Privacy Policy

1. Introduction

Physio Progression is a trading name of Support and Sustain Limited ("we", "us" or "our").

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and share personal information when you visit or use the Physio Progression website and its associated services.

Physio Progression is a free, personalised career-development platform designed to help physiotherapists explore career opportunities, identify development goals and plan their professional progression.

Our services include:

• Personalised career journeys and recommendations.
• Job and course searches and listings.
• Personal profiles containing skills, experience and career interests.
• Saved opportunities and personalised alerts.
• AI-assisted career guidance and recommendations.
• Communication between users, employers and course providers where users choose to engage.

This policy applies to visitors, registered users, employers, recruitment organisations and course providers using our website.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable UK privacy legislation.

2. Who is responsible for your information?

The data controller responsible for your personal information is:

Support and Sustain Limited

Trading as: Physio Progression

Company number: 10775519

Registered office:

Beech House 21 St. Mellons Road Marshfield Cardiff CF3 2TX

Email: physioprogression@supportandsustain.co.uk

For questions about this policy or how we handle your information, please contact us using the email address above.

3. What personal information do we collect?

The information we collect depends on how you use Physio Progression.

3.1 Account and registration information

When you create an account, we may collect:

Your name. Email address. Profile picture, where supplied through Google sign-in. Account identification and authentication information. Account preferences and settings.

If you choose to sign in using Google, Google shares your name, email address and profile picture with our authentication provider, Clerk.

We use this information to create and manage your account and authenticate your sign-in.

We do not use Google sign-in to access your emails, files or other information in your Google account.

You can also choose to sign in using an email-based sign-in link.

3.2 Career profile and professional information

If you choose to create a personalised career profile, we may collect:

Your professional skills and experience. Your current or previous roles. Your career interests and ambitions. Your professional development goals. Your preferred locations and working arrangements. Your interests in particular specialisms or areas of practice. Your professional development and learning preferences. Information about your availability and career plans.

This information allows us to personalise career journeys and suggest relevant jobs, courses and development opportunities.

You control the information you provide to your private profile.

Please do not include patient information, confidential employer information or other people's personal information in your profile.

3.3 Job and course information

When you browse, save, list or interact with job and course opportunities, we may collect:

Search terms and filters. Job and course preferences. Saved jobs and courses. Application or expression-of-interest information. Information you submit when creating a job or course listing. Communications relating to listings or opportunities.

Public job and course listings may be visible to other website visitors and accessible through our public read-only information interface.

Private account information and personal career journeys are not made available through that interface.

3.4 Communications and enquiries

We may collect information when you:

Contact us by email. Use our website assistant. Submit feedback about a career recommendation. Report a job or course listing. Request help with your account. Exercise your data protection rights.

This may include your contact details, the contents of your message and any information you voluntarily provide.

3.5 Technical and usage information

When you visit our website, we collect technical information such as:

Page, feature and search interactions (for example, which pages are viewed and how people move through the site). Date, time and general acquisition category of a visit (for example, which channel brought you to the site). Device and technical logs needed to operate, secure and debug the website.

We currently use our own first-party measurement for this purpose, recorded against the day, page or feature and general acquisition category rather than against your name, email address or IP address. We do not use Google Analytics, advertising pixels or similar third-party analytics or advertising trackers. See our Cookie Policy for the specific cookies and browser storage this involves.

4. How do we use your information?

We use personal information for the following purposes.

4.1 Providing the service

We use your information to:

Create and manage your account. Provide access to your personal profile. Build personalised career journeys. Suggest relevant career development steps. Identify relevant jobs and courses. Save your preferences and opportunities. Provide personalised alerts. Allow you to manage job and course listings.

4.2 Personalised recommendations and artificial intelligence

Physio Progression uses artificial intelligence to help personalise career journeys and interpret career preferences.

When you describe your ambitions or complete your profile, our systems translate a limited, structured set of information from it, such as your country, role and practice setting, years qualified or student status, skills and completed learning tags, working preferences, course budget and career goals, into a request sent to our AI provider. We do not send your name, email address, contact details or full free-text profile description to the AI provider, and completed course providers you've listed are not included in that request.

This processing currently uses OpenAI's gpt-5.4-mini model, accessed through Replit's AI Integrations service (which also involves OpenRouter as part of that managed routing). This is a managed service we use within our hosting platform, not a direct arrangement we hold with OpenAI ourselves.

