Physiopedia:Privacy Policy
PRIVACY POLICY
This privacy policy applies to Physiopedia (charity number 1173185, company number 08530802) (“we”, “us”, “our” or “Physiopedia”). We are the data controller responsible for your personal data processed through the website at www.physio-pedia.com (the “Site”, as further described in Section 1 below). We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy, together with our Terms of Service (and any other documents referred to in them), sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand how we collect, use, and safeguard your personal data.
Our registered office is at 86-90 Paul Street, London, EC2A 4NE, United Kingdom. You can contact us regarding data protection matters by emailing [email protected].
For definitions of terms used in this Privacy Policy and FAQs, see Section 20.
1. What This Privacy Policy Covers
This Privacy Policy pertains to the use of the Site, and (i) the information and materials made available on the Site (the “Physiopedia Wiki”); and (ii) the related Physiopedia services, (collectively, the “Physiopedia Service”), and covers how Physiopedia treats personal data that it collects and receives from its users.
This Privacy Policy is incorporated into and is subject to the Physiopedia Terms of Service. Your use of the Site, the Physiopedia Service and any information you provide on the Site is subject to the terms of this Privacy Policy and the Physiopedia Terms of Service.
Under the UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases we rely on are as follows:
(a) Contract performance (Article 6(1)(b) UK GDPR): where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract — for example, to provide you with access to the Site and the Physiopedia Service, to administer your account as a registered editor (an “Editor”, as further described in Section 3.2), and to respond to your enquiries.
(b) Legitimate interests (Article 6(1)(f) UK GDPR): where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests — for example, to maintain and improve the Site, to analyse website traffic, to prevent fraud and abuse, to enforce our Terms of Service, to share information with professional associations in furtherance of our charitable objectives, and to send you communications about the Physiopedia Service.
(c) Legal obligation (Article 6(1)(c) UK GDPR): where processing is necessary for us to comply with a legal obligation — for example, to respond to lawful requests from law enforcement or regulatory authorities.
(d) Consent (Article 6(1)(a) UK GDPR): where you have given clear consent for us to process your personal data for a specific purpose — for example, to send you marketing communications or newsletters where we are required to obtain consent. Where we rely on consent, you have the right to withdraw it at any time by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
2. What This Privacy Policy Doesn’t Cover
2.1 Third Party Websites
This Privacy Policy applies only to the Site, the Physiopedia Service and any other websites and services that are owned and operated by us from time to time. We do not exercise control over third party websites linked to or from within the Site. These third party sites may place their own cookies or other files on your computer or other device, collect data or solicit information from you. You are encouraged to read their privacy policies before you enter into an exchange with them.
2.2 Advertisements
We automatically receive your IP address when you visit the Site. We use this technology to send, directly to your browser, the advertisements and related links that appear on the Site. We may also use other technologies (such as cookies, JavaScript, or web beacons) to measure the effectiveness of the advertisements and to personalise the advertising content (including pop-up adverts) to a certain audience.
Where such technologies require your consent under the Privacy and Electronic Communications Regulations 2003 (PECR), we will obtain your consent via our cookie consent mechanism before deploying them. The lawful basis for processing your IP address for the purpose of serving contextual advertisements is our legitimate interest in funding the Site’s free educational content (Article 6(1)(f) UK GDPR). Where personalised advertising is used, we will obtain your consent in accordance with PECR and the UK GDPR before doing so.
See our Cookie Policy for further details.
3. The Information We Collect and How It Is Used
3.1 General
The information we collect is set out in this Section 3. Failure to provide such information may mean that you are unable to receive the Physiopedia Service or register as an Editor.
You do not need to register for a Physiopedia account in order to visit and use the Site; however, you must register to be an Editor. For these no-registration-required services, we collect the following information:
General: You may give us information about you by filling in forms on our Site or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you fill in the contact form, apply for a Physiopedia account, register for an online course or event, or other social media functions on our Site, enter a competition, promotion or survey, and when you report a problem with our site. The information you give us may include your name, address, e-mail address and phone number, personal description and professional information.
Cookies: The Site uses cookies to distinguish you from other users of the Site. This helps Physiopedia to provide you with a good experience when you browse the Site and also allows us to improve the Site. For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy.
E-mail Messages: If you send an e-mail to Physiopedia, we may retain those communications and your e-mail address in order to reply to your enquiries, fulfil your requests and to improve our services.
To the extent that you submit to us any personal data belonging to third parties, you warrant that you have the consent of that third party to submit such data to us, including for such uses described in this Privacy Policy.
