Private practice. 14 minute read.

How to start a private physiotherapy practice in the UK: registration, insurance and the rules

To start a private physiotherapy practice in the UK, you need current registration with the Health and Care Professions Council (HCPC), professional indemnity cover of your own, and a business registered with HMRC as a sole trader or with Companies House as a limited company. Most self-employed physios also need to pay the Information Commissioner's Office (ICO) data protection fee, because patient notes are health data. In England, a standalone service run by physiotherapists does not need to register with the Care Quality Commission (CQC) for treatment, but that changes once a listed healthcare professional, such as a doctor, nurse, paramedic or radiographer, works in the team in that role. The rest is less urgent but still needs sorting before you see your first patient: notes that meet HCPC standards, a decision on private medical insurers, premises disabled patients can use and advertising you can back up.

It is written for UK physios going private, from a single rented room in a gym to a clinic with a receptionist and associates. It explains the rules but does not replace your accountant, a solicitor or an insurance broker. The quoted rules were read on the official pages in September 2026, and each source's own date sits beside it in the reference list. The CQC changed part of its scope guidance on 27 August 2026. Before you rely on anything here, open the source and see whether it has moved again.

What do you need to start a private physiotherapy practice in the UK?

The checklist, in roughly the order it comes up:

  1. Current HCPC registration in your own name.
  2. Professional indemnity arrangements that cover your private work.
  3. A business structure: sole trader registered for Self Assessment, or a limited company registered with Companies House. If you will also take sessions for a clinic or an agency, see working as a self-employed physiotherapist in the UK.
  4. Employers' liability insurance from the day you take on staff.
  5. A decision on CQC registration, based on who works in your service and what it offers.
  6. The ICO data protection fee, unless you are exempt, plus a privacy notice for patients.
  7. A record-keeping system that meets HCPC standard 10.
  8. A decision about which private medical insurers, if any, you will work with.
  9. Premises that disabled patients can use, and advertising you can prove.

Each item gets its own section below.

HCPC registration and the standards that follow you into private practice

You cannot call yourself a physiotherapist in the UK without HCPC registration. The HCPC says: "The professions we regulate have one or more designated titles that are protected by law. To use one of these titles, an individual must be registered with the HCPC." For physiotherapy, both "physiotherapist" and "physical therapist" are protected. The Chartered Society of Physiotherapy (CSP) repeats the point in its guidance for independent practitioners: "To work as a physiotherapist in the UK, you must be registered with the HCPC".

The standards themselves do not change when you leave employment. What changes is who is checking. In a team, a colleague or manager may notice late notes or a technique that goes beyond your training. In your own practice that falls to you. The HCPC standards of conduct, performance and ethics, in force since 1 September 2024, have a few lines that press harder once you work alone:

  • 3.1: "You must only practise in the areas where you have the appropriate knowledge, skills and experience to meet the needs of a service user safely and effectively."
  • 6.1: "You must take all reasonable steps to reduce the risk of harm to service users, carers and colleagues, as far as possible."
  • 2.7: "You must share relevant information, where appropriate, with colleagues involved in the care, treatment or other services provided to a service user." In private practice, that usually means letters to the patient's GP. The NHS self-referral guide sets out a simple layout for them.
  • 9.3: "You must take reasonable steps to make sure that any promotional activities you are involved in are accurate and are not likely to mislead."
  • Standard 10, on records, which has its own section below.

Scope of practice matters more than people expect when a practice grows. Adding acupuncture, shockwave or a new class is a clinical decision under standard 3.1, and it is also an insurance question. The HCPC's indemnity page says: "If your scope of practice is changing, you will need to contact your insurer to make sure that your new scope of practice will be appropriately covered by your arrangement."

Professional indemnity insurance for private physiotherapists

Indemnity cover is a condition of registration. The HCPC says: "You are required to have a professional indemnity arrangement in place as a condition of your registration with the HCPC." Most registrants are covered by their employer. Once you go private, that no longer applies: "If you are self-employed or work in independent practice, you will need to make your own professional indemnity arrangements."

