Privacy Policy

Privacy Policy

Last updated: 2/9/26

Solas Physio respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect personal information when you visit our website, contact us or use our physiotherapy and physiotherapy-led Reformer Pilates services.

Solas Physio is operated by Roisin McGinley & Raymond McGinley / Solas-Physio, located at Main Street, Killaloe, Co. Clare, Ireland.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Data Protection Act 2018 and other applicable Irish law. We also follow our professional confidentiality obligations and the relevant standards of conduct and ethics applicable to physiotherapists registered with CORU and members of the Irish Society of Chartered Physiotherapists (ISCP).

1. Who is responsible for your data?

The data controller responsible for your personal data is:

Solas Physio

Data controller: Roisin McGinley

Address: Solas-Physio, Main street, Killaloe, Co Clare

Email: roisin.solas@gmail.com

Telephone: +353 86 8928132

2. Personal data we collect

  • Depending on how you interact with us, we may collect the following information:

  • Information you provide to us

  • Your name and contact details, including email address, telephone number and address.

  • Appointment and booking information.

  • Payment and billing information.

  • Information you provide when contacting us through our website, email, telephone or social-media channels.

  • Information relating to your preferences, availability and communications.

  • Feedback, reviews or other information you voluntarily provide.

  • Health and clinical information

  • When you receive physiotherapy or related services, we may collect and process health information, including:

  • Medical history and relevant symptoms.

  • Previous injuries, illnesses, diagnoses and treatments.

  • Clinical assessment findings.

  • Treatment and rehabilitation records.

  • Exercise, movement and functional information.

  • Information about medication, referrals and relevant healthcare professionals.

  • Progress notes and information necessary for your ongoing care.

  • Health information is special-category personal data under the GDPR and is treated with additional confidentiality and security.

  • Information collected when you use our website

  • When you visit our website, certain technical information may be collected automatically, depending on your cookie choices. This may include:

  • IP address.

  • Browser and device information.

  • Approximate location.

  • Pages viewed and interactions with the website.

  • Information about how you reached our website.

  • Cookie and similar technology information.

  • Please see the Cookies section below for further information.

3. How we use your personal data

We may use your personal data to:

  • Respond to enquiries.

  • Arrange, confirm, amend and manage appointments.

  • Provide physiotherapy, rehabilitation and Reformer Pilates services.

  • Assess your needs and develop treatment or rehabilitation plans.

  • Maintain accurate clinical and administrative records.

  • Communicate with you about your appointments, treatment and exercises.

  • Process payments, invoices and refunds.

  • Communicate with other healthcare professionals where appropriate and permitted.

  • Meet our legal, regulatory, professional and insurance obligations.

  • Protect the safety, rights and property of our patients, staff and business.

  • Manage complaints, incidents, claims and legal matters.

  • Improve our website, services and patient experience.

  • Send marketing communications where you have provided the required consent.

We will only collect and use information that is relevant and necessary for these purposes.

4. Our legal bases for processing

Under the GDPR, we must have a lawful basis for processing personal data.

Depending on the circumstances, we rely on the following legal bases:

  • Performance of a contract: To arrange and provide services you have requested.

  • Steps taken before entering into a contract: To respond to your enquiry and provide information before you book.

  • Legal obligation: To comply with legal, accounting, regulatory, insurance and professional requirements.

  • Legitimate interests: To administer and improve our practice, maintain appropriate records, communicate about existing services, prevent misuse and protect our business, provided that these interests do not override your rights.

  • Consent: Where consent is required, such as for certain marketing communications, optional cookies or particular disclosures of information.

For health information, we rely on the GDPR provisions that permit processing necessary for the provision and management of health or social care services, including Article 9(2)(h), together with an applicable Article 6 lawful basis.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal will not affect processing that took place before consent was withdrawn, and it may not affect processing that we are permitted or required to continue under another legal basis.

5. Website enquiries and contact forms

Please do not submit detailed medical histories, diagnoses, photographs or other sensitive health information through a general website contact form unless we specifically ask you to do so through an appropriate secure system.

A website contact form may not be suitable for sending confidential clinical information. If you need to discuss your health, please contact us using telephone number (available on our website) or use our secure booking or clinical platform, where available.

We may retain enquiry information where necessary to respond to you, manage an appointment or maintain appropriate business records.

6. Sharing your personal data

We do not sell or rent your personal data.

We may share relevant information:

  • With healthcare professionals involved in your care, where appropriate and lawful.

  • With a GP, consultant, insurer or other third party where you have requested or authorised this, or where another lawful basis applies.

  • With service providers who process data on our behalf, such as booking, practice-management, payment, email, website-hosting, cloud-storage, IT-support and accounting providers.

  • With professional advisers, insurers or legal representatives where necessary.

  • With regulatory, law-enforcement, government or public authorities where required or permitted by law.

