1. Who we are
This Privacy Policy explains how Sports Healing Ltd (“we”, “us”, “our”) collects, uses, shares and protects personal information when you use our websites sportshealing.com and chinmaygupte.com (together, the “Websites”), contact us, or request our services.
For the purposes of UK data protection law, the “controller” of your personal information is Sports Healing Ltd, a private limited company registered in England and Wales under company number 05540087, whose registered office is at Woodlands Grange, Woodlands Lane, Bradley Stoke, Bristol, England, BS32 4JY.
Both Websites are operated by Sports Healing Ltd. We are registered with the Information Commissioner’s Office under registration reference ZA005873.
We are not required to appoint a Data Protection Officer and have not appointed one. Responsibility for data protection rests with the company, and any question about how we handle your information should be sent to patient@sportshealing.com (see section 17).
We are committed to protecting your privacy and handling your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
Clinical services referred to on the Websites are provided by Mr Chinmay Gupté, who is registered with the General Medical Council (GMC reference 4342319) and is bound by a professional duty of confidentiality.
2. Scope of this policy
This policy covers personal information collected through the Websites and related enquiries. Where you go on to receive clinical or diagnostic services, additional privacy information specific to your care (for example, a patient privacy notice) may also apply. If you follow a link to a third-party website or service — such as myKneeScan.com or an online booking provider — that organisation’s own privacy policy will govern the information you give them.
3. The information we collect
3.1 Information you give us
- Identity and contact details — such as your name, email address, telephone number and postal address.
- Enquiry and booking details — the content of contact forms, appointment or scan-booking requests, and any correspondence with us.
- Health information — where you choose to tell us about your symptoms, injury, medical history or reason for seeking care. Health data is “special category” personal data and we treat it with particular care (see section 5).
- Payment information — where you pay for a service, this is processed securely by our payment provider; we do not store full card details.
3.2 Information we collect automatically
When you visit the Websites we may automatically collect technical and usage information using cookies and similar technologies, such as your IP address, device and browser type, the pages you view, and how you arrived at the site. We use Google Analytics for this purpose, and only with your consent. See section 6.
3.3 Information from other sources
We may receive information about you from third parties, such as a referring GP or clinician, an insurer, or a person making an enquiry on your behalf, where they are permitted to share it with us.
4. How and why we use your information
We use your information only where the law allows. The table below sets out our main purposes and the corresponding lawful basis under Article 6 of the UK GDPR, together with the additional condition under Article 9 that applies whenever we handle health information.
| Purpose | Lawful basis (Art. 6) | Condition for health data (Art. 9) |
| Responding to enquiries and contact forms | Legitimate interests; or steps prior to a contract | Explicit consent; or health/social care purposes, where health details are shared |
| Managing appointment and scan-booking requests | Steps to enter into a contract; legitimate interests | Health or social care purposes (Art. 9(2)(h)); or explicit consent |
| Providing clinical and diagnostic services | Performance of a contract; legal obligation | Health or social care purposes (Art. 9(2)(h)) |
| Sending you updates or marketing (where you have opted in) | Consent | Explicit consent, where the message concerns health |
| Analysing and improving the Websites | Consent (for non-essential cookies); legitimate interests | Not applicable |
| Keeping the Websites secure and preventing fraud | Legitimate interests; legal obligation | Not applicable |
| Meeting legal, regulatory and professional obligations | Legal obligation | Health care; or legal claims |
| Establishing, exercising or defending legal claims | Legitimate interests | Legal claims (Art. 9(2)(f)) |
Where we rely on legitimate interests, those interests are running and promoting our practice, responding to enquiries, and keeping our services safe and effective; we balance them against your rights. Where we rely on consent, you may withdraw it at any time (see section 12).
5. Health information (special category data)
Any information about your physical or mental health is “special category” data and receives extra protection. We only collect health information that is relevant to your enquiry or care; we limit access to those who need it; and we process it under the conditions identified in section 4, supported by the conditions in Schedule 1 to the Data Protection Act 2018 and an appropriate policy document where required. Members of our clinical team are also bound by a professional duty of confidentiality.
Our clinical services are delivered at hospitals and clinics registered with the Care Quality Commission (CQC). Where you are seen at such a setting, that hospital or clinic may hold its own records of your care and act as a controller of that information in its own right, under its own privacy notice.
6. Cookies and analytics
The Websites use cookies — small text files placed on your device. Strictly necessary cookies are required for the site to function and for security, and do not require your consent.
We also use Google Analytics, a web analytics service provided by Google, to understand how visitors use the Websites so that we can improve them. Google Analytics collects information such as your IP address, the pages you visit and how long you spend on them. These are non-essential cookies and are set only if you consent to them through our cookie banner.