The HCPC does not set a figure. It says cover must be "appropriate to your practice, taking into account the nature and extent of its risks" and "sufficient to meet any liability that may be incurred if a successful claim is brought against you." When you register, you make a professional declaration that you have, or will have, an arrangement in place and that it gives the appropriate level of cover. The HCPC also notes that "Some professional bodies and trade unions offer professional indemnity cover as part of their membership, or for an additional fee."

What CSP membership cover includes

For CSP members, the professional liability insurance (PLI) scheme is the usual starting point. The CSP's page on running a business says PLI "is provided for eligible members of the Chartered Society of Physiotherapy (CSP) subject to policy terms and conditions, to cover your individual work." If you are a sole trader and employ nobody, the CSP says the scheme covers "your medical malpractice (professional liability) and public liability risks for your individual work, subject to the terms and conditions of the policy."

The limits are where people get caught out. The same page warns: "If you carry a lot of stock or other business assets, or have premises, you may need other covers." It says private limited companies or partnerships owned entirely by CSP members are included in the members' scheme, provided annual turnover does not exceed £200,000 and subject to policy terms and conditions. If your company's turnover is more than £200,000, the CSP says you need individual advice on its malpractice insurance and are not eligible for the CSP small business cover. More broadly: "if you deliver services through a limited company/partnership, employ people and/or are involved in activities outside the scope of physiotherapy practice, you may require additional insurance."

The CSP leaves the final check with you: "You are responsible for establishing the right level of insurance cover". It recommends taking your own insurance advice, from its broker or another specialist broker regulated by the Financial Conduct Authority. Read the policy wording before you open.

If your cover comes from another body or a commercial policy, ask the same questions of it. Does it cover your own work? Your company? Your staff and premises? Anything outside core physiotherapy?

Employers' liability insurance

Taking on a receptionist or an associate changes your insurance. GOV.UK says you must get employers' liability insurance "as soon as you become an employer", with cover "for at least £5 million". The insurer must be authorised.

You must display the certificate where employees can access it and show it to inspectors when they ask. The page lists two narrow exemptions: employing only a family member, or employing only someone based outside England, Scotland and Wales. Check the page against your own situation rather than assuming one applies. Northern Ireland has its own law on this. The official NI business site also says an employer must be insured for at least £5 million, and it lists slightly different exemptions, so practices there should check that page instead.

Sole trader or limited company?

For a physio going it alone, the choice is usually one of these two. Partnerships and other structures are not covered here.

Sole trader

GOV.UK says: "You must register for Self Assessment as a sole trader if you earn more than £1,000 in a tax year (from 6 April to 5 April)." Record keeping for tax starts on your first day of trading. The main drawback is liability. In GOV.UK's words, sole trader businesses have "'unlimited liability' which means owners are personally responsible for all of the debts of the business."

Limited company

A limited company "is legally separate from the people who own it." You register it with Companies House before you start trading. GOV.UK's step-by-step guide covers what that involves, including a company name, a registered office address, at least one director, at least one shareholder and a SIC code describing what the business does. Directors may also need to verify their identity before the company can be registered. The company then pays Corporation Tax on its profits.

Which suits you depends on your income, your appetite for paperwork and the risks you carry. An accountant who works with healthcare businesses can run the numbers for your situation. Whichever you choose, tell your insurer, because the CSP scheme treats sole traders and companies differently.

VAT and physiotherapy

HMRC's VAT Notice 701/57 lists physiotherapists among the registered health professionals whose services can be exempt from VAT. Section 2.3 says your services are exempt when both of these apply:

  1. "The services are within the profession in which you're registered to practice."
  2. "The primary purpose of the services is the protection, maintenance or restoration of the health of the person concerned."

Not everything a physio does passes that test. Section 2.4 says that "where a medical report is done solely to provide a third party with a necessary element for taking a decision for insurance or legal purposes, the supply is taxable at the standard rate." Section 4.2 says: "Most supplies of certificates and reports are liable to VAT at the standard rate as they allow a third party to make a decision and contain no element of therapeutic care."

