BodyMed Patient Privacy Notice

Version 2.0  ·  Effective date: [25.08.26]  ·  Replaces all previous versions

1. Who We Are

BodyMed Healthcare Ltd (“BodyMed”, “we”, “us”) is a multidisciplinary healthcare clinic located at 188 Clontarf Road, Dublin, D03 C3W0. Our clinical team includes Chartered Physiotherapists, Osteopaths, Acupuncturists and Massage Therapists. A number of independent visiting practitioners also see patients at our clinic; their position is explained in Section 4.

BodyMed Healthcare Ltd is the Data Controller of your personal information. This means we are responsible for deciding how your information is collected, used and protected, and we are accountable to you and to the Irish Data Protection Commission for how we do that.

This notice explains, in plain language, what information we collect about you, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We have tried to keep it clear and honest — if anything is unclear, please feel free to get in touch.

Our Data Protection Officer: Kathy Kavanagh, BodyMed Healthcare Ltd, 188 Clontarf Road, Dublin, D03 C3W0. For any privacy query or to exercise any of your rights, contact us at hello@bodymed.ie or write to us at the address above.

2. The Information We Collect About You

To care for you safely and effectively, we need to collect and keep certain information. We only ask for what we genuinely need.

• Identity and contact details — your name, date of birth, address, phone number and email address, GP and, where relevant, your next of kin or emergency contact
• Health information — the reason you are attending, your symptoms, medical history, medications, examination findings, our clinical notes, your treatment plan, and your exercise programmes
• Information from your referrers — referral letters and clinical reports (including X-ray and MRI reports) sent to us by your GP, hospital consultant or another healthcare professional
• Clinical photographs and video — with your consent, your therapist may take clinical photographs or short videos — for example to assess your movement or posture, or to show you your progress. These are stored securely in your patient record, never on personal devices, and never used for any other purpose without your separate, explicit permission
• Appointment and payment information — records of your appointments, payments and receipts. We do not store your card details — payments are processed securely by our payment provider
• CCTV images — our premises are monitored by CCTV for the security and safety of patients and staff — see Section 8
• Website information — when you use our website, we collect limited technical information such as pages visited — see Section 9

Health information — including the fact that you attend our clinic at all — is classed as “special category data” under data protection law and receives the highest level of legal protection. Everything in this notice should be read with that in mind.

3. Why We Use Your Information, and Our Legal Basis

Data protection law requires us to have a lawful basis for everything we do with your information. Because health information is special category data, we must also meet a second, stricter condition. In summary:

• Providing your healthcare — Assessing, treating and caring for you. Legal basis: performance of our contract of care with you (Article 6(1)(b) GDPR) and the provision of healthcare by professionals subject to a duty of confidentiality (Article 9(2)(h) GDPR and Section 53 of the Data Protection Act 2018)
• Running the clinic — Booking appointments, sending appointment reminders, taking payments and issuing receipts. Legal basis: performance of our contract with you
• Communicating with your other healthcare providers — Writing to your GP or consultant about your care, with your knowledge. Legal basis: provision of healthcare (Article 9(2)(h))
• Legal and insurance purposes — Preparing medico-legal reports where you (through your solicitor) ask us to, or where we are legally required to. Legal basis: your explicit consent, or the establishment, exercise or defence of legal claims (Article 9(2)(f))
• Keeping in touch (marketing) — Sending you our newsletter and health tips — only if you have opted in, and you can unsubscribe at any time. Legal basis: your consent (Article 6(1)(a))
• Complying with the law — Meeting our obligations under tax law, healthcare regulation and professional standards. Legal basis: compliance with a legal obligation (Article 6(1)(c))
• Safety and security — CCTV for premises security, and essential administration. Legal basis: our legitimate interests, balanced carefully against your rights (Article 6(1)(f))

We will never sell your information, and we will never use it for a purpose you would not reasonably expect without telling you first.

