M20 Health & Performance respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, contact us, make an enquiry, book an appointment, attend our clinic, use our services, or otherwise interact with us.
This policy is written to help you understand what information we collect, why we collect it, how we use it, who we may share it with, how long we keep it, and what rights you have.
M20 Health & Performance is a health, rehabilitation and performance clinic based in Manchester.
Clinic name: M20 Health & Performance
Address: 150E Burton Road, West Didsbury, Manchester, M20 1LH
Website: https://m20health.com
Email: contact@m20health.com
Phone: 0161 706 0736
For the purposes of UK data protection law, M20 Health & Performance is the “controller” of the personal information we collect and use.
Legal entity: [INSERT FULL LEGAL ENTITY NAME]
Company number: [INSERT COMPANY NUMBER, IF APPLICABLE]
ICO registration number: [INSERT ICO REGISTRATION NUMBER, IF APPLICABLE]
Data protection contact: [INSERT NAME OR ROLE, e.g. Clinic Manager / Data Protection Lead]
You can contact us about this Privacy Policy or your personal information by emailing:
This Privacy Policy applies to personal information collected through:
This policy does not apply to third-party websites that we may link to. If you follow a link to another website, you should read that organisation’s own privacy policy.
The personal information we collect depends on how you interact with us.
When you contact us, we may collect:
When you book or attend an appointment, we may collect:
Because we provide health, rehabilitation and performance-related services, we may collect information about your health. This may include:
Health information is treated as special category data under UK data protection law. This means it receives a higher level of protection.
If you use our performance services, we may collect:
Some of this information may also reveal health-related information and will be treated with appropriate care.
When you pay for our services, we may collect:
We do not usually store full card details ourselves. Payments are normally processed by third-party payment providers.
Payment processor: [INSERT PAYMENT PROVIDER, e.g. Stripe, Square, SumUp, Worldpay, Fresha, Cliniko payments, etc.]
When you use our website, we may collect:
Some of this data is collected through cookies and similar technologies. See section 14 below for more information.
If you choose to provide a review, testimonial, photo, video or case study, we may collect:
We will only use identifiable testimonials, images, videos or case studies for marketing where we have appropriate permission.
If you subscribe to updates or agree to receive marketing, we may collect:
You can opt out of marketing at any time.
We may collect information directly from you when you:
We may also receive information from third parties, including:
We only use your personal information where we have a lawful reason to do so.
The table below explains the main ways we use personal information and the lawful bases we rely on.
Some information we collect is health-related. This may include details about injuries, pain, symptoms, medical history, treatment, rehabilitation, physical assessment, exercise prescription, clinical notes and progress.
This type of information is known as special category data under UK data protection law.
We process health information only where necessary for appropriate purposes, such as:
Where we process health information for care, treatment or rehabilitation, we usually rely on the UK GDPR condition that processing is necessary for the provision of health care or treatment. We may also rely on other conditions where appropriate, such as explicit consent, vital interests, legal claims or substantial public interest.
Access to health information is restricted to people who need it for legitimate clinical, administrative, legal or operational reasons.
We understand that health information is personal and sensitive.
We aim to protect your confidentiality by:
There may be limited situations where we need to share information without your consent, such as where required by law, where there is a safeguarding concern, where there is a serious risk of harm, or where necessary in connection with legal or regulatory matters.
We do not sell your personal information.
We may share personal information with trusted third parties where necessary, including:
We may share relevant information internally with clinicians, practitioners, administrative staff and contractors who need access to provide services, manage appointments, respond to enquiries, process payments or support clinic operations.
Where appropriate and lawful, we may share relevant information with:
We will usually do this with your knowledge or consent unless there is another lawful reason to share the information.
We may use third-party service providers for:
These providers may process personal information on our behalf. Where required, we expect them to protect your information and only use it for the agreed purpose.
Current or potential providers may include:
We may share information with:
We will only do this where necessary and lawful.
If M20 Health & Performance is involved in a business sale, merger, restructure or transfer, relevant personal information may be shared with the parties involved, their advisers and any new owner or operator, where lawful and necessary.
If you contact us by WhatsApp, email, Instagram, Facebook or another third-party platform, your message may also be processed by that platform.
Please avoid sending highly sensitive medical information through social media or messaging platforms unless necessary. For detailed clinical matters, we may ask you to use a more appropriate communication method or discuss the matter during your appointment.
