Your health storystays yours.

Munaza Physio Studio ("the clinic", "we", "us") is a physiotherapy clinic at Hasham Street, Karim Block, Allama Iqbal Town, Lahore 54570, Pakistan, led by Dr. Munaza Ghani. The clinic decides why and how your personal information is used, and is responsible for it.

This policy applies to personal information we handle when you:

• visit munazaphysio.studio or booking.munazaphysio.studio;
• book, change or cancel an appointment, or contact us by phone, email, WhatsApp or our forms;
• receive care in the clinic, at a home visit, or by telehealth (video or audio);
• use the patient portal, including records, exercise programmes, assessments and the movement lab;
• leave a review, subscribe to our updates, or apply to work with us.

It does not cover websites or services run by others that we link to. Their own policies apply.

Identity and contact: name, date of birth, gender, phone number, email address, home address (for home visits), emergency contact, and, for a child or dependant, the details of the parent or guardian.

Health information: your medical history, symptoms, diagnoses, medications, assessment findings, treatment and clinical notes, outcome measures, vital signs, referrals, exercise programmes, and documents you upload, such as scans and reports. This is special, sensitive information and receives the highest protection in this policy.

Images and video: posture photographs, movement-lab recordings and other clinical images, only when you agree to them.

Appointments and payments: booking history, attendance, invoices and payment status. We do not store full card numbers.

Messages: what you send us through forms, email, WhatsApp or the portal, and our replies.

Reviews and feedback: reviews you choose to leave, and your preference on whether they are shown publicly.

Technical and security data: IP address, device and browser type, sign-in times, and security logs of access to clinical records. We keep these to protect your account and the clinic's systems.

We collect this information from you, from a parent or guardian, from clinicians who refer you with your agreement, and from the systems you use to reach us.

We use your information only for these purposes:

1. Your care: assessment, diagnosis, treatment planning, exercise programmes and follow-up, in the clinic, at home or by telehealth.
2. Clinical records: keeping complete and accurate records, as physiotherapy regulation and professional standards require.
3. Appointments and billing: booking, reminders, invoices and payments.
4. Communication: answering your questions and sending information about your care. We send updates or newsletters only if you opt in, and you can unsubscribe at any time.
5. Safety, security and quality: protecting your account, preventing misuse, investigating incidents, and improving our service using de-identified information.
6. Legal duties: complying with the laws of Pakistan, lawful requests from competent authorities, inspections by healthcare regulators, and establishing or defending legal claims.

Our legal basis. We rely on your consent (including explicit consent for health information), on what is necessary to provide the care you request, on our legal and regulatory obligations, on protecting your vital interests in an emergency, and on our legitimate interest in running a safe clinic, where that interest does not override your rights. We describe these bases using the vocabulary of GDPR Articles 6 and 9 because it is the clearest international benchmark. Our obligations arise under Pakistani law.

• Treatment: before assessment or treatment we explain what is proposed and ask for your informed consent. You may stop or decline any part of it at any time.
• Photographs and video: clinical images are taken only with your specific consent, by female clinicians, and are stored in your private record. They are never used in marketing without separate, written consent.
• Children and dependants: for patients under 18, a parent or legal guardian gives consent, and we involve the young person in decisions as far as their age and understanding allow.
• Withdrawing consent: you can withdraw consent by contacting us. This does not affect anything done lawfully before you withdrew, or records we must keep by law.

Although the clinic is in Pakistan, we adopt the eight Caldicott Principles used across the NHS as our internal standard for confidential health information:

1. Justify the purpose for every use of confidential information.
2. Use confidential information only when it is necessary.
3. Use the minimum information necessary.
4. Allow access only on a strict need-to-know basis.
5. Everyone with access understands their responsibilities.
6. Comply with the law.
7. The duty to share information for individual care is as important as the duty to protect patient confidentiality.
8. Inform patients and service users about how their confidential information is used.

Every clinician and staff member is bound by a duty of confidentiality that continues after they leave the clinic.