4. Visiting Independent Practitioners

A number of self-employed healthcare professionals — currently in clinical psychology, podiatry, acupuncture and counselling — see patients at BodyMed. These practitioners keep their own clinical records on their own systems, have no access to BodyMed’s patient records, and are each independently responsible (as separate Data Controllers) for the information they hold about you. If we refer you to one of them, we will only pass on your information with your agreement, and they will explain their own privacy practices to you.

We believe this separation matters, particularly for psychology and counselling: notes from those sessions are held only by your psychologist or counsellor and do not form part of your BodyMed clinic record.

One of our visiting acupuncturists practises as part of the BodyMed clinical team and records notes within BodyMed’s patient record system under a binding confidentiality and data protection agreement. For those records, BodyMed remains the Data Controller and this notice applies in full.

5. Children and Young People

We treat children and young people from the age of 8 upwards — for example in our scoliosis and paediatric musculoskeletal services. We take particular care with their information and their welfare:

• For patients under 16, a parent or legal guardian must be present during assessment and treatment, and we ask the parent or guardian to provide consent for the collection and use of the child’s information.
• For patients aged 16 and 17, we involve both the young person and their parent or guardian appropriately, respecting the young person’s growing autonomy.
• All of our Physiotherapists are Garda vetted, as required by our membership of the Irish Society of Chartered Physiotherapists.
• All of our team — including reception staff — have completed the Tusla “Children First” child protection training programme.
• Records of patients treated as children are kept until the patient’s 25th birthday (see Section 10).

6. Who We Share Your Information With

We share your information only when it is necessary for your care, when you ask us to, or when the law requires it. Only the relevant parts of your record are ever shared. Those we share with include:

• Your healthcare team — your GP, hospital consultants and other healthcare professionals involved in your care — for referrals, treatment updates and discharge summaries, with your knowledge
• Visiting practitioners — the visiting independent practitioners described in Section 4, only with your agreement
• Solicitors — where you are pursuing a legal claim, we may provide medico-legal reports to your solicitor — only with your written consent, or where we are compelled by law or a court
• Insurance and tax — we provide you with receipts which you may submit to your health insurer or to Revenue for reimbursement or tax relief; we do not send your clinical information to insurers unless you explicitly ask us to
• Legal and regulatory authorities — in the rare situations where the law requires disclosure — for example a court order, a statutory investigation, or a child protection concern under the Children First Act 2015

We also use a small number of carefully chosen technology providers (“data processors”) who handle information on our behalf under strict written contracts. They may only use your information on our instructions and must protect it to the standards the law requires:

• Jane (JaneApp) — our secure patient administration and clinical records system, where your patient record is held
• Physitrack — our exercise-prescription platform, linked to your patient record, used to design and share your exercise programmes
• Heidi Health — an AI-assisted clinical dictation tool we are currently trialling to help our therapists prepare clinical notes and referral letters. Your therapist will tell you if it is being used in your consultation, and you are free to decline — this will never affect your care. See Section 7
• Google Workspace — our secure email and office systems
• MailerLite — our newsletter platform, used only if you have opted in to hearing from us
• SumUp — our card payment processor — we never see or store your full card details

Where any of these providers processes data outside the European Economic Area — for example Jane’s Canadian operations or US-based providers — we rely on the legal safeguards required by GDPR, such as European Commission adequacy decisions and Standard Contractual Clauses, so that your information receives equivalent protection wherever it is processed.

7. How We Use Artificial Intelligence

Like many modern clinics, we are carefully introducing AI tools to help us run the clinic efficiently — never to replace the judgement of your clinician. Our commitments to you are:

• We will always tell you before an AI tool is involved in processing your information, and where practical give you the choice to opt out.
• Every AI provider we use is bound by a written data processing contract, and we verify that your information is not used to train their AI models.
• No AI system makes clinical decisions about you. Diagnosis, treatment and clinical communication are always the responsibility of your qualified clinician.
• Any AI-drafted document about your care (such as a clinical note or referral letter prepared using our dictation tool) is reviewed and approved by your clinician before it enters your record or is sent anywhere.

