Privacy Policy

1. Data Controller

Cumbria Clinical Exercise ("the Practice") is committed to protecting your personal and medical data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO).

2. Information We Collect

We collect personal details (name, address, date of birth, contact details) and special category health data (medical history, diagnostic information, exercise tolerance testing results, GP/consultant details) necessary to deliver safe, effective Clinical Exercise Physiology services.

3. How Your Data Is Stored & Protected

All personal and clinical records are securely stored within Cliniko, an encrypted, fully GDPR-compliant electronic health record system. Payment transactions are processed securely via Stripe; we do not hold or store raw credit/debit card numbers on our website servers.

4. Data Sharing & Clinical Governance

Your health data is kept strictly confidential. Clinical summary reports or health observations may be shared with your GP or medical consultant when clinically indicated for your safety or as part of your ongoing care pathway. We will never sell or pass your data to third parties for marketing purposes.

5. Your Legal Rights

Under UK data protection law, you have the right to request access to the clinical and personal data we hold about you, request corrections, or request deletion where legally permissible. To exercise these rights, please contact info@cumbriaclinicalexercise.co.uk.