We share personal information only when necessary, and only the minimum required:

• Other healthcare professionals involved in your care, such as your doctor or a specialist, with your agreement, or without it only where it is needed to protect your life or someone else's.
• Service providers who host, store or deliver our systems on our instructions, bound by confidentiality and security obligations: our database host (Supabase), our file storage and network security provider (Cloudflare), our web host (Hostinger), and our email delivery provider. They may not use your information for their own purposes.
• Authorities and regulators, where a law of Pakistan, a court order, or a lawful request of a competent authority or regulator (including the Punjab Healthcare Commission) requires it. We check each request and disclose only what is lawfully required.
• Professional advisers, such as lawyers and insurers, where needed to establish, exercise or defend legal claims.
• Analytics and advertising platforms (Google, Microsoft, Meta, TikTok and Pinterest), only if you accept those cookies, and only for generic page visits and booking or contact taps, never health information (see clause 12).

We never sell your information, share it with advertisers or data brokers, or use it for marketing by anyone else.

To give you a secure, reliable service, some of our systems are operated by international providers:

• our clinical and booking database is hosted by Supabase in its Sydney, Australia region;
• files such as uploaded documents and clinical images are held in private Cloudflare storage, with public website images delivered through Cloudflare's network;
• the website is hosted by Hostinger.

Where information is stored or processed outside Pakistan, we protect it with encryption in transit, access controls, private storage, and contractual confidentiality and security terms with each provider. Storage abroad does not change the law that governs this policy: the laws of Pakistan continue to apply to how we handle your information.

We use technical and organisational measures appropriate to health information, including:

• encryption of all connections to our website and portal (HTTPS/TLS);
• encryption of selected sensitive fields in our database, and strongly hashed passwords;
• optional two-step verification for accounts;
• role-based access, so clinicians, staff and administrators see only what their role requires;
• audit logs recording access to clinical records and security events, reviewed for misuse;
• checking uploaded files for their true type, and keeping clinical files in private storage that cannot be opened by a public link;
• confidentiality duties and training for everyone with access.

No system can be guaranteed to be completely secure. If you think your account or information has been put at risk, contact us straight away.

We keep information only as long as necessary for the purpose it was collected for, and to meet our legal and professional duties. Our retention schedule follows the NHS Records Management Code of Practice as a benchmark, unless the law of Pakistan requires longer:

• Adult clinical records: at least 8 years after your last appointment.
• Records of children and young people: until the patient's 25th birthday, or 8 years after the last appointment, whichever is later.
• Movement-lab recordings: automatically deleted 45 days after capture, unless you ask us, or your clinician needs, to keep a specific recording in your clinical record.
• Enquiries that do not lead to an appointment: up to 24 months.
• Security and audit logs: for the period set in our security settings, and longer where needed to investigate an incident.

When the retention period ends, we securely delete or permanently anonymise the information.

Subject to the law of Pakistan, and to the duty to keep clinical records, you have the right to:

• access the information we hold about you and receive a copy;
• correct information that is inaccurate or incomplete;
• erase information we no longer need or are not required to keep;
• restrict or object to particular uses of your information;
• receive your information in a portable format;
• withdraw consent where we rely on it;
• complain to us, and, if you are not satisfied, to the relevant authority described in clause 15.

We respond within 30 days. We may need to confirm your identity first, and we will tell you if a request can only be partly met, for example because the law requires us to keep a clinical record. Requests are free, unless they are manifestly unfounded or excessive.

We treat patients under 18 only with the involvement and consent of a parent or legal guardian, who may exercise the rights in this policy on the child's behalf. We give weight to a young person's own views and confidentiality as their maturity allows, and we always act in the child's best interests. Our online services are not directed at children, who should use them only with a parent or guardian.