The notice gives examples both ways. A fitness certificate given to an employer so that it recognises limits the person's health places on certain activities is exempt. A fitness certificate needed to take up a profession or sporting activity is standard rated. The notice treats workplace risk assessments, including advice on ergonomic layouts, as taxable too. Section 2.5 adds that if you supply taxable services, you may be required to register for VAT.

If you plan medico-legal reports, workplace assessments or anything else outside treatment, read the notice in full and check with HMRC or your accountant.

Working in someone else's clinic instead

Many physios start by working self-employed in an existing practice before opening their own. Whether that arrangement really is self-employment is a tax question. HMRC's CEST tool will tell you "if you, or a worker on a specific engagement, should be classed as employed or self-employed for tax purposes." The CSP also notes that if you provide self-employed services to a physiotherapy business "where you decide yourself how your patients are treated", you need to register with the ICO.

Does a physiotherapy clinic need to register with the CQC?

In England, the CQC registers providers of regulated activities. Its guidance is blunt: "Any person (individual, partnership or organisation) who provides regulated activity in England must be registered with us otherwise they commit an offence." The question is whether physiotherapy counts.

For most small practices, it does not. The regulated activity that covers treatment is "treatment of disease, disorder or injury", and it depends on a list of healthcare professionals in the regulations. The CQC's scope guidance says "The list of professionals in the regulations does not include" ten groups, and physiotherapists are one of them, alongside clinical psychologists, occupational therapists, pharmacists, opticians and dietitians. It goes on: "If you are one of these professionals and you run a standalone treatment service, you do not need to register for Treatment of disease, disorder or injury."

The team you build can change that answer. The same guidance says: "If a multi-disciplinary team includes one of these healthcare professionals (or a social worker in the case of mental health treatment) involved in their professional capacity, then the activity will be within scope and needs to be registered." The CQC glossary defines who counts as a listed healthcare professional for this activity. The list includes a medical practitioner, nurse, midwife, paramedic, radiographer, operating department practitioner and several dental professions. Bringing in a GP for a musculoskeletal clinic, or a nurse to give injections, is the kind of step to check before you advertise it.

The August 2026 change also brought treatment at sports grounds and gyms, and at sporting or cultural events, into scope. Those settings used to be excepted. A physiotherapy-only service at a club still falls outside the treatment activity, because physiotherapists are not on the list. A club or event medical team that includes a doctor or paramedic now needs to register, unless it only gives first aid as the CQC defines it.

A few more points from the CQC's pages are worth knowing:

  • Dual registration. A physiotherapist who is also a registered paramedic "will not need to register if they are working solely as a physiotherapist." The CQC adds that registration is needed if they diagnose or treat as a paramedic, or use the paramedic title.
  • Ultrasound. Diagnostic and screening procedures are a separate regulated activity. It covers procedures that examine the body using radiation, ultrasound or magnetic resonance imaging. The CQC lists "the use of ultrasound by registered physiotherapists" among the exceptions to this activity. The exception names physiotherapists, so scans by anyone else in your team need checking against the rest of that guidance.
  • Other activities. The physiotherapist exclusion belongs to the treatment activity only. Diagnostic and screening procedures also cover some sample taking and physiological measurement, and the CQC says you do not have to be a healthcare professional to register for that activity. Surgical procedures are in scope when a healthcare professional carries them out, and for that activity the CQC's definition includes anyone on the HCPC register. Check each activity before you add a new test or procedure.

The CQC updated its treatment guidance on 27 August 2026 after the government changed the regulations, including which listed healthcare professionals are in scope. It also says: "Where the situation is unclear, we will consider each case individually." If your service mixes professions or procedures, ask the CQC before you open, and keep its answer on file.

Scotland, Wales and Northern Ireland

The CQC covers England only. The CSP's independent practice guidance says: "Most self-employed physiotherapists and small physiotherapy practices do not currently need to register with the Care Quality Commission (in England) or the respective devolved countries' equivalent organisations". It adds: "This is currently accepted practice because physiotherapists are HCPC regulated." The CSP says you may need to register if your practice includes professionals who do have to register, such as doctors and nurses, or if you have a formal business partnership with them. It also warns that some activities, such as taking blood samples or using specialised equipment to monitor certain physiological functions, can bring a private physiotherapy business into regulation.

