Privacy Policy

1. Introduction

BookMyPhysio.lk respects your privacy and is committed to protecting your personal data, including the sensitive health information necessarily involved in connecting you with physiotherapy services. This Privacy Policy explains what data we collect, how we use it, and your rights, in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022 ("PDPA") and general data protection good practice.

By using the Platform, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email, phone number, address, date of birth.
• Health information: BookMyPhysio does not collect any information regarding your health or medical history.
• Booking information: appointment details, home visit address, preferred times.
• Payment information: BookMyPhysio does not handle payments, nor does it collect payment information.
• Practitioner information: professional registration numbers, qualifications, specialisations, availability.
• Communications: messages exchanged via the Platform, support enquiries, reviews/ratings.

2.2 Information Collected Automatically

• Device information, IP address, browser type, operating system.
• Usage data (pages visited, session duration, click patterns) via cookies and analytics tools.

2.3 Information from Third Parties

• Verification information from professional regulatory bodies (for Practitioners).

3. How We Use Your Information

1. Create and manage your account;
2. Facilitate bookings;
3. Share necessary contact information with the Practitioner you book, so they can prepare for and deliver your session safely;
4. Send booking confirmations, reminders, and service-related communications;
5. Improve and personalise the Platform, including through aggregated/anonymised analytics;
6. Verify Practitioner credentials and maintain Platform safety and trust;
7. Comply with legal obligations.

4. Legal Basis for Processing

Under the PDPA, we process your data on the following bases:

• Consent — we rely on your explicit, informed consent, which you may withdraw at any time (this will not affect bookings already completed).
• Contractual necessity — to provide the service you have requested (e.g., processing a booking).
• Legitimate interest — for Platform security, fraud prevention, and service improvement, balanced against your rights.

5. Sharing of Your Information

We share information only as necessary:

• With Practitioners/Patients directly involved in a booking — limited to what is necessary for that session.
• With service providers (e.g., cloud hosting, SMS/email providers, analytics) under contractual confidentiality and data protection obligations.
• With regulatory or law enforcement bodies where required by law or to protect the safety of users.
• In a business transfer (merger, acquisition, or asset sale), subject to continued protection under this policy or a successor policy.

We do not sell your personal data to third parties for advertising purposes.

6. Data Security

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data we hold, including encryption in transit, access controls limiting who can view information, and regular security reviews. However, no system is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain personal data for as long as necessary to provide the service, comply with legal obligations and enforce our agreements.

8. Your Rights

Under the PDPA, subject to applicable exceptions, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Withdraw consent;
• Request erasure of your data, subject to legal retention requirements;
• Object to or restrict certain processing; and
• Data portability, where technically feasible.

To exercise these rights, contact us.

9. Cookies

We use cookies and similar technologies to operate the Platform, remember preferences, and analyse usage. You can control cookie preferences through your browser settings; disabling some cookies may affect Platform functionality.

10. Children's Privacy

The Platform is not intended for direct use by children under 18. Bookings on behalf of minors must be made and supervised by a parent or legal guardian, who is responsible for the accuracy of any information provided about the minor.

11. International Data Transfers

If we transfer your data outside Sri Lanka (e.g., to a cloud hosting provider with servers abroad), we will ensure appropriate safeguards are in place consistent with PDPA requirements for cross-border data transfers.

12. Changes to This Policy

We may update this Privacy Policy periodically.

13. Contact Us

For privacy questions, concerns, or to exercise your rights, please contact us.