3.2 Additional information collected from Editors
In order to contribute content to the Site you must register as an Editor (see the Terms of Service). We collect the non-personal data described above at Section 3.1 from Editors, and in addition, we collect the following types of personal data from Editors for the following purposes (personal data is data that personally identifies you, such as your name, e-mail address or other data which can be reasonably linked to such information):
Information you provide: When you register to become an Editor, Physiopedia asks you for certain personal data. Examples of such data include your full name, e-mail address, professional credentials and the profile information described below. We use the personal data that you provide to verify your professional credentials, respond to your questions, provide you the specific services you select, send you emails about Site maintenance and updates, and inform you of significant changes to this Privacy Policy.
Profile Information: Editors must disclose in their public profiles their professional credentials, corporate and academic affiliations, and they must disclose if they receive, or expect to receive, any form of compensation for the content they contribute to Physiopedia, or any compensation related to medicine, medical information, or products and services related to the body. This is standard practice in the medical field and those policies carry over to the Physiopedia community, and are meant to encourage a “neutral point of view” with respect to Physiopedia contributions.
Your IP Address: In addition to your profile, you may also be identified in our system by your IP address, the numerical address of the location from which you are connecting to the Site. That IP address may be traceable specifically to your computer, or it may only be traceable to the Internet Service Provider (ISP) you use to access the Internet, depending on what type of connection you have. In either case, we will have the ability to link your IP address to your contributions on the Site, which helps to prevent abuse and fraud.
Contributions: When Editors submit content to the Site, that information becomes publicly available throughout the world via the Site, and each such “post” will be attached to the Editor’s profile. Our policy is to store this material indefinitely and to ensure that it is always publicly viewable. Removing content from a Physiopedia article does not permanently delete that content. This does not affect any of your rights under applicable law. The features of the Site permit anyone to retrieve a previous version of an article and, if requested, may allow people to see content that was previously deleted. If the article itself is deleted, a copy will permanently remain on the Physiopedia servers and be accessible by Physiopedia personnel (again, this does not affect any of your rights under applicable law).
Other Data: In order to maintain an open and transparent community, certain other data on Editors is made public through “user contributions” lists and by other users, typically in aggregated form. Such data might include the times at which an Editor edited content on the Site and the number of edits they made.
E-mail: Other Editors may send e-mail to you through the Physiopedia Service; however, your e-mail address will not be revealed to them unless you respond, or possibly if their e-mail to you is “bounced” back to them. We may use Editors’ e-mail addresses to communicate with them periodically.
Invitation E-mails: You may choose to opt-out of Physiopedia invitation e-mails by clicking the unsubscribe link at the bottom of the invitation e-mail.
Links: We may present links in a format that enables us to keep track of when these links are clicked. We use this information to improve the quality of the Physiopedia Service, to estimate traffic we send to third party sites, and to customise content and advertising.
Your Contacts: In order to invite others to connect with you directly in Physiopedia, you may enter their names and e-mail addresses. This information will be used by us to send your invitation including a message that you write. The names and e-mail addresses of people that you invite will be used only to send your invitation and reminders. You may also choose to manually enter or upload data about your contacts on Physiopedia. All information entered as private will only be viewable by you and will not be searchable by others in the Physiopedia network without your permission. All information that you enter or upload about your contacts will be covered by the same terms of this Privacy Policy as cover your own personal data. If you enter the names and e-mail addresses of any such third parties, you warrant that you have the consent of such third party to enter such personal data and thereby submit it to us.
3.3 Use of interaction data by AI systems
Where you interact with the Site or the Physiopedia Service (for example, by conducting searches, browsing content, or using any AI-powered features such as the Physiopedia AI Assistant), we may collect and process data relating to your interactions (such as search queries, pages visited, and feature usage patterns). This interaction data may be used to maintain, improve, and develop the Physiopedia Service, including to train, improve, and operate AI and machine learning systems that form part of the Physiopedia Service. We process this interaction data on the basis of our legitimate interests in improving the quality, relevance, and functionality of the Physiopedia Service (Article 6(1)(f) UK GDPR). Where interaction data is used for AI training purposes, it will be aggregated or anonymised wherever reasonably practicable. To the extent that any interaction data constitutes personal data and is used in connection with AI systems, we will ensure that appropriate safeguards are in place, including data minimisation and purpose limitation.
4. Physiopedia Plus
Please refer to the Physiopedia Plus terms and conditions and privacy and cookie policy (operated by Physiopedia International SL), a company registered in Andorra, which set out how personal data is used for the purpose of receiving the Physiopedia Plus services. The Physiopedia Plus platform is operated separately by Physiopedia International SL and is subject to its own privacy documentation.
5. Public Areas of Physiopedia
The Site is open to public viewing. Any information shared (including personal data) that you reveal is by design open to the public and is not a private, secure service. You should think carefully before disclosing any personal data. What you have written may be seen, disclosed to, or collected by third parties and may be used by others in ways we are unable to control or predict, including to contact you for unauthorised purposes. As with any public forum on any site, this information may also appear in third-party search engines.
