Flow State Physiotherapy • Privacy Notice
Privacy Notice
Flow State Physiotherapy
Last updated: 15 September 2026
Flow State Physiotherapy respects your privacy and is committed to protecting the personal information
you provide to us.
This Privacy Notice explains how we collect, use, store and protect your personal information when you
contact us, book an appointment, attend for physiotherapy treatment, make a payment or use our
website.
Flow State Physiotherapy operates in accordance with applicable Irish and European data protection
legislation, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
1. Who we are
Flow State Physiotherapy is a sole-practitioner physiotherapy practice operated by Morgan Sloggett.
For the purposes of data protection legislation, Morgan Sloggett / Flow State Physiotherapy is the data
controller responsible for your personal information.
Flow State Physiotherapy
Unit 9, Sligo Retail Park
Carrowroe
Co. Sligo
F91 N522
Ireland
Email: morgan@flowstatephysio.ie
Telephone: 083 082 8464
Website: flowstatephysio.ie
2. What information do we collect?
The information we collect depends on the services you use and your relationship with us.
Personal and contact information
• Your name
• Date of birth, where relevant
• Address, where necessary
• Telephone number
• Email address
• Emergency contact information, where appropriate
Appointment information
• Appointment dates and times
• Appointment history
Flow State Physiotherapy • Privacy Notice • Page 2
• Booking information
• Cancellation information
• Communications relating to appointments
Health and clinical information
In order to assess and treat you appropriately, we may collect information concerning your health,
including:
• Your medical history
• Current symptoms
• Previous injuries
• Relevant diagnoses
• Medication information where relevant
• Information about previous treatment
• Clinical assessment findings
• Treatment provided
• Rehabilitation and exercise programmes
• Treatment progress
• Relevant correspondence or information from other healthcare professionals
Health information is considered special-category personal data under Article 9 of the GDPR and
therefore receives additional protection.
Payment information
Flow State Physiotherapy accepts:
• Cash
• Card payments through a SumUp card terminal
We do not need to record or retain your full card details as part of your physiotherapy clinical record.
Insurance information
Where you use private health insurance, we may collect information necessary to administer or process
your claim.
• Vhi
• Laya Healthcare
• Irish Life Health
3. How do we collect your information?
• When you contact us by telephone
• When you book an appointment online
• When you attend an appointment
• During your assessment and treatment
• When you communicate with us by email
• When you provide information relating to an insurance claim
• Where relevant information is provided by another healthcare professional
• Where relevant information is provided by or through your health insurer
Flow State Physiotherapy • Privacy Notice • Page 3
• Through our website
4. Why do we use your information?
• Provide physiotherapy assessment, treatment and rehabilitation
• Maintain appropriate clinical records
• Manage appointments
• Send appointment reminders
• Communicate with you about your appointments and treatment
• Respond to enquiries
• Process payments
• Administer health-insurance claims
• Communicate with health insurers where necessary
• Communicate with other healthcare professionals involved in your care where appropriate and
lawful
• Meet our legal, professional and regulatory obligations
• Maintain appropriate business and financial records
• Deal with complaints or legal matters
• Protect the security of our systems and business
We only seek to collect information that is relevant and necessary for these purposes.
5. Our legal basis for processing your information
Under the GDPR, we must have a lawful basis for processing personal information. Depending on the
circumstances, we may rely on one or more of the following:
Provision of healthcare and treatment
Processing health information may be necessary for the provision of healthcare and treatment and may
be carried out under the applicable provisions of Article 9 GDPR, together with an appropriate Article 6
lawful basis.
Contract
We may process information where it is necessary to provide services you have requested or to take
steps at your request before providing those services.
Legal obligation
We may process information where necessary to comply with a legal obligation.
Legitimate interests
We may process information where it is necessary for our legitimate interests, such as managing and
protecting our business, maintaining appropriate records, preventing misuse and dealing with legal
matters, provided those interests are not overridden by your rights and freedoms.
Consent
Where we rely on consent for a particular processing activity, we will explain this to you and obtain your
consent where required.
