condition, but it has additional requirements, including the relevant UK legal basis and professional-secrecy safeguards. We have not yet verified that OptiMoveTherapy meets those requirements, so we will not state that this condition applies until it has been checked.
5. Who we share information with
6. Storage, security and transfers
7. How long we keep information
8. Your data protection rights
You have data-protection rights in relation to the personal information we hold about you. These rights are subject to legal conditions and exemptions, so they may not apply in every situation.
Your right of access — You can ask for a copy of your personal information and, subject to exemptions, details about where we obtained it and who we share it with. Read more about the right of access
Your right to rectification — You can ask us to correct or complete personal information you believe is inaccurate or incomplete. Read more about the right to rectification
Your right to erasure — You can ask us to delete your personal information. This right is not absolute; we may need to retain clinical records where a legal, professional or insurance requirement applies. Read more about the right to erasure
Your right to restriction of processing — You can ask us to limit how we use your personal information in certain circumstances. Read more about the right to restriction of processing
Your right to object — You can object to certain processing, including processing based on legitimate interests. Whether the right applies depends on the circumstances. Read more about the right to object
Your right to data portability — In certain circumstances, you can ask us to provide personal information you gave us in a structured, commonly used, machine-readable format or transfer it to another organisation. Read more about the right to data portability
To exercise a right, contact us using the details in section 1. We will respond within the applicable legal timeframe, usually one month. We may need to verify your identity before responding.
9. Cookies and website technologies
1. Who we are and how to contact us
Noeh Khalifa trading as OptiMoveTherapy is a sports therapy clinic based in Chesterfield, England. Noeh Khalifa trading as OptiMoveTherapy is the data controller responsible for deciding how personal information is used for the clinic.
Business address: 64 Jaw Bones Hill, Chesterfield, Derbyshire, S40 2EN
Email: optimovetherapy@gmail.com
Telephone: 07369 912665
2. What information we collect
Depending on how you interact with us, we may collect:
Contact and identity details, such as your name, email address, telephone number and other details you provide.
Appointment and service information, including bookings, appointment history, attendance and communications about appointments.
Health information relevant to treatment, such as injury history, symptoms, assessment findings, treatment notes, contraindications, consent and rehabilitation information.
Payment and transaction information needed to take and account for payments. Card payment details are handled through the relevant payment provider.
Information you send through website forms, email, telephone, social media or other direct communications.
Website technical information, including cookies or analytics information, if those tools are enabled.
We may collect information about clients under 18. Where a client is under 18, we involve a parent or guardian as appropriate when collecting information and completing relevant rehabilitation and clinical records.
3. Where information comes from
We usually receive information directly from you through booking systems, consultation and consent forms, website enquiry forms, email, telephone or other communications. Where relevant, we may also receive information from a parent or guardian, or from a person or organisation involved in a referral or your care, where this is appropriate and lawful.
4. Why we use information and our lawful bases
We use personal information only where we have a lawful basis under UK data protection law. The lawful basis depends on the purpose for which the information is used.
For ordinary personal information, we rely on the following lawful bases where they apply:
• Contract (Article 6(1)(b)): to manage your booking and take steps at your request before providing an appointment or treatment.
• Legitimate interests (Article 6(1)(f)): to respond to enquiries, administer and operate the clinic, manage appointments, maintain appropriate business records and manage our services, where our interests are not overridden by your rights and freedoms.
• Legal obligation (Article 6(1)(c)): where we need to keep or disclose information to comply with a legal requirement.
• Consent (Article 6(1)(a)): where we ask for your permission for a specific use, such as marketing where consent is required.
Clinical records include health information, which is special-category personal data. In addition to an Article 6 lawful basis, we need a separate condition under Article 9 of the UK GDPR. For this notice, OptiMoveTherapy relies on your explicit consent under Article 9(2)(a) to collect and use health information for assessment, treatment, rehabilitation and related clinical record-keeping.
We ask you to provide this explicit consent separately and clearly as part of our client consent process. You can withdraw that consent at any time by contacting us. Withdrawal does not affect processing carried out before you withdrew consent. If you withdraw consent, we may be unable to provide or continue treatment that requires us to use your health information. We may retain information where another lawful basis or legal requirement permits or requires us to do so.