  • Where necessary to protect someone’s vital interests or to investigate fraud, abuse or security concerns.

  • We require relevant service providers to process information only on our instructions and to use appropriate confidentiality and security measures.

7. Booking, payment and other service providers

We use the following providers in operating our practice:

Booking or clinical-record system: Bookinghawk.ie

Payment provider: Stripe

Email provider: gmail.com

Website and hosting provider: Squarespace and hostingireland

These providers may process personal data on our behalf. Their own privacy policies may also apply.

8. International transfers

Some service providers may process or store personal data outside Ireland or the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will ensure that an appropriate lawful transfer mechanism and suitable safeguards are in place, such as an adequacy decision, Standard Contractual Clauses or another mechanism permitted by data-protection law.

Further information about relevant safeguards may be requested by contacting us using the details above.

9. How we protect your information

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

These measures may include:

  • Restricting access to personal data to authorised people.

  • Using passwords, access controls and multi-factor authentication where available.

  • Using reputable service providers with appropriate security measures.

  • Keeping devices and software updated.

  • Maintaining professional confidentiality.

  • Securely storing and disposing of records.

  • Providing appropriate privacy and data-protection training.

  • No method of transmitting or storing information is completely secure. If you believe your information has been accessed or disclosed improperly, please contact us immediately.

10. How long we keep your information

We retain personal data only for as long as necessary for the purposes for which it was collected, including our legal, regulatory, professional, insurance and accounting obligations.

Clinical records are retained in accordance with applicable Irish requirements, professional guidance and our professional indemnity insurance requirements. Our current policy is to retain adult clinical records for 7 years after the last contact, and records relating to children until their 25th Birthday.

You should confirm these periods with your professional indemnity insurer and legal adviser before publishing this policy.

After the applicable retention period, information will be securely deleted, destroyed or irreversibly anonymised unless we are required to retain it for longer, for example because of a legal claim, complaint, audit or regulatory obligation.

11. Your data-protection rights

Subject to certain legal exemptions and limitations, you may have the right to:

  • Request access to the personal data we hold about you.

  • Request correction of inaccurate or incomplete information.

  • Request erasure of your personal data.

  • Request restriction of processing.

  • Object to processing based on legitimate interests or direct marketing.

  • Request data portability where applicable.

  • Withdraw consent where processing is based on consent.

  • Request information about international transfers and safeguards.

  • Lodge a complaint with the Data Protection Commission.

To exercise your rights, please contact us at roisin.solas@gmail.com. We may need to verify your identity before responding.

We will normally respond to a valid request within one month. This period may be extended where permitted by law if a request is complex or numerous. We will tell you if an extension is required.

Some rights are not absolute. For example, we may need to retain clinical records despite a request for erasure where retention is necessary to comply with legal, professional or insurance obligations, or to establish, exercise or defend legal claims.

12. Direct marketing

We may send you service-related communications, such as appointment confirmations, reminders, receipts and information necessary for your care.

We will send promotional or marketing communications only where we have a lawful basis to do so. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link or contacting us at roisin.solas@gmail.com.

Unsubscribing from marketing will not stop essential communications relating to appointments, treatment or services you have requested.

13. Cookies and similar technologies

Our website may use cookies and similar technologies. Some cookies are necessary for the website to function. Other cookies, such as analytics or marketing cookies, may be used only where you have given the required consent.

You can manage your cookie preferences through the cookie banner or your browser settings. Refusing optional cookies may affect some website functionality.

Our website is hosted by Squarespace. Squarespace may place cookies or process technical information to provide, secure and improve the website.

For more information about the cookies used on this website, please see our [Cookie Policy / Cookie Settings].

14. Children and young people

Our services may be provided to children and young people with the involvement of a parent or legal guardian where appropriate.

Where a person is not legally able to provide consent or make decisions about their information, we will seek involvement or authorisation from a parent or legal guardian as appropriate, while respecting the child’s rights and confidentiality in accordance with applicable law and professional guidance.

15. Data breaches

We maintain procedures for identifying, managing and responding to personal-data breaches.

Where required by law, we will notify the Data Protection Commission within the applicable timeframe and will notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

If you believe a breach or loss of personal data has occurred, contact us immediately at roisin.solas@gmail.com.

16. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

If this changes, we will update this Privacy Policy and provide any information required by law.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or data-processing practices.

The latest version will be published on this page with the updated date. We encourage you to review it periodically.

18. Contact and complaints

If you have a question, concern or complaint about how we use your personal data, please contact us first:

Solas Physio

Email: roisin.solas@gmail.com

Address: Solas-Physio, Main Street, Killaloe, Co Clare

Telephone: +353 868928132

You also have the right to complain to the Irish Data Protection Commission:

Data Protection Commission

21 Fitzwilliam Square South

Dublin 2

D02 RD28

Ireland

Telephone: +353 57 868 4800

Website: www.dataprotection.ie

Email: info@dataprotection.ie