For Wales and Northern Ireland, the CSP names Healthcare Inspectorate Wales and the Regulation and Quality Improvement Authority. In Wales, lasers need particular care. Healthcare Inspectorate Wales says: "Usually all settings in Wales who wish to provide any treatments using a class 3B/4 laser or an IPL device must first register with HIW." If you use a therapy laser in Wales, check its class with the manufacturer and send HIW a registration enquiry before you use it on patients.

For Scotland the CSP names the Care Inspectorate, but independent clinics that meet the legal definition register with Healthcare Improvement Scotland. Its definition of an independent clinic lists medical practitioners, dental practitioners, registered nurses, registered midwives, dental care professionals, pharmacists and pharmacy technicians, and does not list physiotherapists. A clinic where one of those professionals also provides services may need to register. Check with the regulator in the nation where you practise.

The CSP page was last reviewed in January 2026, before the CQC's August change. For England, the CQC's own guidance is the one to follow.

ICO registration and UK GDPR for patient records

Patient notes are personal data, and health information gets extra protection. The ICO says: "organisations (including sole traders) that use personal information need to pay a data protection fee, unless they are exempt." Its self-assessment tool takes about 10 minutes and tells you whether you need to pay and how much. The CSP is direct about it for physios: "Most self-employed physiotherapists must be registered with the Information Commissioner's Office (ICO) as they hold and process sensitive data in the form of the patient record, or patient notes."

Under UK GDPR, "data concerning health" is special category data. The ICO says: "You must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9." For treatment records, the relevant Article 9 condition is usually health or social care. The ICO says it covers the "provision of health care or treatment" where the processing is done by or under the responsibility of "a health professional" or someone else who owes a duty of confidentiality, and its guide to who counts as a health professional includes physiotherapists. For this condition, "You don't need to have an appropriate policy document in place." The ICO notes that some of this guidance is under review after the Data (Use and Access) Act, so check the current version.

For a small practice, most of the day-to-day work is five habits:

  1. Give patients privacy information when you collect their details. The ICO describes the right to be informed as "being open with people and providing them with clear and concise information about what you do with their personal information."
  2. Answer requests for records on time. The ICO says: "You must respond without undue delay, and within one month of receipt of the request." It adds: "In most cases, you cannot charge a fee to comply with a SAR." A patient can ask "verbally or in writing, including via social media", so reception staff need to recognise a request when they hear one.
  3. Know what to do if records go astray. "You must report a notifiable breach to the ICO without undue delay, but not later than 72 hours after becoming aware of it." If a risk to people is likely, you must notify the ICO. If it is unlikely, you do not have to report it, but the ICO says you should document that decision, and its checklist expects you to keep a record of every breach, reported or not. If the breach is likely to result in a high risk to the people affected, you must also tell them without undue delay.
  4. Check whether you need a data protection impact assessment. The ICO says you must do one "for any type of processing which is likely to be high risk", and it lists special category data "on a large scale" as one trigger.
  5. Keep confidentiality at the centre. HCPC standard 5.1: "You must treat information about service users as confidential."

Marketing messages to past patients follow separate rules on email and text consent. The physical therapy marketing guide covers them.

Record keeping in private practice

HCPC standard 10 is short, and all three parts apply to private work:

  • 10.1: "You must keep full, clear and accurate records for everyone you care for, treat or provide other services to."
  • 10.2: "You must complete all records promptly and as soon as possible after providing care, treatment or other services."
  • 10.3: "You must keep records secure by protecting them from loss, damage or inappropriate access."

The HCPC's record-keeping page adds that "What records you need to keep, in what format and for how long, varies depending on the setting you are working in and the subject matter of those records." The CSP's record-keeping guidance gives more detail.

The CSP says its Quality Assurance Standards expect notes to be written "immediately after the contact with the service user or before the end of that working day", and accepts that this is not always possible.