We keep personal information only for as long as necessary for the purposes for which it was collected, including legal, clinical, insurance, accounting, regulatory and operational requirements.
Typical retention periods are:
We may keep information for longer where required by law, professional guidance, insurance requirements, safeguarding duties, legal claims, regulatory matters or ongoing investigations.
When information is no longer needed, we will securely delete, anonymise or archive it where appropriate.
Some of our service providers may process or store personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take reasonable steps to ensure appropriate safeguards are in place. This may include using providers based in countries recognised as providing adequate protection, or using approved contractual safeguards where required.
We take appropriate steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.
These steps may include:
No method of electronic transmission or storage is completely secure, but we aim to use appropriate practical and organisational safeguards.
Under UK data protection law, you have rights over your personal information.
Depending on the circumstances, you may have the right to:
Some rights are not absolute. For example, we may need to keep certain clinical, legal, tax, insurance or regulatory records even if you ask us to delete them.
To exercise your rights, contact us at:
We may need to verify your identity before responding to your request.
Our website may use cookies and similar technologies.
Cookies are small files placed on your device that help websites function, remember preferences, measure performance and, where enabled, support marketing or analytics.
We may use the following types of cookies:
These cookies are needed for the website to work properly. They may support basic functions such as page navigation, security, form submissions or cookie preference settings.
These cookies do not usually require consent.
Analytics cookies help us understand how visitors use our website, such as which pages are visited most often and how users move around the site.
We use this information to improve the website and user experience.
Analytics cookies should only be used where you have given consent, unless they fall within a legal exemption.
Functional cookies help provide enhanced features, such as embedded maps, videos, reviews or third-party tools.
If you disable these cookies, some features may not work properly.
Marketing cookies may be used to help measure advertising, build audiences or show relevant content across other platforms.
We will only use marketing cookies where legally permitted and, where required, with your consent.
When you visit our website, you may be asked to accept, reject or manage non-essential cookies.
You can also control cookies through your browser settings. If you block some cookies, parts of the website may not work as intended.
Cookie consent provider: [INSERT COOKIE TOOL NAME]
Analytics tools used: [INSERT ANALYTICS TOOLS]
Marketing pixels used: [INSERT, OR SAY “None currently used”]
We may send you marketing communications about our services, clinic updates, educational content, offers or events where we are legally allowed to do so.
We will only send marketing where:
You can opt out of marketing at any time by:
We will still send essential service messages, such as appointment confirmations, appointment reminders, payment information or important updates about your care.
If you leave a review on Google, Trustindex, social media or another third-party platform, that platform will process your review according to its own privacy policy.
If we ask to use your review, testimonial, image, video or case study on our website, social media or marketing materials, we will ask for appropriate permission.
You can withdraw consent for future use of identifiable testimonials, images or videos by contacting us. Please note that withdrawal may not affect materials already lawfully published or printed before your request was received.
We may provide services to children and young people.
Where we collect personal information about a child or young person, we will take appropriate care with that information.
Depending on the child’s age, maturity and the circumstances, we may involve a parent or guardian in bookings, consent, communications and treatment decisions.
Where a young person is able to understand and make decisions about their own information, we will take their views and rights into account.
In limited circumstances, we may need to share personal information where we believe there is a serious risk of harm, a safeguarding concern, a medical emergency, or a legal obligation to disclose information.
This may include sharing information with healthcare professionals, emergency services, safeguarding authorities, regulators or law enforcement.
We will only share what is necessary and appropriate in the circumstances.
Our website may include links to third-party websites, maps, social media pages, booking systems, review platforms, videos or embedded content.
These third parties may collect information about you when you interact with their services.
We are not responsible for the privacy practices of third-party websites or platforms. You should read their privacy policies before providing personal information.
We do not use your personal information to make decisions about you based solely on automated processing that would have a legal or similarly significant effect on you.
If you have concerns about how we handle your personal information, please contact us first so we can try to resolve the issue.
Email: contact@m20health.com
Phone: 0161 706 0736
Address: M20 Health & Performance, 150E Burton Road, West Didsbury, Manchester, M20 1LH
You also have the right to complain to the UK data protection regulator:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://ico.org.uk
Phone: 0303 123 1113
We may update this Privacy Policy from time to time.
When we make changes, we will update the “Last updated” date at the top of this page. If we make significant changes, we may take additional steps to notify you where appropriate.
You should review this page occasionally to stay informed about how we protect your information.
