Privacy policy
Last updated: 29 August 2026
This privacy policy explains how In Motion Rehab Limited collects, uses, stores and protects your personal information when you use this website, contact the practice or receive services from In Motion Rehab.
Who I am
In Motion Rehab Limited is the data controller responsible for your personal information. The company is registered in England and Wales under company number 11968684, with its registered office at 44 Rosemont Road, London, NW3 6NE.
Services are provided by me, Alistair McKinley, a registered osteopath (GOsC registration number 12219) and personal trainer, practising as the sole practitioner of In Motion Rehab.
If you have any questions about this policy or about how your information is handled, contact me at inmotionrehab1@gmail.com
What information I collect:
If you contact me through the website
When you submit an enquiry form, I collect your name, email address, telephone number if you provide one, and whatever you choose to write in your message.
Please don't include detailed medical information in the enquiry form. A general description of what you would like help with is enough at this stage, and we can discuss the details properly once an appointment has been arranged.
If you become a patient or client
To provide osteopathy, rehabilitation, clinical sports massage or personal training, I may collect and record information including:
-
Your name, date of birth, address, telephone number and email address
-
Your GP's details, where relevant
-
A case history, including your presenting complaint, symptoms, past medical history, current medication and relevant lifestyle information
-
Relevant information about your work, activities, exercise or training
-
Examination and assessment findings
-
Diagnosis or clinical impressions, where relevant
-
Treatment provided and clinical reasoning
-
Advice, rehabilitation exercises or training programmes provided
-
Records of appointments and payments
-
Relevant correspondence between us
-
Relevant correspondence with other healthcare professionals, where appropriate
Health information is classed as special category data under UK data protection law and receives additional protection. It is only collected where it is relevant to providing your care, rehabilitation or training safely and appropriately.
Information received from other healthcare professionals
Where appropriate, I may receive information about you from another healthcare professional, such as your GP, consultant, physiotherapist or other treating clinician.
This might include referral information, imaging or investigation reports, post-operative guidance or other correspondence relevant to your care.
Where appropriate, this information will normally be provided with your knowledge or consent.
Why I process your information and my lawful basis:
Enquiries
I process your contact details and enquiry information on the basis of legitimate interests, specifically so that I can respond to a request you have made and determine the appropriate next step.
If you do not go on to book an appointment, I do not use your information for unrelated purposes.
Providing services
I process ordinary personal information where this is necessary to provide the service you have requested and to perform our contract.
This includes arranging appointments, communicating with you, providing treatment, rehabilitation or training, and administering your care.
Health information used for healthcare
Where health information is processed for osteopathic care, or for rehabilitation or clinical sports massage provided as healthcare, I rely on Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018.
This permits the processing of health information where necessary for the provision of healthcare by a health professional who is subject to a professional duty of confidentiality.
Health information used for personal training
Personal training may require me to collect relevant health information so that I can determine whether exercise is appropriate and plan your training safely.
Where health information is processed solely for personal training and the healthcare condition above does not apply, I will rely on an appropriate special-category condition, which may include your explicit consent under Article 9(2)(a) UK GDPR.
Where explicit consent is relied upon, I will ask for it clearly. You can withdraw that consent at any time, although I may be unable to continue providing a service if I no longer have the information needed to do so safely.
Clinical and regulatory record keeping
As a registered osteopath, I am required to maintain appropriate clinical records and comply with the professional standards of the General Osteopathic Council.
Where applicable, personal information may therefore also be processed to comply with my legal and regulatory obligations.
Payments and accounts
I process payment and accounting information where necessary for the administration of the business and to comply with legal, tax and accounting obligations.
Complaints and legal claims
Where necessary, information may also be processed for the establishment, exercise or defense of legal claims, or in connection with a complaint, regulatory matter or professional indemnity issue.
Information needed to provide a service
You are not generally under a legal obligation to provide personal information to me.
However, I may be unable to provide treatment, rehabilitation, clinical sports massage or personal training safely if you do not provide information that is reasonably necessary to assess your needs, identify relevant risks and provide the service.
Who I share your information with
I do not sell your personal information and I do not share it with other organisations for their own marketing purposes.
Your information may be shared in limited circumstances, including:
-
With your GP, consultant or another healthcare professional where referral, further investigation or communication about your care is appropriate. This will normally be done with your consent.
-
With my professional indemnity insurer or legal advisers if a complaint, claim or other legal matter arises.
-
With the General Osteopathic Council where information is required as part of a regulatory process.
-
With service providers used to operate the practice, as described below.
-
Where disclosure is required by law.
-
Where there is a serious risk of harm to you or another person and disclosure without consent is necessary and permitted by law.
Where possible, I will tell you before sharing information without your consent unless doing so would be inappropriate, unlawful or could increase the risk of harm.
Only information that is reasonably necessary for the purpose will be shared.
Service providers
I use third-party services to help operate the practice. These currently include services such as:
Wix — website hosting, website forms and website functionality.
Heidi — clinical documentation and transcription support.
QuickBooks — accounting and financial administration.
IONOS and Google/Gmail — email, communications and related business services.
