Privacy Policy & General Data Protection Regulation (GDPR)
Elena Terron Arranz collects personal details and information relating to my patients’ health. Medical information is classed as sensitive data and termed as special category data under the General Protection Data Regulations (GDPR), effective 25th May 2018. This document advises you of our policies and procedures for dealing with your personal and medical information.
Why is information collected?
The processing of personal and medical data is necessary so that we can deliver the best quality of physiotherapy care to you. I keep this information as details of successful treatments plans and previous rehabilitation strategies may improve the understanding and inform future injuries that you may present with, which is of benefit to you when you return to us with a recurring injury.
I use your email address and mobile number to contact you with your receipts, your appointments remainders, and home exercises plans, and to follow up with you during the management of your injury.
Who has access to your information?
Elena Terron Arranz has access to client records. Elena Terron Arranz is bound by GDPR legislation, the Irish Society of Chartered Physiotherapy (ISCP) code of conduct, and the standards of conduct, performance and ethics of CORU (Regulating Health & Social Care Professionals). Data may be shared with patients GP or other referring source, and will only be shared with other third parties with the written consent of the patient as set out in this policy.
How is your information stored and protected?
Your personal information and treatment notes are securely hosted on Cliniko, a physiotherapy specific practice management software package. Cliniko’s servers are located in Australia; this international transfer of data is safeguarded by Standard Contractual Clauses under Cliniko’s Data Processing Agreement, as permitted under GDPR.
Data retention period
I hold onto a patient’s personal information and medical records for a period of 7 years after their last treatment, or at the date of death.
Where treatment is provided to a patient under 18 years of age, records are retained until the patient’s 25th birthday (or their 26th birthday if they were 17 years old at the conclusion of treatment), or for 8 years after the patient’s death if this occurs before adulthood — in line with guidance from the Medical Council of Ireland and standard practice for allied health professionals.
Your rights
Under the General Data Protection Regulation, you have the right to access the personal data I hold about you; to rectify any inaccurate or incomplete personal data; to request erasure of your personal data, where applicable; to restrict the processing of your personal data in certain circumstances; to object to processing based on legitimate interest; to request portability of your data in a structured, commonly used format; and to withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal. To exercise any of these rights, please contact me at info@axiosphysio.com.
How to make a complaint
If you are unhappy with how your personal data has been handled, you have the right to lodge a complaint with the Data Protection Commission (DPC), the supervisory authority in Ireland: 21 Fitzwilliam Square South, Dublin 2, D02 RD28. Phone: 01 765 0100 / 1800 437 737. Web: www.dataprotection.ie.
Data collected through this website
In addition to clinical data collected during treatment, this website collects limited personal data when you use the contact form (your name, email address and message) in order to respond to your enquiry. This data is stored on our website’s hosting server and is not used for any other purpose. This website also uses Google Maps to show our clinic location, WhatsApp (Meta) for the click-to-chat button, and a Google Reviews widget to display patient reviews — these third-party services may set their own cookies and process data according to their own privacy policies. Where these services require your consent, this will be requested via the cookie banner on this website.
Children and minors
Where a patient is under 18 years of age, consent for treatment and for the processing of personal and medical data is obtained from a parent or legal guardian, in line with ISCP and CORU guidance.
Last updated
This policy was last updated on 21 August 2026.