Flow State Physiotherapy • Privacy Notice • Page 4
Your consent to receive physiotherapy treatment should not be confused with consent as a GDPR lawful
basis. We do not rely on GDPR consent as the blanket legal basis for all processing of your clinical
information.
6. Clinical confidentiality
We understand that information about your health and treatment is highly private.
As a sole-practitioner practice, access to your clinical information is currently restricted to Morgan
Sloggett, except where information needs to be processed or disclosed by an appropriate third party for
a legitimate and lawful purpose.
We will not disclose your clinical information unnecessarily.
Where information needs to be disclosed to another healthcare professional, insurer or other third
party, we will seek to ensure that there is an appropriate lawful basis and that only information
reasonably necessary for the relevant purpose is disclosed.
7. Cliniko
Flow State Physiotherapy uses Cliniko to manage appointments and maintain patient and clinical
records.
Information stored in Cliniko may include your:
• Contact information
• Appointment information
• Clinical history
• Assessment information
• Treatment notes
• Rehabilitation information
• Other information relevant to your care
Cliniko acts as a service provider/data processor in relation to patient information processed through
the platform. Cliniko provides GDPR-related documentation, including a Data Processing Addendum for
applicable European customers.
Cliniko currently states that accounts created in Europe have their account data stored in Ireland.
Access to your Flow State Physiotherapy Cliniko account is restricted appropriately, and Morgan
Sloggett is responsible for managing access to the records held within it.
8. Appointment reminders
We send appointment reminders by email approximately two days before your appointment.
An appointment reminder may include:
• Your name
• Appointment date
• Appointment time
• Basic appointment information
We do not ordinarily include detailed medical or clinical information in appointment reminder emails.
Flow State Physiotherapy • Privacy Notice • Page 5
If you do not wish to receive appointment reminders by email, please contact us at
morgan@flowstatephysio.ie. Please note that we may still need to communicate with you where
necessary for the management of your appointment or treatment.
9. Health insurers
Where you are using private health insurance, we may need to process and share relevant information
with your insurer to administer your claim.
Flow State Physiotherapy currently deals with:
• Vhi
• Laya Healthcare
• Irish Life Health
The information shared will be limited, where reasonably possible, to information necessary for the
relevant insurance or claims process.
10. Payments
Payments can be made by cash or by card using our SumUp card terminal.
When you make a card payment, your payment information is processed through SumUp and its
relevant payment systems.
Flow State Physiotherapy does not ordinarily retain your full payment-card details as part of your clinical
records.
11. Who else may receive your information?
We may disclose relevant personal information to appropriate third parties where there is a lawful basis
to do so. These may include:
• Health insurers
• Other healthcare professionals involved in your care
• Cliniko
• SumUp
• Email service providers
• Website hosting and technical service providers
• Professional advisers, where necessary
• Legal or regulatory authorities where we are legally required to provide information
We do not sell your personal or clinical information.
We do not share your health information for unrelated marketing purposes.
12. Website
Our website is flowstatephysio.ie.
When you visit our website, certain technical information may be processed as necessary to operate,
secure and maintain the website.
Depending on the technologies currently installed on the website, this may include information such as:
Flow State Physiotherapy • Privacy Notice • Page 6
• IP address
• Browser and device information
• Pages visited
• Technical information concerning your visit
• Cookie information
Cookies and analytics
The specific cookies and analytics technologies used by flowstatephysio.ie should be reviewed
separately to ensure that this section accurately reflects the website's current configuration.
Before publishing this Privacy Notice, you should check whether the website uses Google Analytics,
Google Tag Manager, Meta Pixel, embedded services, or other non-essential tracking technologies. If it
does, we recommend having a separate Cookie Notice/Cookie Policy alongside this Privacy Notice.
13. How we protect your information
We take reasonable technical and organisational measures to protect your personal information
against:
• Unauthorised access
• Unauthorised disclosure
• Accidental loss
• Destruction
• Alteration
• Unlawful processing
These measures include restricting access to patient information and using appropriate systems and
security controls.
Because health information is particularly sensitive, we take additional care when storing, accessing
and communicating clinical information.
