Privacy policy.

Rebecca Gomes is a sports therapist and MSK consultant, trading as a sole practitioner. She is the data controller for personal information collected through this website and during consultations.

If you have any question about how your data is handled, or if you'd like to exercise any of the rights described below, contact support@rebeccagomes.com.

When you use the contact form we collect the name, email address, phone number (optional), subject line (optional) and message you submit, along with the topic category you select.

When you book an online consultation, Setmore collects the details you provide directly on their platform — typically name, email address, phone number and payment details (processed by Stripe). Rebecca receives your booking details from Setmore to prepare for and deliver the consultation. Setmore is a separate data controller for the information you enter on their site.

When you attend a consultation — online via doxy.me or in person — Rebecca creates and maintains clinical records that include your presenting complaint, relevant medical history, examination findings, treatment or rehabilitation plan, exercise programmes, and any communications relating to your care.

When you visit this website we collect anonymous, cookieless usage information via Vercel Web Analytics — country, device type, page path and referring site. This data is aggregated for statistical reporting and cannot be linked back to you individually.

Personal data collected through the contact form is used solely to reply to your enquiry.

Booking and clinical data is used to schedule, prepare for, deliver, follow up on and record your treatment; to comply with clinical record-keeping obligations; to process payments; and to communicate with you about your appointments.

Anonymous website analytics is used to understand which pages are useful to patients and to improve the site.

We do not use your personal data for marketing, do not sell it to third parties, and do not use it for any purpose you have not been informed of.

Different processing activities rely on different legal bases under the UK GDPR and EU GDPR:

• Contract — to deliver the consultation and treatment you have booked, and to process payment.
• Legal obligation — to keep clinical records for the periods required by professional-body guidance and applicable law.
• Legitimate interests — to run the practice efficiently and to understand aggregate site usage, where those interests are not overridden by your rights.
• Consent — for any onward sharing with another clinician (see below).

Clinical information is special-category data under Article 9 of the UK and EU GDPR. It is processed under Article 9(2)(h) for the provision of health care.

We do not sell your data. We share information only where necessary, and only with parties bound by contract or by law to protect it. The regular recipients are:

• Setmore — appointment scheduling. Setmore holds the booking data you enter on their platform.
• Stripe — payment processing at the point of booking, integrated with Setmore.
• doxy.me — the video-conferencing platform used for online consultations. Doxy.me is HIPAA and GDPR-compliant; no consultation content is recorded or stored on their servers.
• Vercel — hosting for this website and for the private admin tools used to maintain clinical records.
• Neon — the managed Postgres database on which those clinical records are stored.
• Infomaniak — the email delivery service used for messages sent through the contact form.
• Referring or receiving clinicians (with your consent) — for example, your GP, a consultant, or a surgeon, where continuity of care benefits from the exchange. We ask before making any such referral.
• HMRC or the Portuguese tax authority — where legally required for tax and financial-record purposes.

We do not disclose personal or clinical data to insurers unless you specifically authorise it.

Some of the processors listed above are based in the United States (Vercel, Stripe, Setmore, doxy.me, Neon). Transfers of personal data outside the UK and EEA are made in reliance on the UK's approved data-protection safeguards — typically the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. Your rights under UK GDPR and EU GDPR are not diminished by these transfers.

• Clinical records — eight years from your last appointment for adult patients. For patients under 18, records are held until the patient reaches age 25, or eight years after the last appointment, whichever is later. Follows the Society of Sports Therapists retention guidance.
• Contact-form messages — twelve months from the last exchange, unless you become a patient, at which point the exchange is added to your clinical record.
• Financial records — six years from the end of the relevant tax year, per HMRC requirements.
• Website analytics — aggregated only; no personal data is retained.

You have the right, subject to some exceptions, to:

• access the personal data we hold about you
• rectify inaccurate or incomplete data
• erase data where we have no ongoing lawful reason to keep it (subject to the clinical-record retention periods above)
• restrict processing while a challenge is being resolved
• object to processing based on legitimate interests
• withdraw consent at any time, where processing was based on consent (this does not affect processing already carried out)
• receive a machine-readable copy of data you provided under contract or consent (data portability)

To exercise any of these rights, email support@rebeccagomes.com. We aim to respond within one calendar month. There is no charge for a first request; we may charge a reasonable fee for repeat or manifestly excessive requests.

This website does not set tracking cookies for visitors. Vercel Web Analytics operates without cookies — it derives an anonymous daily visitor fingerprint that cannot be traced back to you, and the underlying salt rotates every 24 hours.

The only cookies set by this site are session cookies for the private admin area, which is not accessible to patients. If you use Setmore to book, Stripe to pay, or doxy.me to attend a consultation, those services set their own cookies and are governed by their own privacy policies.

Clinical records are stored in an encrypted database. Data in transit between your browser and this site is encrypted using HTTPS/TLS. Access to the admin area is restricted to Rebecca alone via password authentication. Backups are held by the database provider.

No system is entirely immune to compromise, and we cannot guarantee absolute security. In the event of a personal-data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.

If you are unhappy with how your personal data has been handled, contact us first at support@rebeccagomes.com and we will try to resolve the issue.

You also have the right to lodge a complaint with a data-protection regulator:

• United Kingdom — Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113
• Portugal — Comissão Nacional de Protecção de Dados (CNPD): cnpd.pt / +351 213 928 400

We review this policy at least once a year. Material changes — those affecting your rights or how your data is used — will be flagged on the website. The current version is always available at rebeccagomes.com/privacy with the date of last update shown below.