Consent to receive treatment is separate from consent to process personal data. We explain these separately in our client documentation.
5. Who we share information with
We share information only where needed for the purposes described in this notice, where required by law, or where otherwise appropriate and lawful. Our systems and recipients currently include:
Rehab Guru — used to manage appointments and store client personal details, consent forms, clinical/treatment notes and rehabilitation information.
Stripe — used to process card and online payments.
Squarespace — hosts our website and may receive information submitted through website contact forms.
Gmail — used for business email and communications.
Relevant practitioners working within OptiMoveTherapy may access shared client records in Rehab Guru where needed to provide or coordinate care and carry out their role. Access should be limited to appropriate purposes.
6. Storage, security and transfers
Clinical information, consent forms and injury documentation are stored in Rehab Guru. We take appropriate steps to protect personal information against unauthorised access, loss, alteration or disclosure, and access should be limited to people who need the information for their role.
Some service providers may store or process information outside the United Kingdom. Where this occurs, applicable data protection requirements and safeguards must be met.
7. How long we keep information
We keep personal information only for as long as necessary to meet the purpose for which it was collected and any relevant professional, insurance, legal or accounting requirements.
Clinical records for adult clients aged 18 and over are retained for eight years from the date of their last treatment. Clinical records for clients under 18 are retained until their 25th birthday. After the applicable retention period, identifiable records are securely deleted or destroyed, unless there is a lawful reason to retain them for longer.
Other information, such as website enquiries, payment/accounting records and marketing sign-up details, may be kept for different periods depending on the relevant purpose and legal requirements.
8. Your data protection rights
You have data-protection rights in relation to the personal information we hold about you. These rights are subject to legal conditions and exemptions, so they may not apply in every situation.
Your right of access — You can ask for a copy of your personal information. You can also ask for details about where we obtained it and who we share it with, subject to applicable exemptions. Read more about the right of access
Your right to rectification — You can ask us to correct or complete personal information you believe is inaccurate or incomplete. Read more about the right to rectification
Your right to erasure — You can ask us to delete your personal information. This right is not absolute; we may need to retain clinical records where a legal, professional, insurance or other lawful requirement applies. Read more about the right to erasure
Your right to restriction of processing — You can ask us to limit how we use your personal information in certain circumstances. Read more about the right to restriction of processing
Your right to object — You can object to certain processing, including processing based on legitimate interests. Whether the right applies depends on the circumstances. Read more about the right to object
Your right to data portability — In certain circumstances, you can ask us to provide personal information you gave us in a structured, commonly used, machine-readable format or transfer it to another organisation. Read more about the right to data portability
You may also withdraw consent where we rely on consent to process your information. To exercise a right, contact us using the details in section 1. We will respond within the applicable legal timeframe, usually one month. We may need to verify your identity before responding.
9. Cookies and website technologies
Our website is hosted by Squarespace. The website uses cookies and similar technologies needed for its basic operation. We also use Google Analytics to understand how visitors use our website, such as which pages are visited and how visitors interact with the site.
Google Analytics uses cookies or similar technologies for analytics. These are not strictly necessary for the website to function. We will only allow Google Analytics cookies or similar non-essential tracking technologies to operate after you have actively given consent through the website's cookie settings.
You should be able to accept or reject non-essential cookies and change your preferences using the cookie settings on our website. You can also manage cookies through your browser settings, although blocking essential cookies may affect website functionality.
Google may process information collected through Google Analytics on our behalf or for its own purposes, depending on the service configuration. Please also refer to Google's privacy information for further details.
10. Marketing communications
We may send promotional messages to people who sign up through our Meta advertising forms, in line with the permission and preferences collected at sign-up and applicable marketing rules. Marketing messages include instructions for opting out; where a message asks you to reply STOP, you can use that method to stop further marketing messages. Appointment-related messages, such as booking confirmations, are different from marketing.
11. Complaints
If you have concerns about how we handle your personal information, please contact us first using the details in section 1 so we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office (ICO).
ICO website: https://ico.org.uk/make-a-complaint/
ICO helpline: 0303 123 1113
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Updates to this notice
We may update this notice when our services, systems or legal requirements change. The latest version will be published on our website with its updated date.
Last updated: 5 November 2026