Depending on the particular service, these organisations may process personal information on behalf of In Motion Rehab Limited or may have their own responsibilities under data protection law.
Where an organisation processes personal information on my behalf, I use appropriate contractual and data-protection arrangements and only provide access to information necessary for the service being provided.
Use of Heidi
Where Heidi is used to assist with preparing clinical documentation, it may process information from a consultation, which may include health information and consultation audio or transcript data.
Where Heidi is used during your appointment, I will explain this to you beforehand. Its use does not replace my own clinical judgement or responsibility for the accuracy of your clinical records.
International transfers
Some technology providers may process or store personal information outside the United Kingdom.
Where this involves a restricted international transfer, I take steps to ensure that an appropriate transfer mechanism or safeguard is in place as required by UK data protection law. This may include UK adequacy regulations or approved contractual safeguards.
You can contact me if you would like further information about safeguards relating to your personal information.
How long I keep your information:
I only keep personal information for as long as it is reasonably required for the purpose for which it was collected, including professional, legal, regulatory and insurance requirements.
Enquiries
Enquiries that do not lead to an appointment are normally deleted after 12 months.
Osteopathy, rehabilitation and clinical sports massage records
Clinical records relating to osteopathy, rehabilitation and clinical sports massage are normally retained for a minimum of eight years from your last appointment.
Osteopathic patient records are retained in accordance with General Osteopathic Council requirements.
Where an osteopathic patient was under 18 at the time of treatment, records are retained until their 25th birthday, where applicable.
Personal training records
Personal training records are normally retained for six years from the end of our working relationship, unless there is a reason why they need to be retained for longer.
Financial and accounting records
Financial and accounting records are normally kept for at least six years from the end of the company financial year to which they relate, or for longer where required by HMRC or another legal obligation.
Complaints, claims and regulatory matters
Information connected with a complaint, insurance claim, legal matter or regulatory investigation may be kept for as long as reasonably necessary to deal with that matter and any associated legal or professional obligations.
When records are no longer required, they will be securely deleted or destroyed where appropriate.
How your information is kept secure
I take appropriate measures to protect the personal information I hold.
Access to practice and clinical records is restricted to me, except where an authorised service provider requires limited access in order to provide its service.
Electronic information is protected using password-controlled devices and services, with encryption and other security measures where appropriate.
Any paper records are stored securely in locked storage.
I take reasonable steps to keep the systems and services I use secure and review these arrangements where appropriate.
Your rights
Depending on the circumstances and the lawful basis being used, you may have the right to:
-
Be informed about how your personal information is used
-
Request access to the personal information I hold about you
-
Ask for inaccurate or incomplete information to be corrected
-
Ask for your personal information to be deleted in certain circumstances
-
Ask me to restrict the use of your information in certain circumstances
-
Object to certain uses of your personal information
-
Request transfer of certain information to you or another provider in a portable format where the right to data portability applies
-
Withdraw consent where processing is based on consent
-
Complain to the Information Commissioner's Office
To exercise any of these rights, contact me at inmotionrehab1@gmail.com.
I will normally respond within one month. There is normally no charge, although a reasonable fee may be charged or a request may be refused in limited circumstances permitted by law, such as where a request is manifestly unfounded or excessive.
The right to deletion is not absolute. I may need to retain clinical or other records where this is necessary to meet legal, professional or regulatory obligations, or for the establishment, exercise or defense of legal claims.
If you withdraw consent, this does not affect the lawfulness of processing that took place before consent was withdrawn.
Your right to object
Where I process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.
If you wish to object, contact me at inmotionrehab1@gmail.com and explain what you are objecting to.
Automated decision-making
I do not use your personal information to make decisions about you solely by automated means that produce legal or similarly significant effects.
Technology such as clinical documentation software may assist with administrative tasks, but clinical decisions remain my responsibility.
Cookies and similar technologies
This website uses cookies and similar technologies.
Some are necessary for the website to function correctly and may be used without consent.
Certain technologies used solely to produce statistical information about how the website is used may also be used without prior consent where the legal requirements for the statistical-purpose exception are met. Where that exception is relied upon, you will be given clear information and a simple way to object.
For cookies or similar technologies that are not necessary and do not fall within a legal exception, your consent will be requested before they are used.
You can manage your choices using the website's cookie controls and, where applicable, through your browser settings.
Complaints
If you have a concern about how your personal information has been handled, please contact me first so that I have an opportunity to investigate and put things right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
Website: ico.org.uk
Telephone: 0303 123 1113
Changes to this policy
I may update this privacy policy from time to time, including where my services, technology providers or legal obligations change.
The date at the top of this page shows when the policy was last revised.
If a significant change affects how I use personal information that I already hold, I will take reasonable steps to bring that change to the attention of the people affected where required.
Contact details
If you have any questions about this privacy policy or how your information is handled, please contact:
In Motion Rehab
Email: inmotionrehab1@gmail.com
Telephone: 07936 898 297
Legal company name: In Motion Rehab Limited
Company number: 11968684
Registered office: 44 Rosemont Road, London, NW3 6NE
Registered in: England and Wales