Privacy Notice
Last updated: 28 October 2026
Summit Rehabilitation is committed to protecting your privacy and handling your personal information responsibly. This Privacy Notice explains what information we collect, why we collect it, how we use and protect it, and the rights you have over your personal information.
1. Who we are
Summit Rehabilitation is operated by Will Holroyd, providing sports rehabilitation, injury assessment and rehabilitation services in Tring, Hertfordshire, and other locations listed on our website.
For data protection purposes, Summit Rehabilitation is responsible for the personal information we collect and use in connection with our website, bookings and rehabilitation services.
Contact details
-
Business: Summit Rehabilitation
-
Business address: Unit 50, Silk Mill Business Park, Brook Street, Tring, Hertfordshire, HP23 5EF
You can contact us using the email address above with any questions about this Privacy Notice or how we handle your information.
2. What personal information we collect
The information we collect depends on how you interact with Summit Rehabilitation.
Contact and booking information
When you contact us or book an appointment, we may collect your name, telephone number, email address, appointment details, preferred location and information contained in messages you send to us.
Health and rehabilitation information
When you receive an injury assessment or rehabilitation service, we may collect information about your injury, symptoms, medical history, previous treatment, relevant health conditions, assessment findings, exercise programmes and progress.
We may also record information about your physical function, strength, movement and rehabilitation outcomes where relevant to your care.
Health information is classed as special category personal data under UK data protection law and requires additional protection.
Payment and insurance information
Where relevant, we may process payment records, invoices, insurance details and information required to administer claims through insurers we accept, including Vitality.
Payment card information is processed through the relevant payment provider where applicable.
Website and technical information
When you visit our website, certain technical information may be collected, such as your IP address, browser type, device information and how you interact with our website. The information collected depends on the website features, cookies and analytics tools in use.
Information about children
Where we provide rehabilitation services to a child or young person, we may collect relevant information from the individual, their parent or guardian, or another appropriate source involved in their care.
We take additional care when handling children's personal information and only use it where necessary and lawful.
3. Why we collect and use your information
We use personal information for the following purposes:
-
To respond to enquiries and arrange appointments.
-
To provide injury assessments, rehabilitation services and appropriate follow-up care.
-
To maintain accurate clinical records and monitor rehabilitation progress.
-
To manage payments, invoices and insurance-related administration.
-
To communicate with you about appointments, changes to services and your rehabilitation.
-
To operate, maintain and improve our website and booking system.
-
To protect our business, manage complaints and address legal or insurance matters.
-
To meet applicable legal, regulatory and professional obligations.
-
To send marketing communications where permitted by law and, where required, with your consent.
We do not sell your personal information to third parties.
4. Our lawful bases for processing
Data protection law requires us to have a lawful basis for using personal information.
Depending on the purpose, we may rely on:
-
Contract or steps before entering into a contract: To arrange appointments, provide services you request and manage our relationship with you.
-
Legal obligation: Where we need to process information to comply with applicable legal requirements.
-
Legitimate interests: To manage our business, respond to enquiries, maintain appropriate records, protect our services and improve our website, provided these interests do not override your rights.
-
Consent: Where you have freely agreed to a particular use of your information and consent is the appropriate legal basis, such as certain marketing activities or non-essential cookies.
Health information
Because health information is special category data, we must also satisfy an additional legal condition before processing it.
Where applicable, we rely on the condition for health or social care under Article 9(2)(h) of the UK GDPR and the relevant requirements of the Data Protection Act 2018. Other conditions may apply to particular activities.
We only collect and use health information that is relevant to providing appropriate rehabilitation services, maintaining clinical records or meeting legitimate legal and professional requirements.
5. Who we share your information with
We only share personal information where it is necessary, appropriate and lawful.
This may include:
-
Wix: Our website is built using Wix, which provides website hosting and booking functionality. Wix processes personal information in connection with these services under its applicable terms and privacy arrangements.
-
Payment providers: Where payments are made online, the relevant payment provider processes the information needed to complete the transaction.
-
Insurance providers: Where you use an accepted insurer, we may share information required to verify cover, administer a claim or support payment, subject to the applicable legal requirements.
-
Healthcare professionals and referrers: Where necessary for your care, we may share relevant information with another healthcare professional or referrer where there is an appropriate legal basis and any required consent or other safeguards are in place.
-
Professional advisers and authorities: We may disclose information to insurers, legal advisers, regulators or public authorities where necessary to protect our interests or comply with legal obligations.
We do not share clinical information for unrelated marketing purposes.
6. How we protect your information
We take appropriate steps to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
These measures may include access controls, password protection, secure systems and restricting access to information to those who need it for legitimate purposes.
No method of electronic storage or transmission is completely secure. However, we take reasonable steps to protect the information entrusted to us.
7. How long we retain your information
We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of applicable legal requirements, professional obligations, insurance requirements and the need to deal with complaints or potential legal claims.
Clinical records may need to be kept for longer than ordinary booking or enquiry records. Records concerning children may also require longer retention periods.
When information is no longer required, we will take appropriate steps to delete it securely or anonymise it.
8. Cookies and website tracking
Our website may use cookies and similar technologies to support website functionality, booking services and, where enabled, website analytics or advertising.
Some cookies are necessary for the website to operate. Other cookies, including those used for analytics or advertising, may require your consent before they can be used.
You can manage available cookie preferences through our website's cookie settings, where provided. You can also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.
Where we use third-party website services, those providers may process technical information in accordance with their own privacy notices and the applicable arrangements.
9. Links to external websites and social media
Our website may contain links to third-party websites or social media services.
If you contact us through Instagram, Facebook or another social media platform, we will receive the information you choose to send us. The platform itself may also process your information under its own privacy policy.
We are not responsible for the privacy practices of external websites or platforms. We recommend reviewing their privacy notices before providing personal information.
10. International transfers
Some of our service providers may store or process personal information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that appropriate safeguards are in place where required by applicable data protection law.
Further information about the relevant arrangements can be requested using the contact details in this notice.
11. Your data protection rights
Under applicable data protection law, you may have the right to:
-
Access the personal information we hold about you.
-
Correct inaccurate or incomplete information.
-
Request erasure of your information where the legal conditions are met.
-
Restrict processing in certain circumstances.
-
Object to particular types of processing.
-
Request data portability where the relevant legal conditions apply.
-
Withdraw consent where we rely on consent as our lawful basis.
These rights are subject to certain legal conditions and exceptions. For example, we may need to retain some clinical records to comply with legal or professional obligations.
To exercise your rights, email will@summitrehabilitation.co.uk. We may need to verify your identity before responding to a request.
12. Complaints
If you have concerns about how we handle your personal information, please contact us in the first instance so that we can investigate.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.
You can find guidance and details of how to make a complaint at:
https://ico.org.uk/make-a-complaint/
13. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, website, technology or legal obligations.
The latest version will be published on our website, together with the date it was last updated.
If you have any questions about this Privacy Notice or how your personal information is handled, please contact us at will@summitrehabilitation.co.uk.