The analytics cookies we use are:
| Cookie | Purpose | Duration |
| _ga | Distinguishes one visitor from another so that visits can be counted | 2 years |
| ga<container-id> | Maintains the analytics session state | 2 years |
You can change or withdraw your consent at any time using the cookie settings on the Websites, and you can also block or delete cookies through your browser settings. Refusing analytics cookies will not affect your ability to use the Websites or to contact us. We do not use cookies to collect health information, and we do not use advertising or profiling cookies.
Full details of every cookie we use, and how to control them, are set out in our Cookie Policy.
7. Who we share your information with
We do not sell your personal information. We share it only where necessary, with:
- Our clinical and administrative team, to respond to you and provide care;
- Trusted service providers acting on our behalf under contract, in the following categories: our website host, our appointment-booking and practice-management system, our secure clinical records platform, our email provider, our payment provider, and Google, which provides the analytics service described in section 6;
- myKneeScan.com, where a knee MRI scan is reported as part of our diagnostic pathway;
- The CQC-registered hospitals and clinics at which our clinical services are delivered, and other healthcare providers, your GP, or your insurer, where relevant to your care and with an appropriate basis;
- Our professional advisers (such as lawyers, accountants and indemnity providers) where needed;
- Regulators, law enforcement or other authorities where we are required or permitted by law to do so.
Where providers process personal data on our behalf, we put written contracts in place requiring them to protect it and use it only as instructed.
8. Marketing communications
We will only send you marketing messages where you have asked us to, or where the law otherwise permits. Every marketing email contains an unsubscribe link, and you can opt out at any time by contacting us at patient@sportshealing.com. Opting out of marketing does not affect messages we need to send about a service you have requested.
9. International transfers
Your personal information, including any health information, is normally stored and processed in the United Kingdom.
The exception is the Google Analytics data described in section 6, which may be transferred to and processed on servers outside the UK, including in the United States. Where this happens, the transfer is protected by an appropriate safeguard recognised under UK law — such as the UK Extension to the EU–US Data Privacy Framework, or Google’s standard contractual clauses together with the UK International Data Transfer Addendum. Analytics data of this kind is collected only with your consent, and does not include your health information.
If we introduce any other provider that processes personal data outside the UK, we will ensure an equivalent safeguard is in place before doing so.
10. How long we keep your information
We keep personal information only for as long as necessary for the purposes set out above, and to meet our legal, regulatory and professional obligations.
Enquiry, booking and website data — including contact forms, correspondence and analytics data — is kept for three years, after which it is securely deleted or anonymised.
Clinical records are held on a secure, UK GDPR-compliant clinical records platform and are retained for 20 years, in line with applicable professional guidance and our indemnity requirements.
When information is no longer needed, we securely delete or anonymise it.
11. How we protect your information
We use appropriate technical and organisational measures — including secure hosting, access controls, encryption in transit, and staff confidentiality obligations — to protect your information against unauthorised access, loss or misuse. Clinical records are held on a secure, UK GDPR-compliant clinical records platform with restricted access. No transmission over the internet can be guaranteed to be completely secure, but we take reasonable steps to reduce the risks.
12. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your information (this policy);
- access a copy of the information we hold about you;
- have inaccurate information corrected;
- have your information erased in certain circumstances;
- restrict or object to certain processing;
- data portability, in certain circumstances;
- withdraw consent at any time, where we rely on consent; and
- not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you.
To exercise any of these rights, contact us at patient@sportshealing.com. We will respond within the time limits set by law (usually one month). You will not normally have to pay a fee.
13. Automated decision-making
We do not make decisions about you, your care or your treatment based solely on automated processing. Where technology such as artificial intelligence is used to assist with imaging or analysis, the results are always reviewed and interpreted by a qualified clinician.
14. Children’s privacy
The Websites are intended for adults. We do not knowingly collect information from children without appropriate consent. Where we provide care to a patient under 18, we handle their information in accordance with the law and our professional duties. If you believe a child has provided us with information without appropriate consent, please contact us so we can address it.
15. Third-party links
The Websites may contain links to other websites and services that we do not control. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before providing any information.
16. Changes to this policy
We may update this policy from time to time. The current version is always available on the Websites, and the “last updated” date at the top shows when it last changed. Significant changes will be made clear where appropriate.
17. How to contact us, and your right to complain
For any question about this policy or your information, or to exercise your rights, contact us:
- By email: patient@sportshealing.com
- By telephone: +44 (0)20 7483 5160
- By post: Sports Healing Ltd, Woodlands Grange, Woodlands Lane, Bradley Stoke, Bristol, England, BS32 4JY
If you have a concern, we would like the chance to resolve it, so please contact us first. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or on 0303 123 1113. Our ICO registration reference is ZA005873.