Our provider's terms state that paid API usage is not used to train their models by default. OpenAI's standard abuse-monitoring processes may retain prompts and responses for up to 30 days for safety and legal purposes, and we do not currently have an enhanced "zero data retention" arrangement in place with them. Processing is not limited to the UK or European Economic Area, and should be treated as international processing. See section 8 for more on international transfers.

AI-generated suggestions are intended to support your own career planning. They are not instructions, guarantees of employment or professional advice.

AI systems can make mistakes or produce unsuitable recommendations. You should use your own judgement when considering suggestions.

You can give feedback on an AI-generated route using "Not quite right?" and we will review it.

We do not use AI-generated career suggestions as the sole basis for decisions that produce legal or similarly significant effects concerning you.

4.3 Communication and support

We use your information to:

Respond to enquiries. Investigate reported problems. Provide account support. Improve the accuracy and quality of career recommendations. Communicate important service updates.

4.4 Website security and improvement

We may use technical information to:

Monitor website performance. Identify and resolve errors. Prevent unauthorised access. Detect misuse and suspicious activity. Maintain the security and reliability of our services.

4.5 Legal and regulatory obligations

We may process information where necessary to comply with applicable laws, respond to lawful requests or establish, exercise or defend legal claims.

5. Our lawful bases for processing

Under UK data protection law, we must have a lawful basis for processing personal information.

Depending on the purpose, we rely on the following lawful bases:

Contract

We process information where necessary to provide the services you request, manage your account and fulfil our obligations to you.

Legitimate interests

We may process information for legitimate business interests, including:

Operating and improving Physio Progression. Maintaining website security. Preventing misuse and fraud. Improving the relevance of career recommendations. Responding to enquiries and feedback. Understanding, in aggregate, how people interact with our services.

We balance these interests against your rights and expectations.

Consent

Where required, we rely on your consent, including for non-essential cookies or certain optional communications.

You can withdraw consent at any time.

Legal obligation

We may process information where necessary to comply with legal obligations.

6. Who can see your information?

We take care to protect your personal career information.

6.1 Your private profile

Your personal career journey and private profile are intended to remain private.

Employers do not automatically receive access to your full profile.

Employers only see the parts of your profile that you choose to share.

6.2 Contact requests from employers

If an employer sends you a contact request and you accept it, the employer is shown: the request itself and when it was made, your response, and, once you've accepted, your LinkedIn profile URL (while your discovery profile remains visible and active).

We do not disclose your email address, phone number, your full career profile, certificates, or your private goal history as a result of accepting a contact request. Any other part of your profile stays visible to an employer only if you have separately chosen to share it. Accepting a contact request is not permission for us to disclose anything you haven't separately chosen to share.

6.3 Course providers

Where you choose to share information or engage with a course provider, we may disclose the relevant information necessary to facilitate that interaction.

6.4 Public job and course listings

Job and course listings submitted for publication may be visible to the public.

You should not include confidential or unnecessary personal information in public listings.

6.5 Public AI access

Physio Progression provides a public, read-only interface through which external AI tools can search and read publicly available job and course listings.

This interface cannot:

Sign in to user accounts. View private career journeys. Access private saved items. Access private availability information. View private applications. Post or edit listings.

We do not intentionally expose private account information through this interface.

7. Third-party service providers

We use the following third-party services to operate and support Physio Progression:

Clerk — account authentication and sign-in (including Google sign-in). OpenAI, via Replit's AI Integrations service (which also involves OpenRouter) — generating personalised career route suggestions. Replit, hosted on Google Compute Engine — website hosting. Neon, via Replit's managed database service — database storage. Resend — sending account-related and business email (job/course listing notifications and similar; not yet active in production for all message types).

These providers process personal information on our behalf where necessary to provide their services. Where a provider acts as our data processor, we require appropriate contractual and technical safeguards to protect personal information. Some third-party services may act as independent data controllers for particular processing activities; their own privacy policies apply to those activities.

We will not sell your personal information to advertisers or other organisations.

8. International transfers

Some of our service providers process or store information outside the United Kingdom. Based on each provider's own published terms:

Clerk's data processing agreement describes transfers from the UK/EU/Switzerland to Clerk in the United States, under stated Data Privacy Framework and UK Extension arrangements. Resend states that customer message, log and account data is stored in the United States; choosing a European sending region changes how email is routed, not where this data is stored. Replit, Google Compute Engine, Neon, OpenAI and OpenRouter are United States-based companies. For this website, Replit's hosting and database are published in the Europe (EU) geography; the exact physical region used for individual AI processing requests is not published by our AI provider.

