Privacy Notice
Last updated: October 2026 Capability Practice Ltd respects your privacy and is committed to protecting your personal information. This Privacy Notice explains what information we collect, why we collect it, how we use and protect it, who we may share it with, how long we keep it and the rights you have in relation to your personal information. Capability Practice provides private Occupational Therapy and Functional Longevity services. For the purposes of UK data protection law, Capability Practice Ltd is the data controller for the personal information described in this notice. Capability Practice Ltd Company number: 15278776 Registered in England and Wales Registered office: 2nd Floor College House 17 King Edwards Road Ruislip London United Kingdom HA4 7AE Email: contact@capabilitypractice.co.uk
The information we collect depends on your relationship with Capability Practice and the services you receive. It may include: Personal and contact information, such as your name, date of birth, address, telephone number and email address. Enquiry and appointment information, including information you provide when contacting us, appointment details and communications relating to your care. Health and clinical information, where this is necessary to assess your needs and provide Occupational Therapy or other appropriate intervention. This may include information about your health, medical history, diagnoses, medication, mobility, physical capability, cognition, everyday activities, home environment, current support and other information relevant to your assessment and care. Clinical records, including assessments, clinical notes, treatment or intervention plans, recommendations, outcomes and correspondence relevant to your care. Information about other people involved in your care, such as family members, carers, your GP or other health and social care professionals where relevant. Payment and administrative information, where required to manage appointments, invoices and payments. We aim to collect only the information that is necessary and relevant for the purpose for which it is being used. Health information is classed as special category personal data and receives additional protection under UK data-protection law.
Our website may collect basic information when you contact Capability Practice, such as your name, telephone number, email address and the information you include in an enquiry. We ask that you do not provide detailed medical or health information through the general website enquiry form. If you decide to proceed with our services, appropriate clinical information may instead be collected securely through our clinical practice management system, WriteUpp, or directly as part of your assessment and care. Information about cookies and similar technologies used on our website is provided separately in our Cookie Policy.
Capability Practice uses WriteUpp as its clinical practice management system. If you become a client, WriteUpp may be used to securely manage information including your contact details, appointments, clinical records, assessments, treatment or intervention plans, documents and relevant communications. You may also be asked to complete information-gathering or assessment forms through WriteUpp before or during your involvement with Capability Practice. WriteUpp is provided by Pathway Software (UK) Limited. In relation to patient information entered into the system by healthcare customers, WriteUpp describes itself as acting as a data processor on the customer's instructions. writeupp.com WriteUpp states that its systems are ISO 27001 certified, that data is encrypted in transit and at rest, and that its data is replicated across EU-based locations.
Most of the personal information we process is provided directly by you. We may also receive relevant information from someone acting on your behalf, such as a family member or carer, or from another health or social care professional where appropriate and lawful. If someone else makes an initial enquiry on your behalf, this does not automatically give that person authority to make decisions about your care or access your clinical information. Where appropriate, we will establish your wishes and consent regarding the involvement of family members, carers or other people in your care.
We may use your personal information to: - respond to enquiries and arrange consultations or appointments; - assess your needs and provide Occupational Therapy and related healthcare services; - plan, deliver, monitor and review your intervention; - maintain appropriate clinical records; - communicate with you about your care; - provide recommendations, reports or other clinical documentation; - communicate with family members, carers or other professionals where appropriate and lawful; - manage appointments, payments, invoices and administration; - meet our professional, regulatory, safeguarding and legal responsibilities; - respond to concerns, complaints or requests relating to your information; and - maintain the safe and effective operation of Capability Practice. We will not use your clinical information for unrelated purposes without an appropriate legal basis.
Data-protection law requires Capability Practice to have an appropriate lawful basis for processing personal information. Depending on the purpose, this may include processing that is: necessary to take steps at your request before entering into a contract or to perform our contract with you; necessary for our legitimate interests in operating and administering Capability Practice, where those interests are not overridden by your rights and interests; or necessary to comply with a legal obligation. Where we process information concerning your health, additional protections apply because this is special category data. For clinical information required to provide health care or treatment, Capability Practice may rely on Article 9(2)(h) of the UK GDPR — health or social care — together with the applicable provisions of the Data Protection Act 2018. The ICO specifically identifies Article 9(2)(h) as a condition that can permit processing necessary for the provision of health or social care or treatment, subject to its requirements and safeguards. ICO We will identify and document the appropriate lawful basis for the different ways in which we process personal information. Your consent to healthcare is separate from our data-protection lawful basis Where your consent is required for assessment, treatment, sharing confidential information or another aspect of your care, we will discuss this with you as appropriate. However, consent to receive healthcare and “consent” as a lawful basis under data-protection legislation are not necessarily the same thing. The ICO specifically distinguishes clinical consent from the lawful basis healthcare providers use to process patient information.