• Essential cookies keep you signed in to the patient portal, protect forms and accounts from misuse, and remember your cookie choice (the `mp_consent` cookie, kept for 180 days). The website cannot work safely without them, so they do not need consent.
• Analytics cookies (optional): Google Analytics 4 and Microsoft Clarity help us understand which pages are useful. IP addresses are anonymised, Google signals and ad personalisation are off, and Clarity masks the text on the page.
• Advertising cookies (optional): the Meta Pixel (Facebook and Instagram) with Meta's Conversions API, Microsoft Advertising (Bing UET), the TikTok Pixel and the Pinterest Tag measure whether our adverts lead to bookings.
• Only with your consent. No optional cookie is set and no optional tag loads until you choose on our cookie banner. Rejecting is as easy as accepting, and nothing is pre-selected.
• Never on health pages. Optional tags run only on our public information pages, never on booking, the patient portal, assessments, exercise programmes or sign-in, and they receive only generic events (a page visit, a Book tap, or a call, WhatsApp or email tap), never a condition, service or any health detail.
• Changing your mind. Use Cookie settings at the bottom of any page to change or withdraw your choice at any time. When you withdraw, we delete those providers' cookies from your browser.
• Proof of your choice. We record your choice, its version and the date against a random identifier stored in your consent cookie, with no IP address or account link, so we can show consent was given.
• How long. Provider cookies last as set by each provider (up to two years for Google Analytics) unless you withdraw consent or clear them. These providers may process data outside Pakistan under their own terms and privacy policies.

You can also clear or block cookies in your browser settings. Blocking essential cookies will prevent sign-in.

Where we record clinical specialties, qualifications and similar clinical concepts in coded form, we use SNOMED CT, the international clinical terminology maintained by SNOMED International. Standard coding improves accuracy and consistency and supports safe continuity of care. Coded information is subject to the same confidentiality, sharing and retention rules as the rest of your record. It is never shared outside your care without a lawful basis.

If a personal data breach occurs, we will act at once to contain it and assess the risk. Where a breach is likely to put your rights and freedoms at risk, we will inform you without undue delay, telling you what happened, what information was involved, what we are doing, and what you can do to protect yourself. We will notify the relevant authorities where the law of Pakistan requires it. As a benchmark, we aim to complete our assessment within 72 hours of becoming aware of a breach.

Please contact our privacy lead first (see Contact below). We will acknowledge your complaint within 5 working days and aim to resolve it within 30 days.

If you remain unsatisfied, you may raise a concern with the Punjab Healthcare Commission, which regulates healthcare establishments in Punjab; with the Pakistan Allied Health Professionals Council about a clinician's professional conduct; or seek a remedy before the competent courts of Pakistan, as set out in the governing-law clause.

To the fullest extent permitted by the laws of Pakistan:

• the clinic is not responsible for the privacy practices or content of third-party websites, platforms or apps, including those we link to or embed;
• the clinic is not responsible for information you choose to make public, for example in a public review;
• the clinic is not liable for loss caused by events beyond its reasonable control, or by unauthorised access that occurs despite the reasonable security measures described in this policy;
• you are responsible for keeping your portal password and devices secure, and for telling us promptly if you suspect misuse.

Nothing in this policy excludes or limits any liability that cannot be excluded or limited under the laws of Pakistan.

We review this policy at least once a year and whenever the law or our services change. The version number and effective date at the top of this page show the current version. If we make a material change, we will tell you through the website, the portal or by email before it takes effect. Previous versions are available on request.

This Privacy Policy, and any dispute or claim arising out of or in connection with it or its subject matter, is governed by and construed in accordance with the laws of the Islamic Republic of Pakistan.

The courts at Lahore, Punjab, have exclusive jurisdiction, and you and the clinic submit to that jurisdiction.

No foreign law governs this policy, and no foreign court, tribunal, regulator or supervisory authority has jurisdiction over it. References in this policy to the GDPR, the NHS, the Caldicott Principles, SNOMED CT, ISO/IEC 27001 or other international instruments describe standards the clinic follows voluntarily as good practice. They do not incorporate any foreign law into this policy, and they do not submit the clinic to any foreign jurisdiction.

If any part of this policy conflicts with a mandatory law of Pakistan, that law prevails, and the rest of the policy remains in force. Where this policy is translated, the English version prevails.