On retention, the CSP notes that "Each UK country sets out minimum retention periods for NHS health records." It gives the usual NHS minimums as eight years from the date of last treatment for adult records, and for children eight years after their 18th birthday or until 25 years of age. These are NHS figures, not a rule written for private practice. The CSP also reminds members that under data protection law, data must only be kept for as long as necessary. It points out, too, that a physio facing a claim must be able to access the records to defend themselves. Decide your own retention period with all of this in mind, check it with your indemnity insurer, and write it down.

Plan for the end of the practice as well as the start. The CSP says: "Once you retire, you must make suitable arrangements for storage of your patient records in order for you or your patients to be able to access them should the need arise in the future and to comply with data laws." Choose a notes system with that in mind, paper or electronic. What goes into each note is covered in the SOAP notes guide.

Working with private medical insurers

You do not have to take insured patients at all. The CSP's advice on working with private medical insurers (PMIs) says: "Working with PMIs is a business decision, not a professional requirement." It says physios and clinics can choose which insurers to work with based on the fees, the admin each insurer asks for and how well the arrangement fits their business model.

The CSP describes what insurers typically ask for. "Most insurers require" an initial referral or GP or consultant involvement (depending on the policy), pre-authorisation for treatment and agreed limits on the number of sessions. "Processes vary between insurers and are typically managed through online provider portals." The CSP adds: "Collecting and using outcome data is becoming central to engagement with insurers." For picking measures and reading the change, see the outcome measures guide.

On fees, you negotiate alone. "Physiotherapists can choose whether or not to accept an insurer's fee structure, but collective negotiation is not permitted under competition law." The CSP advises that members "should not accept rates that undervalue them or which don't reflect the full costs of providing advice or treatment." When costing a rate, it points to time beyond the session itself, including "writing reports, recording notes and insurer required administration."

Session limits run out. The CSP says patients can then usually self-fund more treatment, be discharged with advice and self-management strategies, or be referred to other services if appropriate. Agree which of these applies before the last authorised session, not during it. If you want to see insured patients, ask each insurer how its provider recognition works, and read the contract before you sign.

Premises and accessibility

The CSP's independent practice guidance says: "New premises must be set up in line with the Equality Act and the Disability Discrimination Act, as well as the processes for dealing with clinical waste, such as acupuncture sharps." It also reminds practice owners that health and safety law, starting with the 1974 Act, covers everyone at work.

A few things are worth checking before you sign a lease. These are practical suggestions from clinic experience, not legal requirements:

  • Can a patient with a walking frame, a crutch or a wheelchair get from the street to the treatment room?
  • Is there a toilet a patient with limited mobility can use?
  • Does the couch go low enough for a patient who cannot climb?
  • Where will clinical waste be stored, and who will collect it?

Tell your insurer about the premises too. The CSP notes that having premises may mean you "need other covers" beyond PLI.

Advertising your practice

Two sets of rules cover everything you publish, from the website to a leaflet or a social post. HCPC standard 9.3, quoted above, requires promotional activity to be accurate and not likely to mislead. The Advertising Standards Authority enforces the CAP Code, and its rule 12.1 says "Objective claims must be backed by evidence, if relevant consisting of trials conducted on people." Rule 12.2 adds that marketers "must not discourage essential treatment for conditions for which medical supervision should be sought."

The physical therapy marketing guide goes further into online reviews and testimonials, working with referrers, and the UK rules on each.

Policies to have in writing before you open

The CSP says its governance guidance for independent practitioners helps members consider the governance they need, which "included legal and regulatory frameworks, risk assessments, infection control and consent policies." You do not need a binder of policies on day one. You do need something in writing for the situations that turn up in the first few weeks. These are practical suggestions from clinic experience, not legal requirements. Settle them before you open:

  1. Consent: how you explain treatment, and how consent is written down, including for any intimate examination or treatment.
  2. Cancellations and missed appointments: what notice you need and whether you charge. Sample wording is in the cancellation policy guide.
  3. Urgent findings: who you contact, and what you do, when screening turns up a red flag. The red flags guide lists the screening questions and the point at which to refer.
  4. Data breaches: who decides whether a lost file or misdirected email is reportable, and within what time.
  5. Infection control and clinical waste.

