Privacy Policy

AG Sports Massage & Manual Therapy
Last updated: 19 September 2026

1. Who we are

Anne Geraghty, trading as AG Sports Massage & Manual Therapy, is the data controller responsible for the personal data described in this Privacy Policy.

Clinic address: AG Sports Massage & Manual Therapy, Thurles Physiotherapy & Sports Injury Clinic, 22 Castle Avenue, Thurles, Co. Tipperary, E41 C9W4, Ireland
Telephone: 085 257 2569
Email: info@agsportsmassage.com
Website: www.agsportsmassage.com

This Privacy Policy explains what personal data we collect, why we use it, how it is protected and the rights you have under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

2. Information we collect

Depending on how you contact us and which services you use, we may collect:

• Identity and contact information, including your name, address, date of birth, telephone number, email address and emergency contact details.

• Booking information, including appointment dates, services booked, attendance, cancellations, reminders and booking history.

• Health and treatment information, including relevant medical history, current symptoms, injuries, medications, allergies, pregnancy information, GP details, information about other healthcare providers, consultation forms, body charts, treatment plans, consent records and treatment notes.

• Payment and transaction information, including amounts paid, payment method, receipts, invoices, gift-card purchases and refunds. We do not normally receive or retain your complete payment-card details, which are processed by the relevant payment provider.

• Communications, including emails, contact-form enquiries, telephone messages, text messages and correspondence relating to your care or appointments.

• Marketing preferences, including whether you have chosen to receive newsletters or promotional communications.

• Website and device information, such as your IP address, browser type, device information and cookie choices, where collected through our website.

• Information concerning a child or young person, including relevant health, treatment and parent or guardian details where applicable.

Health information is special-category personal data and receives additional protection under GDPR.

3. How we collect information

We collect personal data:

• directly from you when you contact us, complete a consultation form, book or attend an appointment, purchase a gift card, make a payment or subscribe to communications;

• from a parent, guardian or person booking on your behalf;

• through our website, online booking system and clinic-management system;

• from a healthcare professional or other referrer where you have authorised the referral or where another lawful basis applies; and

• automatically through essential website technologies and, where you have consented, analytics or advertising cookies.

Please ensure that information you provide is accurate and tell us if relevant information changes.

4. Why we use your information and our legal bases

We only use personal data when we have a lawful reason to do so.

Responding to enquiries and taking steps before a booking

Legal basis: Steps taken at your request before entering a contract, and our legitimate interests in responding to enquiries.

Creating, managing and administering appointments

Legal basis: Performance of our contract with you.

Sending appointment confirmations, reminders and essential service messages

Legal basis: Performance of our contract and our legitimate interests in managing appointments and reducing missed appointments.

Providing safe, appropriate treatment and maintaining clinical records

Legal basis: Performance of our contract with you. For health data, we rely on your explicit consent under Article 9(2)(a) GDPR.

Using information where necessary to establish, exercise or defend a legal claim

Legal basis: Our legitimate interests and Article 9(2)(f) GDPR where health data is involved.

Processing payments, issuing receipts and maintaining tax and accounting records

Legal basis: Performance of our contract and compliance with legal obligations.

Protecting our website, systems, clients and business against misuse or fraud

Legal basis: Our legitimate interests in maintaining security and protecting legal rights.

Sending optional newsletters and promotional messages

Legal basis: Your consent, which you may withdraw at any time.

Using non-essential analytics or advertising cookies

Legal basis: Your consent through our website’s cookie controls.

Using Heidi Health to assist with drafting treatment notes

Legal basis: Your specific, optional consent. For health data, we rely on your explicit consent under Article 9(2)(a) GDPR.

Complying with legislation, court orders or lawful requests

Legal basis: Compliance with a legal obligation.

Providing basic contact, booking and relevant health information is necessary for us to arrange and safely provide treatment. If required information is not provided, we may be unable to accept a booking or provide a particular treatment.

Consent to marketing, non-essential cookies and the use of Heidi Health is optional and is not a condition of receiving treatment.

5. Clinical records and consultation information

We maintain consultation and treatment records so that we can provide safe, consistent care, monitor treatment and meet professional, insurance and legal requirements.

Clinical records may be held securely in electronic form through WriteUpp and, where applicable, in paper files. Access is limited to Anne Geraghty and authorised staff who require access for their duties. Authorised staff are subject to confidentiality obligations and receive appropriate data-protection training.

We will not disclose treatment information to a GP, physiotherapist, other healthcare professional or family member without your permission unless disclosure is required by law or is necessary to protect your or another person’s vital interests in an emergency.

6. Use of Heidi Health

With your prior, explicit agreement, we may use Heidi Health as a secure documentation assistant during a consultation. It assists by processing the conversation in real time and producing a draft clinical note, allowing the therapist to concentrate on the consultation.

• Heidi Health is used only when you have opted in.

• You may decline its use or ask for it to be paused or stopped at any time without affecting your treatment.

• The therapist reviews and corrects every draft before it becomes part of the clinical record.

• Heidi Health does not make treatment decisions, and we do not make decisions about you solely through automated processing.

• Casual conversation is not intentionally included in the final clinical note.

• No audio recording is retained by the clinic.

• Once the draft note has been checked and transferred to the clinic record, it is deleted from Heidi Health in accordance with our clinic workflow and applicable service settings.

If Heidi Health is not used, the therapist will prepare the treatment note manually.

7. Service providers and sharing of information

We do not sell personal data.