Where personal information is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with applicable data protection legislation, which may include transfers to countries recognised by the UK as providing an adequate level of protection, International Data Transfer Agreements, UK Addenda to approved standard contractual clauses, or other legally recognised transfer mechanisms. You can contact us if you would like further information about international transfers relevant to your information.

9. How long do we keep your information?

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

The following retention periods are currently implemented and enforced automatically:

Assistant conversations with our website assistant: 30 days (you can also delete a conversation yourself at any time). Assistant usage records used for rate-limiting: 7 days. Anonymous, aggregate-level usage events: 365 days. Short-lived records used to prevent abuse of public features: 24 hours.

For other categories — including your account identity, career profile history, contact-request messages, job and course applications, and security/audit logs — we do not yet operate a fixed, automatic retention period. We are working to define these, and in the meantime we review and remove this information when it is no longer needed, or on request (see section 10).

When information is no longer required, we delete it or anonymise it securely.

10. Your data protection rights

Under UK data protection law, you have several rights in relation to your personal information, including the right of access, rectification, erasure, restriction of processing, data portability, and to object to certain processing, as well as rights relating to automated decision-making. Where we rely on consent, you can withdraw it at any time.

How to exercise your rights

You can manage much of your personal information directly through your account:

Go to the Me section of Physio Progression. Open Your private profile. Use the available options to view, download or delete your profile, goal and saved data.

Deleting your career profile removes your discovery data, shares, saved routes, and AI-related records associated with it. If you want your underlying account closed as well, or you would like a copy of other information we hold about you, contact us at:

physioprogression@supportandsustain.co.uk

We will respond to requests within the timeframes required by applicable data protection law and may need to verify your identity before responding to certain requests.

11. Google sign-in

If you choose to sign in using Google, Google shares your name, email address and profile picture with our authentication provider, Clerk.

We use these details to create and authenticate your Physio Progression account.

We do not use this connection to post on your behalf to Google, read your Gmail messages, access your Google Drive files, or access unrelated information in your Google account.

You can remove the connection through your Google Account under Security, then Your connections to third-party apps and services. Removing the Google connection does not automatically delete your Physio Progression account. You can continue using an email sign-in link, or contact us to delete your account.

12. Cookies and similar technologies

Physio Progression uses cookies and browser storage to support sign-in, security and website functionality, and a small amount of first-party, non-identifying usage measurement. For the full list of cookies and storage items we use, see our Cookie Policy.

13. Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss or destruction, unauthorised alteration, unlawful disclosure, and other forms of misuse. These measures may include access controls, authentication mechanisms, secure infrastructure and appropriate security monitoring.

No internet-based service can guarantee absolute security. We will take appropriate action if we become aware of a personal data breach, including notifying affected individuals and the Information Commissioner's Office where legally required.

14. Children's information

Physio Progression is designed for people exploring or developing a professional career in physiotherapy. It is not intended to be a service for children. We do not knowingly seek to collect personal information from children in circumstances where parental consent or other additional safeguards would be required. If you believe a child has provided personal information to us inappropriately, please contact us so that we can investigate.

15. Links to external websites

Physio Progression may contain links to external websites, including employers and recruitment organisations, course providers and educational institutions, professional organisations, NHS and other public-sector resources, and external job application services. We are not responsible for the privacy practices or content of external websites. When you follow an external link, the privacy policy of that website or organisation applies.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, new features, changes to the third-party providers we use, changes in applicable law, or improvements to our privacy practices. Where appropriate, we will notify registered users of significant changes. The latest version will always be available on the Physio Progression website.

17. Complaints and the Information Commissioner's Office

If you have concerns about how we use your personal information, we encourage you to contact us first so that we can investigate and address your concerns. You also have the right to complain to the UK Information Commissioner's Office (ICO).

Website: https://ico.org.uk/ Telephone: 0303 123 1113

18. Contact us

Support and Sustain Limited Trading as Physio Progression

Email: physioprogression@supportandsustain.co.uk

Registered office:

Beech House 21 St. Mellons Road Marshfield Cardiff CF3 2TX

Company number: 10775519