Privacy Policy

Sykes Performance Group – Privacy Notice & Data Protection Policy

Most recent update: 29/10/2025
Contact for data‑protection queries: info@sykesperformancegroup.com

1. Introduction

Sykes Performance Group (“we”, “us”, “our”) is committed to protecting the confidentiality, security and integrity of personal and health information we hold about our clients, patients and practitioners. This notice explains how we collect, use, store and share your data, and your rights in relation to it.

2. What Information We Collect

We collect and process the following types of personal data:

Personal identifiers and contact details: name, date of birth, mobile number, email address, home address.
Health, medical and treatment‐related information: medical history, assessment notes, treatment plans, session notes.
Billing and payment information: any data needed to manage invoicing, payments and refunds.
Communication data: emails, text messages or other messages relating to appointments, bookings or treatment.
Booking & intake form information: information you provide when booking online or completing intake forms.
Referral information: details when other clinicians refer you to us (or we of course refer you).

3. How We Collect the Data

Via our online booking/intake forms when you book treatment.
During treatment sessions when practitioners take notes.
Via phone or email communications you initiate (or we send) for appointment management.
When other clinicians refer patients to us (or we refer them).

4. How We Use the Data

We use your information for these purposes:

To provide and manage your physiotherapy, sports massage, podiatry or dietetic treatment.
To manage appointments, bookings, reminders and communications about sessions.
To handle billing, payments, insurance where applicable and internal bookkeeping.
For quality assurance, audits and clinical governance (including internal review of treatment outcomes).
We do not use your personal email or mobile for marketing or promotional purposes without your explicit consent.

5. Who We Share Your Information With

We may disclose your information to:

Our internal administration staff and authorised clinicians working within Sykes Performance Group.
Other healthcare professionals involved in your care, only as needed and always under confidentiality.
Insurance or payment providers when required.
IT and software providers who support our electronic record‑system (see Section 6).
We will not sell your data to third‑parties or use it for any purpose outside those listed without your explicit consent.

6. Data Storage & Security

All records are stored electronically using the system “Cliniko”. We do not retain paper records in general. If any paper records are sent to us, they are scanned/uploaded and then the original physical copy is destroyed securely.
Access to electronic records is restricted to authorised staff only, protected by passwords and encryption as appropriate, to maintain confidentiality and integrity.
We implement appropriate technical and organisational measures to protect your data from unauthorised access, loss or destruction.

7. Retention of Records

In accordance with guidance from professional and regulatory bodies, we retain patient treatment records as follows:

For adult clients: records will be kept for at least eight (8) years after the conclusion of treatment or the last date of contact. theddu.com+3csp.org.uk+3lboro.ac.uk+3
For clients under the age of 18 at the conclusion of their treatment: records will be kept until the client’s 25th birthday (or if they were 17 at the end of treatment, until their 26th birthday) or eight years after death, whichever is sooner. BMA+1
In some cases where there is likely to be long‑term relevance (for example litigation, serious incident, or specific professional obligations) we may retain records for a longer period, in which case we will review retention in light of professional guidance.
When the applicable retention period expires, records will be securely disposed of or archived in accordance with our data‑destruction policy.

8. Your Rights

You have the following rights in relation to your personal data:

The right to access the personal information we hold about you (commonly known as a Subject Access Request).
The right to request correction of inaccurate or incomplete data (the correction will be documented).
The right to request erasure or restriction of processing in certain circumstances.
The right to object to processing (where applicable).
The right to withdraw consent where we rely on your consent for processing.
If you wish to exercise any of these rights, you may email us at info@sykesperformancegroup.com and we will respond in accordance with applicable law.

9. Cookies & Website Tracking

We do not use cookies or any tracking technologies on our website that process personal health or client data. Our online booking system uses secure forms; no third‑party tracking cookies are used for analytics or marketing.
If this changes, we will update this notice accordingly.

10. Updates to this Policy

We may update this privacy notice from time to time. The latest version will always be available on our website. You are encouraged to check the policy periodically to stay informed about how we are protecting your data.

11. Lawful Basis & Legal Obligations

We process your data on the basis of it being necessary for the performance of our contract with you (i.e., provision of treatment), for compliance with our legal obligations, and for the purposes of our legitimate interests (e.g., quality assurance) where those interests do not override your rights.
We are also bound by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

12. Contact us & Complaints

If you have any questions about how we handle your data, you can contact us at:
Email: info@sykesperformancegroup.com
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) — their website is ico.org.uk.