Privacy Policy

Sara Indseth Physiotherapy & Nutrition holds some information about you. This document outlines how that information is used, who we may share that information with and how we keep it secure. This notice does not provide exhaustive detail. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to sara@saraindseth.com. We keep our Privacy Notice under regular review. This Privacy Notice was last reviewed in July 2026.

 

1. Who we are

Sara Indseth provides holistic physiotherapy and functional nutrition/nutritional therapy services, operating under the trading name Sara Indseth Physiotherapy & Nutrition. In this notice, "we", "us", and "our" refer to Sara Indseth.

 

What we do

Sara Indseth Physiotherapy & Nutrition provides holistic physiotherapy and functional nutrition/nutritional therapy services to clients to improve their physical, mental, and overall wellbeing.  Our approach includes evidence informed physiotherapy and personalised nutritional therapy to address musculoskeletal concerns, nutritional and lifestyle related health challenges, and factors contributing to chronic symptoms. Through nutritional therapy consultations, dietary and lifestyle analysis and (where appropriate) biochemical testing, we aim to understand the underlying contributors to your health concerns which we will seek to address through personalised dietary strategies, nutraceutical prescription (supplements) and lifestyle advice. We also offer holistic physiotherapy assessment and treatment, including hands on manual therapy, movement guidance, and exercise advice within the scope of practice defined by Danske Fysioterapeuterne.

 

Our focus is on preventative healthcare, optimisation of physical and mental wellbeing, and supporting clients through musculoskeletal issues, hormonal transitions, and chronic health concerns using a wholebody, integrative approach.

 

Data Controller: Sara Indseth
Physiotherapy practice address: MorKrop, Linnésgade 26, kld, 1361 København K, Denmark
Contact email: sara@saraindseth.com  

As a business based in Denmark, we operate primarily under EU GDPR as enforced by the Danish Data Protection Authority (Datatilsynet). Where we provide services to clients based in the United Kingdom, we also comply with UK GDPR as enforced by the Information Commissioner's Office (ICO). 

 

2. What data we collect and why

We collect and process personal data for the following purposes. In each case we identify the lawful basis under which we do so.

 

2.1 Providing healthcare services

We collect and process personal data in order to provide you with physiotherapy treatment and functional nutrition services. This means that the legal basis of our holding your personal data is for legitimate interest. This includes:

• Name, date of birth, CPR number (for physiotherapy clients in Denmark), address, email address, and phone number

• Next of kin or emergency contact details

• Full health history, current symptoms, medication, supplements, and lifestyle information

• Clinical assessment notes and treatment records

• Health improvement plans and nutritional strategies

• GP and other healthcare provider contact details

 

2.2 Functional testing

Where functional testing is recommended, we collect and process test results provided by third-party specialist laboratories. This includes results relating to gut health, hormonal health, thyroid function, genetics, nutritional status, metabolic markers, and food sensitivities.

 

2.3 Communication

We process your contact details in order to communicate with you about appointments, your programme, and your progress.

 

2.4 Payment processing

We process payment information in order to administer fees for services. We do not store full payment card details; payments are processed through Stripe or MobilePay, which acts as a data processor on our behalf under a formal data processing agreement.

 

2.5 Legal and regulatory compliance

We retain client records for the period required by our professional regulatory body following the end of your care. This enables us to respond to any complaint or regulatory enquiry.

 

2.6 Marketing communications

If you have given your explicit consent, we may contact you with newsletters or other health-related information. You may withdraw this consent at any time by contacting us at sara@saraindseth.com or using the unsubscribe link in any marketing email.

 

3. Special category data

Health data, genetic data, and data concerning physical and mental wellbeing are classified as special category data under Article 9 GDPR and attract a higher level of protection. The majority of data we process falls into this category. We process it solely for the purpose of providing you with direct healthcare, and treat it with the highest standard of confidentiality at all times.

 

4. How we collect your data

We collect personal data in the following ways:

• Through the health and lifestyle questionnaire completed before your initial consultation

• Through signed terms and conditions or consent forms

• During consultations and treatment sessions

• Via email, telephone, or our website contact form

• From third-party functional testing laboratories, with your consent

• From other healthcare providers involved in your care, with your express consent

• Through payment processing

 

5. Who we share your data with

We keep your information confidential. We do not sell your data to any third party. We will only share your information in the following circumstances:

 

5.1 Third-party service providers (data processors)

We work with the following categories of third-party processors who act on our behalf and are contractually bound to keep your data secure and process it only on our instruction:

• Functional testing laboratories - to process and return test results

• Payment processors - to handle payment transactions:

  • Stripe — used to process card payments securely through Practice Better. 

  • MobilePay — used to process mobile payments. 

Both companies acts as GDPR compliant data processors under a formal data processing agreement.

• Website platform (Wix) - our website is hosted on the Wix platform, which processes technical and analytics data. Wix is GDPR-compliant and processes data under a formal data processing agreement. Wix's privacy policy is available at wix.com/about/privacy

• Google Analytics — used to collect anonymised website analytics data. Google acts as a GDPR compliant data processor under Standard Contractual Clauses.

• 123 Reg (email hosting provider) — used to send and receive email communication. 123 Reg acts as a GDPR compliant data processor and processes personal data under a formal data processing agreement.

• Practice Better & Terapeut Booking client management platforms used for scheduling, storing health information, session notes, forms, and communication. Both platforms act as GDPR compliant data processors and process personal data under a formal data processing agreement. Their privacy policies are available at practicebetter.io/privacy-policy and terapeutbooking.dk/privacy-policy respectively.