We treat your personal and clinical information confidentially. Where necessary and appropriate, information may be shared with: - healthcare or social care professionals involved in your care; - your GP or other relevant professionals; - family members or carers where you have agreed to their involvement, or where another lawful basis for disclosure applies; - organisations providing services to Capability Practice, such as our clinical record and practice-management provider; - professional advisers or insurers where necessary; and - regulatory, safeguarding, legal or other authorities where disclosure is required or permitted by law. We will only share information that is appropriate for the purpose. We do not sell your personal or clinical information.Depending on the purpose, this may include processing that is: necessary to take steps at your request before entering into a contract or to perform our contract with you; necessary for our legitimate interests in operating and administering Capability Practice, where those interests are not overridden by your rights and interests; or necessary to comply with a legal obligation. Where we process information concerning your health, additional protections apply because this is special category data. For clinical information required to provide health care or treatment, Capability Practice may rely on Article 9(2)(h) of the UK GDPR — health or social care — together with the applicable provisions of the Data Protection Act 2018. The ICO specifically identifies Article 9(2)(h) as a condition that can permit processing necessary for the provision of health or social care or treatment, subject to its requirements and safeguards. ICO We will identify and document the appropriate lawful basis for the different ways in which we process personal information. Your consent to healthcare is separate from our data-protection lawful basis Where your consent is required for assessment, treatment, sharing confidential information or another aspect of your care, we will discuss this with you as appropriate. However, consent to receive healthcare and “consent” as a lawful basis under data-protection legislation are not necessarily the same thing. The ICO specifically distinguishes clinical consent from the lawful basis healthcare providers use to process patient information.
Capability Practice uses carefully selected third-party services to help operate the practice. These currently include: WriteUpp / Pathway Software (UK) Limited – clinical practice management and patient records. Wix – website hosting and website enquiry functionality. Where another organisation processes personal information on our behalf, we take appropriate steps to ensure that the processing is governed by suitable data-protection arrangements. WriteUpp states that its data-processing agreement forms part of its Privacy Policy and Terms of Service. Wix also publishes a Data Processing Agreement governing its processing on behalf of Wix users. WriteUp Help We may update the service providers we use as Capability Practice develops.
Some technology providers or their subprocessors may process personal information outside the United Kingdom. Where personal information is transferred internationally, Capability Practice will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data-protection requirements and that appropriate safeguards are used where required. Our Privacy Notice will be updated where necessary to reflect material changes to how or where personal information is processed. Note for us before launch: I want to complete the Wix/cookie configuration before making this section more specific. The ICO requires overseas-transfer information where applicable, so we shouldn't pretend we know the final data flow before your Wix setup is finished.
We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected and to meet our professional, regulatory, legal, insurance and clinical-record-keeping responsibilities. Different types of information may therefore be kept for different periods. Clinical records will be retained in accordance with applicable professional, legal and insurance requirements. When information is no longer required, it will be securely deleted or disposed of in accordance with our retention arrangements.Where personal information is transferred internationally, Capability Practice will take appropriate steps to ensure that the transfer is made in accordance with applicable UK data-protection requirements and that appropriate safeguards are used where required. Our Privacy Notice will be updated where necessary to reflect material changes to how or where personal information is processed. Note for us before launch: I want to complete the Wix/cookie configuration before making this section more specific. The ICO requires overseas-transfer information where applicable, so we shouldn't pretend we know the final data flow before your Wix setup is finished.
Capability Practice takes appropriate organisational and technical measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Measures include using appropriate clinical record systems, controlling access to information, maintaining account security and using appropriate security measures for devices and systems used in the practice. Access to personal information is limited to those who have a legitimate reason to access it.
Depending on the circumstances and the lawful basis being relied upon, you may have rights including: The right to access personal information we hold about you. The right to rectification if information is inaccurate or incomplete. The right to erasure in certain circumstances. The right to restrict processing in certain circumstances. The right to object to processing in certain circumstances. The right to data portability where applicable. Rights relating to automated decision-making, where applicable. Not all rights apply in every circumstance. For example, healthcare providers may need to retain certain clinical records even where someone asks for information to be erased. If you wish to exercise a data-protection right, contact: contact@capabilitypractice.co.uk We may need to confirm your identity before fulfilling a request. The ICO requires privacy information to explain the rights available to the individual, which can vary depending on the lawful basis used.
Automated decision-making Capability Practice does not currently make decisions about your care using solely automated decision-making or profiling that produces legal or similarly significant effects. Clinical decisions and recommendations are based on professional judgement and your individual circumstances. Questions or concerns about your information If you have any questions or concerns about how Capability Practice handles your personal information, please contact: Capability Practice Ltd contact@capabilitypractice.co.uk 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's data-protection regulator. Changes to this Privacy Notice We may update this Privacy Notice from time to time to reflect changes to our services, systems, legal obligations or how we process personal information. The latest version will always be available on this website, with the date it was last updated shown at the top of the page.The right to access personal information we hold about you. The right to rectification if information is inaccurate or incomplete. The right to erasure in certain circumstances. The right to restrict processing in certain circumstances. The right to object to processing in certain circumstances. The right to data portability where applicable. Rights relating to automated decision-making, where applicable. Not all rights apply in every circumstance. For example, healthcare providers may need to retain certain clinical records even where someone asks for information to be erased. If you wish to exercise a data-protection right, contact: contact@capabilitypractice.co.uk We may need to confirm your identity before fulfilling a request. The ICO requires privacy information to explain the rights available to the individual, which can vary depending on the lawful basis used.