Sharing of information between Physiopedia entities
Where you also use the Physiopedia Plus platform (operated by Physiopedia International SL), information (both personal and non-personal data) may be shared between Physiopedia and Physiopedia International SL in order to provide or improve services. Any such sharing is carried out on the basis of our legitimate interests in operating the Physiopedia ecosystem and providing integrated services to our users. Physiopedia International SL processes such data in accordance with its own privacy policy.
Sharing of information with professional associations
We may share personal data with professional associations, such as the World Confederation of Physical Therapy, for example, to recommend individuals for professional services, awards and to suggest that individuals are invited to present at conferences. We require that such parties agree to process such data in compliance with this Privacy Policy, and to take reasonable confidentiality and security measures with respect to such data.
Operations and Maintenance Contractors
Our authorised service providers sometimes have limited access to your personal data in the course of providing products or services to Physiopedia. These service providers include vendors and suppliers that provide us with technology, hosting, and/or content delivery services for the operation and maintenance of the Site. Access to your personal data by these service providers is limited to the information reasonably necessary for them to perform their functions on our behalf. We require all service providers to process personal data only on our instructions, to maintain appropriate security measures, and not to use your personal data for any purpose other than providing services to us.
Advertising and Promotions
We may share non-personal data (such as anonymous website use data) with third parties to assist them in understanding the Site, including usage of the Site and the services we provide, and the success of advertisements and promotions.
Legal Requirements
We may disclose your personal data where we are required to do so by law or regulation, in order to comply with any court order or legal process, or in order to enforce or apply our Terms of Service and other agreements; or to protect the rights, property, or safety of Physiopedia, our users, or others.
Breach of Physiopedia Terms
We also reserve the right to disclose personal data that we believe is appropriate or necessary to enforce our Terms of Service, take precautions against liability, to investigate and defend ourselves against any third-party claims or allegations, to assist government enforcement agencies, to protect the security or integrity of the Site, and to exercise or protect our rights, property, or the personal safety of Physiopedia, our users, or others.
Other
In the event that Physiopedia is acquired by or merged with a third party entity, we reserve the right to transfer or assign the information we have collected from you as part of such merger, acquisition, sale, or other change of control. If Physiopedia is involved in a change of control, we will provide notice before personal data becomes subject to a different privacy policy.
In the unlikely event of Physiopedia’s bankruptcy, insolvency, reorganisation, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors' rights generally, we may not be able to control how your personal data is treated, transferred, or used.
Except as described in this Privacy Policy, we will not share your personal data with third parties unless we have a lawful basis for doing so.
Where we share your personal data with Physiopedia International SL or any other third party as described in this Section 6, we do so only where we have identified a lawful basis for the sharing as set out in Section 1 above.
Please contact us for any additional questions about the management or use of personal data.
7. Your Rights Under Data Protection Law
Under the UK GDPR, you have the following rights in relation to your personal data:
(a) Right of access — you have the right to request a copy of the personal data we hold about you (a “subject access request”). We will respond within one month of receiving your request. There is no fee for this unless your request is manifestly unfounded or excessive.
(b) Right to rectification — you have the right to request that we correct any inaccurate personal data, or complete any incomplete personal data, that we hold about you.
(c) Right to erasure — you have the right to request that we delete your personal data in certain circumstances, for example where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent (where consent is the lawful basis for processing). Please note that this right is not absolute and is subject to certain exceptions, including where we need to retain data to comply with legal obligations or for the establishment, exercise, or defence of legal claims.
(d) Right to restriction of processing — you have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or where you have objected to processing pending verification of our legitimate grounds.
(e) Right to data portability — where we process your personal data on the basis of your consent or for the performance of a contract, and processing is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
(f) Right to object — where we process your personal data on the basis of legitimate interests, you have the right to object to such processing. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims. You have an absolute right to object to processing for direct marketing purposes at any time.
(g) Right to withdraw consent — where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
To exercise any of the above rights, please contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive a large number of requests, we may extend this period by up to two further months, but we will notify you of any such extension within the first month.
(h) Right to complain — you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at any time if you are not satisfied with how we handle your personal data. The ICO can be contacted at https://ico.org.uk or by telephone on 0303 123 1113.
8. Where We Store Your Personal Data
The personal data that we collect from you is primarily stored on secure servers located in the United Kingdom. Where it is necessary to transfer your data outside the United Kingdom (for example, to third-party service providers who assist us in operating the Site), we will ensure that appropriate safeguards are in place to protect your personal data in accordance with UK data protection law. Such safeguards may include the use of UK International Data Transfer Agreements, adequacy regulations, or other approved transfer mechanisms.