We may share limited information with trusted organisations that help us operate the clinic, including:

• Wix, for the website, online bookings, forms, gift cards, communications and related website services;

• WriteUpp, for appointment administration and electronic clinical records;

• Heidi Health, only where you have agreed to its use for clinical documentation;

• Square or another payment provider, for payment processing;

• email, telecommunications, IT, website-security and data-storage providers;

• our accountant, bookkeeper, professional advisers, insurer or professional association where reasonably necessary;

• Revenue, regulators, courts, law-enforcement bodies or other authorities where disclosure is legally required; and

• another healthcare professional where you have requested or authorised the disclosure, or where an emergency or another legal basis applies.

These organisations receive only the information reasonably necessary for their role. Where they process personal data on our behalf, we require them to protect it and to process it only on documented instructions and in accordance with applicable data-protection law.

Links to social-media pages or other third-party websites are governed by the privacy policies of those organisations.

8. International data transfers

Some technology providers may process or store data outside the European Economic Area.

Where this occurs, we take reasonable steps to ensure that a lawful transfer mechanism and appropriate safeguards are in place, such as an adequacy decision or European Commission Standard Contractual Clauses.

Further information about relevant safeguards may be requested using the contact details provided in this Privacy Policy.

9. How long we retain information

We retain personal data only for as long as it is required for the purpose for which it was collected and to meet professional, insurance, tax and legal requirements.

Our usual retention periods are:

Adult consultation forms and treatment records: Seven years after the final appointment, or longer where reasonably required by an insurer, legal claim or applicable professional requirement.

Records relating to clients under 18: Until the client’s 25th birthday, or seven years after the final appointment if later, subject to insurer and legal requirements.

Booking and appointment-administration records forming part of the client record: Retained with the associated treatment record.

Enquiries that do not lead to a booking: Normally retained for up to 12 months after the last communication.

Financial, invoice, receipt and tax records: Six years, or longer if required by Revenue or another legal obligation.

Marketing information: Retained until you unsubscribe or withdraw consent, subject to periodic review and any suppression record required to respect your choice.

Heidi Health draft notes: Deleted after the note has been reviewed and transferred to the clinic record, in accordance with our workflow and applicable service settings.

Website logs and cookies: Retained for the period stated in our cookie controls or the relevant service configuration.

We may retain a record for longer where a complaint, legal claim, safeguarding matter or regulatory requirement makes this necessary.

At the end of the relevant retention period, information is securely deleted, destroyed or anonymised.

10. Children and young people

We may process information about children and young people where treatment is requested.

Depending on the client’s age, understanding and circumstances, we may ask a parent or guardian to provide information and consent to treatment and relevant data processing. We will involve the young person in decisions about their information as appropriate to their age and maturity.

A parent or guardian who provides information about a child should ensure that the information is accurate and that they have the authority to provide it.

Data-protection rights belong to the child, although a parent or guardian may exercise those rights on the child’s behalf where appropriate.

11. Security

We use appropriate technical and organisational safeguards designed to protect personal data against accidental loss, unauthorised access, alteration, disclosure or destruction.

These measures include, where appropriate:

• password-protected accounts and access controls;

• limiting access according to staff duties;

• confidentiality and data-protection training;

• secure storage for paper files;

• device and system security measures; and

• appropriate agreements with service providers.

No system can be guaranteed to be completely secure. If a personal-data breach creates a risk to your rights and freedoms, we will act in accordance with our legal reporting and notification obligations.

12. Cookies and website analytics

Our website uses cookies and similar technologies.

Cookies that are strictly necessary for the website, booking or security functions may be used without consent. Analytics, advertising and other non-essential cookies will be used only where you have given consent through the website’s cookie controls.

You may accept, reject or change your non-essential cookie preferences through the cookie settings available on the website.

Further information about individual cookies, their providers, purposes and durations is provided through those controls.

Where Google Analytics, Google Ads or another analytics or advertising service is enabled, it will operate only in accordance with your cookie choice and the relevant provider’s privacy information.

13. Marketing communications

We will send newsletters or promotional messages only where you have opted in or where another lawful basis permitted by electronic-marketing law applies.

You can unsubscribe at any time by using the unsubscribe link in an email or by contacting us.

Withdrawing marketing consent will not stop essential communications concerning an existing booking, payment, clinic closure or another service matter.

14. Your data-protection rights

Subject to the circumstances and the limits provided by law, you may have the right to:

• be informed about how your personal data is used;

• obtain access to your personal data and a copy of it;

• have inaccurate or incomplete information corrected;

• request deletion of information where there is no lawful reason to retain it;

• request restriction of processing;

• object to processing based on legitimate interests;

• receive certain information in a portable format or have it transferred to another provider;

• withdraw consent at any time where processing is based on consent, without affecting processing that occurred before withdrawal; and

• object to direct marketing at any time.

These rights are not absolute. For example, we may need to retain clinical or financial records to meet legal, insurance or professional obligations or to establish, exercise or defend legal claims.

To exercise a right, contact info@agsportsmassage.com.

We may need to verify your identity before releasing or changing information. We will normally respond within one month, as required by GDPR.

You also have the right to raise a concern or lodge a complaint with the Irish Data Protection Commission. Information about making a complaint is available at www.dataprotection.ie.

We would appreciate the opportunity to address your concern directly first, but you are not required to contact us before approaching the Data Protection Commission.

15. Changes to this Privacy Policy

We may update this Privacy Policy when our services, systems or legal obligations change.

The current version will be published on our website with its effective date. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected clients and seek fresh consent where the law requires it.

16. Contact us

Questions, requests or concerns about this Privacy Policy or the use of your information may be sent to:

Anne Geraghty
AG Sports Massage & Manual Therapy
Thurles Physiotherapy & Sports Injury Clinic
22 Castle Avenue
Thurles, Co. Tipperary
E41 C9W4
Ireland

Email: info@agsportsmassage.com
Telephone: 085 257 2569