14. How long do we keep your information?
We retain personal information only for as long as reasonably necessary for the purposes for which it
was collected and to meet applicable legal, professional, regulatory, insurance, accounting and clinical
requirements.
Different categories of information may therefore be retained for different periods.
In determining how long clinical records should be retained, we will consider applicable professional
requirements, legal obligations, insurance requirements and the legitimate clinical need for the records.
We will periodically review the information we hold and securely delete or dispose of information when
it is no longer required.
Note: The precise clinical-record retention period should be confirmed against the professional, legal,
regulatory and insurance requirements applicable to the practice before a specific number is inserted
into this notice.
15. Your rights under data protection law
Depending on the circumstances, you may have the following rights under the GDPR:
Flow State Physiotherapy • Privacy Notice • Page 7
Right of access
You can request a copy of personal information we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete information.
Right to erasure
In certain circumstances, you can request that your personal information be deleted. This right is not
absolute. For example, we may need to retain clinical records to comply with legal, professional,
regulatory or insurance requirements.
Right to restriction of processing
In certain circumstances, you can ask us to restrict how we process your information.
Right to data portability
In certain circumstances, you may request certain information you have provided to us in a structured,
commonly used and machine-readable format.
Right to object
You may have the right to object to certain processing activities.
Right to withdraw consent
Where we process information on the basis of your consent, you may withdraw that consent at any
time, although this does not affect the lawfulness of processing carried out before you withdrew your
consent.
The availability of these rights depends on the particular circumstances and the applicable GDPR
provisions.
16. Making a data protection request
If you wish to exercise one of your data protection rights or have a question about how we process your
information, please contact:
Morgan Sloggett
Flow State Physiotherapy
Unit 9, Sligo Retail Park
Carrowroe
Co. Sligo
F91 N522
Email: morgan@flowstatephysio.ie
Phone: 083 082 8464
We may need to verify your identity before providing or changing personal information, particularly
where sensitive health information is involved.
We will deal with requests within the timeframes required by applicable data protection law.
17. Data breaches
If we become aware of a personal data breach, we will take appropriate steps to:
Flow State Physiotherapy • Privacy Notice • Page 8
• Contain and investigate the breach.
• Assess the potential risks to affected individuals.
• Take steps to prevent further unauthorised access or disclosure.
• Notify the Data Protection Commission where required by law.
• Notify affected individuals where required by law.
• Document and review the incident and take appropriate corrective action.
18. International transfers
Where personal information is transferred outside the European Economic Area, we will ensure that an
appropriate legal mechanism and safeguards are in place where required by the GDPR.
For Cliniko specifically, Cliniko states that European accounts have data stored in Ireland and that it
provides GDPR documentation and appropriate transfer safeguards where applicable.
19. Marketing
Flow State Physiotherapy does not use your clinical information for marketing purposes.
We will not use information about your diagnosis, symptoms, treatment or health to send you targeted
marketing.
If we introduce marketing communications in the future, we will ensure that these comply with
applicable data protection and electronic communications requirements.
20. Children and young people
Where physiotherapy services are provided to a child or young person, we may process information
relating to both the patient and, where appropriate, their parent or legal guardian.
Additional safeguards may apply depending on the patient's age and circumstances.
21. Complaints
If you have concerns about how Flow State Physiotherapy has handled your personal information, we
encourage you to contact us first.
Morgan Sloggett
083 082 8464
We will consider your concern and attempt to resolve it appropriately.
You also have the right to make a complaint to the Data Protection Commission (DPC), Ireland's
supervisory authority for data protection.
The DPC recommends contacting the relevant data controller first and setting out your concern in
writing before making a complaint to the DPC.
Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland
Flow State Physiotherapy • Privacy Notice • Page 9
The DPC currently provides online, email, postal and telephone contact options.
22. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in:
• Our services
• The information we process
• The technology and systems we use
• Our service providers
• Applicable legislation or regulatory requirements
The latest version will be made available on our website.
Last updated: 15 September 2026
This document is a practical privacy-notice template prepared for Flow State Physiotherapy. It is not a substitute for
legal advice. The practice should ensure that the final notice matches its actual website configuration, service
providers, retention arrangements and professional/legal obligations.