1. Who we are
Kirsty McIlwaine, a sole trader trading as NOVA Head & Neck Physiotherapy, is the data controller responsible for your personal information. The practice is based within 232 Medical Practice, Harold’s Cross, Dublin. This notice covers the practice and its website, novaheadneck.com.
232 Harold's Cross Rd, Harold's Cross, Dublin, D6WN923
Email: kirsty@novaheadneck.com
Phone: 0896050129
Please use these details for any privacy question or request. Being based within 232 Medical Practice does not mean other clinicians there receive your information.
2. Information we use
- Website enquiries: your name, email address, optional phone number and message. Please do not send detailed medical information through the enquiry form.
- Bookings and free calls: the details you enter on our Cliniko booking page, and what you tell Kirsty during a free 15-minute call.
- Your care: health information needed to assess and treat you, such as your symptoms, relevant medical history, assessment findings and treatment notes. Health information is a special category of personal data and receives extra protection under data protection law.
- Payments: appointment fees, payment status and receipts. Card payments are processed by Stripe; we do not receive your full card number.
- Website use: like any website, your browser sends technical information such as your IP address and browser type to the services that deliver the pages. With your consent, Google advertising tags also record your visit (see section 10).
3. What you need to provide
- To book: your name and contact details are needed so we can confirm, change or cancel your appointment or call. Without them, we cannot arrange a booking.
- For assessment and treatment: information about your symptoms and relevant health history is needed to assess you safely and plan suitable care. You can choose not to share something, but Kirsty may then be unable to assess or treat you safely, or may recommend another source of care.
- For enquiries: your name, email address and message are needed to reply. Your phone number is optional.
- For payment: payment details are needed to pay for a paid appointment.
- Optional cookies: never required. Rejecting them does not affect contacting us, booking or your care.
4. Why we use it
- Arranging appointments and providing care
- Necessary to provide the physiotherapy service you request, or to take steps you ask for before it starts (Article 6(1)(b) GDPR). Health information is used for assessment and treatment by a health professional bound by confidentiality (Article 9(2)(h) GDPR and section 52 of the Data Protection Act 2018).
- Replying to other enquiries
- Our legitimate interest in responding to correspondence and running the practice (Article 6(1)(f) GDPR). We do not rely on this basis for health information.
- Payments and financial records
- Necessary for the service you request (Article 6(1)(b)) and to meet our tax and accounting obligations under Irish law (Article 6(1)(c)).
- Keeping the website working and secure
- Our legitimate interest in operating and protecting the website (Article 6(1)(f)).
- Optional advertising measurement
- Only with your consent (Article 6(1)(a)), which you can withdraw at any time.
Kirsty is a CORU-registered physiotherapist and follows the Physiotherapists Registration Board’s Code of Professional Conduct and Ethics, including its duties of confidentiality and accurate record-keeping. Confidentiality may be set aside only where the law allows, for example where required by law or to prevent serious harm.
Your consent to assessment and treatment is a separate matter from the legal bases above. Booking, requesting a call or sending an enquiry does not sign you up to marketing.
6. Outside the European Economic Area
Some providers store or access information outside the EEA. Where a country does not have an EU adequacy decision, the transfer is protected by the European Commission’s Standard Contractual Clauses or, for certified US companies, the EU–US Data Privacy Framework.
- Cliniko: transfer safeguards are set out in its EU Data Processing Addendum, which includes Standard Contractual Clauses. Cliniko’s subprocessors.
- Stripe: the Data Privacy Framework, with Standard Contractual Clauses as a fallback, under Stripe’s Data Transfers Addendum.
- Lovable: uses providers in the EU, the UK (which has an EU adequacy decision) and the United States, with transfer safeguards under Lovable’s Data Processing Agreement. Lovable’s subprocessors.
- Microsoft and Google: Standard Contractual Clauses and the Data Privacy Framework under their published data protection terms.
You can ask us for more information about these safeguards using the contact details above.
7. How long we keep it
- Enquiries that do not lead to care: up to 12 months after the last contact.
- Free-call notes where no clinical advice is given and no care follows: up to 12 months after the last contact. Notes containing clinical advice or information relevant to care become part of your patient record.
- Clinical records: We retain clinical records for as long as necessary to support your care and meet applicable legal, professional and insurance requirements. We also consider whether records are needed for a complaint, claim or investigation. Records are reviewed and securely deleted when they are no longer required.
- Financial records: 6 years from the end of the year to which they relate.
At the end of these periods, records are reviewed and securely deleted, unless continuing care, a legal or insurance requirement, or a complaint, claim or investigation means they must be kept longer. Any extension is documented and reviewed.
8. Protecting it
This website is served over an encrypted (HTTPS) connection. Enquiry-form submissions are stored in a database that only the practice’s administrator account can read. The website does not see what you type on the Cliniko booking page.
Our providers are bound by contract to protect information they handle for us. No method of sending information over the internet is completely secure, so please avoid putting detailed health information in emails or the enquiry form.
9. Your rights
You have the right to access your information, have inaccurate information corrected, and, where the law allows, have it erased, restrict its use, or receive information you supplied in a portable format. You can object to use based on legitimate interests, and to direct marketing at any time.
Where we rely on consent, you can withdraw it at any time; this does not affect earlier use. Some rights are limited by law: for example, we may need to keep clinical records for the periods above or to deal with a legal claim.
Contact Kirsty using the details above. We may ask for information to confirm your identity before releasing records. We respond within one month, extendable by up to two further months for complex requests, in which case we will tell you why.
11. Changes and complaints
We will post any changes to this notice on this page with a new “last updated” date, and tell patients directly about significant changes where appropriate.
You are welcome to contact Kirsty with any concerns. You can also complain directly to Ireland’s Data Protection Commission.