All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
9. Information Security
Unfortunately, the transmission of information via the internet is not completely secure. Although Physiopedia does its best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our Site; any transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access.
10. How Long We Store Your Personal Data
We will retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Specifically:
10.1 In respect of Editors, we will retain your personal data:
(a) for the period during which you are registered as an Editor, and for a reasonable period thereafter to the extent necessary to credit your contributions; and
(b) Your name and attribution data may be retained indefinitely in connection with articles and other works on the Site for such period as such works remain publicly available, as this is necessary for the integrity of the collaborative knowledge base and is in the public interest.
10.2 In respect of personal data collected for any other purposes: only for such period as is necessary to fulfil the purposes for which it was collected (for example, to respond to an enquiry or to complete a transaction), after which it will be securely deleted or anonymised unless a longer retention period is required by law.
11. Updating Personal Data
You may update your personal data by visiting your profile page or contacting us.
12. Access to Personal Data
You have the right to request access to the personal data we hold about you (see Section 7 above for full details of your rights). To make a subject access request, please contact us at [email protected]. We will respond within one month. We will not charge a fee for responding to a subject access request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.
13. Complaints, Problems and Correcting and Removing Personal Data
If you have a complaint or problem, or would like any personal data relating to you corrected or deleted, please e-mail us at [email protected]. We will forward your complaint, problem, or request to the appropriate internal Physiopedia department for a response or resolution. Personal data will be corrected or deleted, as applicable, as soon as possible following receipt of the request. We try to answer every e-mail within two business days, but may not always be able to do so.
If you do not receive adequate resolution of a privacy-related problem, you may write to Physiopedia’s Privacy Office at:
Physiopedia, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.
We will notify you within 30 days of receipt of your letter to confirm that your personal data has been corrected or removed.
You may also lodge a complaint with the UK Information Commissioner’s Office (http://ico.org.uk).
14. Limitations on Removing or Changing Personal Data
Upon your request, we will delete your personal data from our active databases and, where feasible, from our back-up media. You should be aware that it may not be technologically possible to remove each and every record of the personal data you have provided to Physiopedia from our servers.
15. Notification of Data Breaches
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 of the UK GDPR. We will also report qualifying breaches to the Information Commissioner’s Office within 72 hours of becoming aware of the breach, in accordance with Article 33 of the UK GDPR.
16. Our Commitment to Children's Privacy
Protecting the privacy of children is especially important. No part of the Site is directed to persons under 16. If you are under 16 years of age, then please do not use or access the Site at any time or in any manner. Physiopedia does not knowingly collect personal data on the Site from persons under 16 years of age. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data as soon as reasonably practicable.
17. International Users
The Site is hosted in the United Kingdom and is primarily intended for users in the United Kingdom. If you are accessing the Site from outside the United Kingdom, please be aware that your personal data may be transferred to and processed in the United Kingdom. The United Kingdom has data protection laws that provide safeguards for your personal data. By continuing to use the Site, you acknowledge this transfer. Where we transfer your personal data to countries outside the United Kingdom that do not benefit from adequacy regulations, we will ensure appropriate safeguards are in place as described in Section 8 above.
18. Changes to This Policy
This Privacy Policy may change from time to time. Where we make material changes to this Privacy Policy, we will use reasonable endeavours to notify registered users by email and/or by prominent notice on the Site at least 30 days before the changes take effect. Please revisit this page periodically to stay aware of any such changes.
Your continued use of the Site after the expiry of the notice period will constitute your acceptance of the updated Privacy Policy. If you do not agree to any changes, you should cease using the Site and may request deletion of your account and personal data in accordance with Section 7 above.
19. Contact
For more information about Physiopedia privacy practices, or if you have any questions about this Privacy Policy, please e-mail [email protected] or write to this address:
Physiopedia, 86-90 Paul Street, London, EC2A 4NE, United Kingdom.
20. Physiopedia Privacy Policy Definitions and FAQ
20.1 What is Personal Data?
We define “personal data” as data that personally identifies you, such as your name, e-mail address, home address, phone numbers, or other data which can be reasonably linked to such information.
20.2 What is Non-Personal Data?
We define “non-personal data” as data which does not identify individuals, whether on its own or in conjunction with other data collected by us. This includes data that is collected from many people, anonymised and aggregated into groups so that individual users cannot be identified.
20.3 What is Collected Data?
We define “collected data” as both the personal and non-personal data that we collect from users.
20.4 What is a Physiopedia Account?
In order for you to use some Physiopedia services, we need to be able to authenticate you and protect your preferences and personal data from unauthorised access. To do that, we ask that you sign up for a unique account, typically secured by your unique e-mail address, a password, and your name. No account information is shared with anyone other than Physiopedia, except as specified in this Privacy Policy or with your consent.