Keep the policies where every clinician can reach them. Put a date on each one so you know when it is due for review.

Home exercise programmes from the first week

The home programme is the part of treatment you never see. Record it in your notes and give the patient that same version, so what sits in the record matches what happens in the kitchen. The home exercise programme guide deals with picking exercises and setting the dose, and the patient retention guide explains why people stop half way through a plan.

PocketPhysio handles the hand-over. Choose from the exercise library, give each exercise a dose (sets, reps, hold time), then type a cue in your own words. Each one comes with a filmed demonstration and a spoken voice guide, handy for patients who would rather not read a sheet. The programme goes out by link, SMS or email, or through Pocket Physio Care, the patient app, and WhatsApp works as well. There are plans for solo physiotherapists and for clinics, and you will find the prices in the app.

The short version

To start a private physiotherapy practice in the UK, keep your HCPC registration current and arrange your own indemnity cover, checking what CSP membership or any other policy leaves out. Register with HMRC as a sole trader, or form a limited company through Companies House. Take out employers' liability insurance before your first employee starts, and pay the ICO fee unless the self-assessment says you are exempt.

A standalone physiotherapy service in England does not need CQC registration for treatment, but a listed professional such as a doctor or nurse in the team can change that, and the CQC's guidance changed in August 2026. Keep records that meet HCPC standard 10 and plan how they will be stored after you stop. Working with private medical insurers is your business decision. Premises need to work for disabled patients, and every claim in your advertising needs evidence behind it.