 

1. 1. Healthcare providers

We may disclose your information to our professional association (BANT / Danske Fysioterapeuterne), for the processing of a complaint made by you, contractors and advisors that provide a service to us or act as our agents on the understanding that they keep the information confidential, or to anyone to whom we may transfer our rights and duties under any agreement we have with you.

We will seek your express written consent before sharing your information with your GP or any other healthcare provider. Where we coordinate your care with other professionals, only the information necessary for that purpose will be shared. However, if we believe that your life is in danger then we may pass your information onto an appropriate authority (such as the police, social services in the case of a child or vulnerable adult, or GP in case of self-harm) using the legal basis of vital interests.

 

5.3 Legal obligations and safeguarding

We may share your information without your consent where we are required to do so by law, by a formal court order, or by a regulatory body. We may also share information where we believe there is a serious and credible risk to your life or the life of another person, using the legal basis of vital interests under Article 6(1)(d) and Article 9(2)(c) GDPR.

 

5.4 Professional development

We may discuss anonymised case information with professional peers for the purposes of clinical supervision or continuing professional development. No information that could identify you will be used for this purpose without your explicit consent.

 

6. International data transfers

Our practice is based in Denmark and operates within the European Economic Area (EEA). Some of our third-party service providers, including Wix, Google Analytics, and Practice Better are based in the United States or other countries outside the EEA and UK. Where your data is transferred outside the EEA or UK, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• UK International Data Transfer Agreements (IDTAs) where applicable

• Transfers to countries recognised as providing an adequate level of data protection

You may request details of the specific safeguards in place for any transfer by contacting us at sara@saraindseth.com

 

7. Data retention 

We retain your personal data for the period required by the guidance of our professional regulatory body following the end of your care. After this period, your data will be securely deleted or anonymised.

Marketing data is retained until you withdraw your consent.

Website analytics data is retained in anonymised form in accordance with Google Analytics' standard retention settings.

 

8. Data security

We take the security of your personal data seriously and have appropriate technical and organisational measures in place, including:

• Password protection and encryption on all devices used to store client data

• Secure, access-controlled storage of physical records where applicable

• Restricted access to personal data — only Sara Indseth and any directly authorised personnel have access to client records

• Formal data processing agreements with all third-party processors

• Regular review of security practices

 

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (Datatilsynet and/or the ICO as applicable) within 72 hours of becoming aware of the breach, and will notify you directly where the breach is likely to result in a high risk to you.

 

9. Your rights

Under EU GDPR and UK GDPR, every individual has the right to see, amend, delete, or have a copy, of data held that can identify you, with some exceptions. You do not need to give a reason to see your data. 

You have the following rights, subject to exemptions, in relation to your personal data:

• Right of access - you may request a copy of the personal data we hold about you (a Subject Access Request)

• Right to rectification - you may ask us to correct inaccurate or incomplete data

• Right to erasure - you may ask us to delete your data where we no longer have a lawful basis to hold it, subject to our legal obligations to retain healthcare records

• Right to restriction - you may ask us to restrict processing of your data in certain circumstances

• Right to data portability - you may request a copy of your data in a structured, machine-readable format, and ask us to transfer it to another provider

• Right to object - you may object to processing based on legitimate interests or for direct marketing purposes

• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal

• Rights related to automated decision-making — we do not carry out any automated decision-making or profiling using your personal data

To exercise any of these rights, please contact us in writing at sara@saraindseth.com. We will respond within one month of receiving your request. We may need to verify your identity before processing your request. Under special circumstances, some information may be withheld.   

 

10. Website and cookies

Our website is built and hosted on the Wix platform (wix.com). Wix processes certain technical data in order to operate the website, in accordance with its own privacy policy and GDPR obligations.

 

Cookies

Cookies are small text files placed on your device when you visit our website. We use the following categories of cookies:

• Strictly necessary cookies - required for the website to function. These cannot be disabled. They include session management and security cookies set by Wix.

• Analytics cookies - we use Google Analytics to collect anonymous information about how visitors use our site, including pages visited, time spent on site, and referral sources. This data is collected in aggregated, anonymised form and is used solely to improve the website. Google Analytics cookies include _ga and _gid.

• Preference cookies — used to remember your cookie consent preferences.

 

You may manage or disable cookies at any time through your browser settings. Disabling analytics cookies will not affect your ability to use the website. To opt out of Google Analytics tracking across all websites, visit tools.google.com/dlpage/gaoptout.

 

In accordance with EU and UK cookie law (the ePrivacy Directive and the Privacy and Electronic Communications Regulations), we will request your consent before placing any non-essential cookies on your device.

 

11. Data Protection Complaints

If you have a concern about how we handle your personal data or exercised your data protection rights, please contact us in the first instance at sara@saraindseth.com and we will do our best to resolve it. We will acknowledge your complaint within 30 days and investigate it in accordance with our data protection complaints procedure. If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

 

Denmark (EU GDPR):
Datatilsynet
Carl Jacobsens Vej 35
2500 Valby, Denmark
dt@datatilsynet.dk
datatilsynet.dk

 

United Kingdom (UK GDPR):
Information Commissioner's Office (ICO)
ico.org.uk/make-a-complaint
0303 123 1113

 

12. Changes to this notice

We keep this Privacy Notice under regular review. Any significant changes will be communicated to active clients by email. The current version will always be available on our website.

This notice was last reviewed in July 2026.