At present we are trialling Heidi Health for clinical dictation, as described in Section 6. If we introduce further tools — such as a website enquiry assistant or AI-assisted email handling — we will update this notice before they go live and clearly signpost them at the point you encounter them.

8. CCTV

CCTV operates at our premises for the security and safety of patients, staff and visitors, on the legal basis of our legitimate interests. Cameras cover entrances and general areas only — never treatment rooms. Signage is displayed where CCTV is in operation. Footage is held securely for 30 days and then automatically deleted, unless it is needed for the investigation of an incident or is required by An Garda Síochána or a court. You have the right to request access to footage of yourself.

9. Our Website

When you visit www.bodymed.ie, we collect limited technical information — such as pages visited, time spent and approximate location — through analytics cookies, to help us understand how the website is used and improve it. Cookies that are not strictly necessary are only set with your consent, which you can give or refuse through our cookie banner and change at any time. Our website is served over an encrypted (HTTPS) connection.

10. How Long We Keep Your Information

We keep your information for no longer than necessary, in line with healthcare record-keeping standards and our legal obligations:

• Adult patient records — 7 years from the date of your last treatment
• Records of patients treated as children — until the patient’s 25th birthday (or 8 years from last treatment, whichever is later)
• Records involved in legal claims — where a record is relevant to an actual or reasonably anticipated legal claim, it is retained until the matter is fully concluded
• Financial and payment records — 6 years, as required by Revenue
• CCTV footage — 30 days, unless required for an investigation
• Marketing preferences — until you unsubscribe or withdraw your consent

When information is no longer needed, it is securely and permanently deleted. Paper documents — such as posted referral letters, once scanned into your record — are shredded and securely disposed of.

11. How We Keep Your Information Safe

We take the security of your information extremely seriously. Our measures include:

• Your records are held in secure, encrypted, cloud-based systems protected by multi-factor authentication.
• Access to patient information is limited to those who need it for your care or for the running of the clinic, and every team member — clinical and non-clinical — is bound by a professional code of confidentiality or a signed confidentiality agreement.
• Referral letters and reports received by email or post are transferred promptly into your secure patient record; the email is then deleted and paper copies are shredded.
• Clinical photographs and videos are stored only in your patient record, never in personal photo libraries.
• Our team receives data protection training, and we maintain a documented procedure for responding to any data security incident. In the unlikely event of a breach that puts your rights at risk, we will notify the Data Protection Commission within 72 hours and inform you directly where the risk to you is high.

12. Your Rights

You have strong rights over your information. You can:

• Access — ask for a copy of the information we hold about you, including your clinical record (a “subject access request”) — we will respond within one month
• Rectification — ask us to correct information that is inaccurate or incomplete
• Erasure — ask us to delete your information. Please note that we are usually required to retain clinical records for the periods in Section 10, and we will explain clearly if that applies
• Restriction — ask us to limit how we use your information in certain circumstances
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time
• Portability — receive the information you provided to us in a portable electronic format
• Withdrawing consent — withdraw any consent you have given — for example to marketing, clinical photography or the use of a dictation tool — at any time, without affecting your care

To exercise any of these rights, contact our Data Protection Officer at hello@bodymed.ie. We may need to verify your identity before acting on a request. Exercising your rights is free of charge.

You are not subject to any decision made solely by automated means that produces legal or similarly significant effects on you.

13. If You Have a Concern

If you are unhappy with how we have handled your information, please tell us first — we genuinely want to put things right. Contact our Data Protection Officer at hello@bodymed.ie or in writing at the clinic address.

You also have the right to lodge a complaint with the supervisory authority: the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 — www.dataprotection.ie.

14. Changes to This Notice

We review this notice at least once a year and whenever we change how we handle your information — for example before introducing any new technology. The current version is always available on our website and at reception, and each version is dated so you can see when it was last updated. Significant changes will be highlighted at the clinic and on our website before they take effect.

BodyMed Healthcare Ltd  ·  188 Clontarf Road, Dublin, D03 C3W0  ·  hello@bodymed.ie  ·  Data Protection Officer: Kathy Kavanagh