References

  1. Health and Care Professions Council. Standards of conduct, performance and ethics. Effective 1 September 2024. Accessed 28 September 2026. https://www.hcpc-uk.org/standards/standards-of-conduct-performance-and-ethics/
  2. Health and Care Professions Council. Professions and protected titles. Page updated 12 May 2025. Accessed 28 September 2026. https://www.hcpc-uk.org/about-us/who-we-regulate/the-professions/
  3. Health and Care Professions Council. Professional indemnity. Updated 14 June 2018. Accessed 28 September 2026. https://www.hcpc-uk.org/registration/your-registration/legal-guidelines/professional-indemnity/
  4. Health and Care Professions Council. Record keeping. Page updated 31 August 2024. Accessed 28 September 2026. https://www.hcpc-uk.org/standards/meeting-our-standards/record-keeping/
  5. Chartered Society of Physiotherapy. Running a business (insurance guidance). Last reviewed 25 June 2026. Accessed 28 September 2026. https://www.csp.org.uk/professional-clinical/professional-guidance/insurance/running-business
  6. Chartered Society of Physiotherapy. Regulatory and professional requirements (governance support for independent practitioners). Last reviewed 7 January 2026. Accessed 28 September 2026. https://www.csp.org.uk/networks/independent-practitioners/governance-support/regulatory-professional-requirements
  7. Chartered Society of Physiotherapy. Governance support. Last reviewed 11 December 2020. Accessed 28 September 2026. https://www.csp.org.uk/networks/independent-practitioners/governance-support
  8. Chartered Society of Physiotherapy. Working with private medical insurers. Published 23 February 2021, last reviewed 5 January 2023. Accessed 28 September 2026. https://www.csp.org.uk/documents/csp-advice-insurance-rates
  9. Chartered Society of Physiotherapy. Record-keeping guidance. Last reviewed 19 August 2025. Accessed 28 September 2026. https://www.csp.org.uk/professional-clinical/professional-guidance/record-keeping-guidance
  10. GOV.UK. Become a sole trader. Accessed 28 September 2026. https://www.gov.uk/set-up-sole-trader
  11. GOV.UK. Set up a private limited company. Accessed 28 September 2026. https://www.gov.uk/limited-company-formation
  12. GOV.UK. Set up a limited company: step by step. Accessed 28 September 2026. https://www.gov.uk/set-up-limited-company
  13. GOV.UK. Employers' liability insurance. Accessed 28 September 2026. https://www.gov.uk/employers-liability-insurance
  14. nibusinessinfo.co.uk. Employers' liability insurance (Northern Ireland). Accessed 28 September 2026. https://www.nibusinessinfo.co.uk/content/employers-liability-insurance
  15. HM Revenue and Customs. Health professionals and pharmaceutical products (VAT Notice 701/57), sections 2.1, 2.3, 2.4, 2.5, 4.2 and 4.11. Updated 13 August 2026. Accessed 28 September 2026. https://www.gov.uk/government/publications/vat-notice-70157-health-professionals-and-pharmaceutical-products
  16. HM Revenue and Customs. Check employment status for tax (CEST). Updated 30 April 2025. Accessed 28 September 2026. https://www.gov.uk/guidance/check-employment-status-for-tax
  17. Care Quality Commission. What is registration? Accessed 28 September 2026. https://www.cqc.org.uk/guidance-providers/registration/what-registration
  18. Care Quality Commission. Scope of registration: introduction. Page last updated 26 August 2026, change history entry 27 August 2026. Accessed 28 September 2026. https://www.cqc.org.uk/page/scope-registration-introduction
  19. Care Quality Commission. Scope of registration: treatment of disease, disorder or injury. Updated 27 August 2026. Accessed 28 September 2026. https://www.cqc.org.uk/guidance-regulation/providers/registration/scope-registration/regulated-activities/treatment-disease-disorder-or-injury
  20. Care Quality Commission. Scope of registration: diagnostic and screening procedures. Guidance updated 26 March 2026, page last updated 31 March 2026. Accessed 28 September 2026. https://www.cqc.org.uk/guidance-regulation/providers/registration/scope-registration/regulated-activities/diagnostic-and-screening-procedures
  21. Care Quality Commission. Scope of registration: surgical procedures. Accessed 28 September 2026. https://www.cqc.org.uk/guidance-regulation/providers/registration/scope-registration/regulated-activities/surgical-procedures
  22. Care Quality Commission. Scope of registration: glossary of terms (listed healthcare professional). Page last updated 26 August 2026. Accessed 28 September 2026. https://www.cqc.org.uk/guidance-regulation/providers/registration/scope-registration/glossary-terms
  23. Healthcare Inspectorate Wales. Registration: frequently asked questions (laser and IPL queries). Accessed 28 September 2026. https://www.hiw.org.uk/registration-FAQs
  24. Healthcare Improvement Scotland. Information for service providers: independent clinics. Accessed 28 September 2026. https://www.healthcareimprovementscotland.scot/inspections-reviews-and-regulation/regulation-of-independent-healthcare/independent-healthcare-find-out-if-you-need-to-register/information-for-service-providers-independent-clinics/
  25. Information Commissioner's Office. Data protection fee. Accessed 28 September 2026. https://ico.org.uk/for-organisations/data-protection-fee/
  26. Information Commissioner's Office. Data protection fee self assessment. Accessed 28 September 2026. https://ico.org.uk/for-organisations/data-protection-fee/self-assessment/
  27. Information Commissioner's Office. What is special category data? Updated 9 April 2024. Accessed 28 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/
  28. Information Commissioner's Office. What are the rules on special category data? Accessed 28 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-rules-on-special-category-data/
  29. Information Commissioner's Office. What are the conditions for processing? Published 18 December 2023. Accessed 28 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-are-the-conditions-for-processing/
  30. Information Commissioner's Office. What is the right to be informed and why is it important? Accessed 28 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/the-right-to-be-informed/what-is-the-right-to-be-informed-and-why-is-it-important/
  31. Information Commissioner's Office. A guide to subject access. Updated 16 July 2026. Accessed 28 September 2026. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/
  32. Information Commissioner's Office. Personal data breaches: a guide. Updated 20 August 2025. Accessed 28 September 2026. https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
  33. Committee of Advertising Practice. UK Code of Non-broadcast Advertising and Direct and Promotional Marketing (CAP Code), Section 12: Medicines, medical devices, health-related products and beauty products, rules 12.1 and 12.2. Accessed 28 September 2026. https://www.asa.org.uk/type/non_broadcast/code_section/12.html

Written and checked by the PocketPhysio editorial team. Last updated 2026-09-28.