Privacy &
Data Protection

The data controller for personal data collected through this FlowNexa lead qualification form is:

FlowNexa is a technology service that provides AI-powered lead capture and qualification infrastructure for professional services firms. It does not itself provide Physiotherapists services. All professional advice and clinical services are provided by the qualified physiotherapist to whom your enquiry is routed.

This policy applies solely to data collected through the Physiotherapists vertical. A separate privacy policy applies to each other FlowNexa vertical.

When you complete the FlowNexa qualification form on the Physiotherapists vertical, we collect the following categories of personal data:

Identity and Contact Data:

• Full name
• Phone number
• Email address
• Postcode or general location

Clinical and Situational Data:

• Injury type, cause, and timeline
• Surgical status and operation date if applicable
• Diagnosis status and investigation results (existence only)
• Upcoming event or competition deadline
• Impact on daily activities and pain level
• Previous physiotherapy history
• Payment type including medico-legal funding status
• Urgency level and preferred contact time

Consent and Compliance Data:

• GDPR consent flag (Yes/No) with submission timestamp
• Lead score and classification (Hot/Warm/Cold)
• Vertical identifier for internal routing

By ticking the consent checkbox on the qualification form, you provide explicit consent for your data to be collected, processed, and shared with the relevant qualified physiotherapist solely for the purpose of reviewing your enquiry and contacting you.

You have the right to withdraw your consent at any time by contacting hello@flownexa.io. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

Your personal data is collected and processed for the following specific purposes only:

• Qualifying your enquiry using our AI scoring engine to classify it as Hot, Warm, or Cold based on clinical urgency and relevant criteria
• Routing your structured enquiry to the relevant qualified physiotherapist in your local area
• Storing your record in AWS DynamoDB for the qualified physiotherapist's reference and follow-up
• Syncing your enquiry to the qualified physiotherapist's private Google Sheet dashboard
• Dispatching a transactional SES email alert to the qualified physiotherapist containing your structured enquiry summary

Your personal data is stored and processed on the following infrastructure, all within the United Kingdom:

• AWS DynamoDB — EU-West-2 (London) region. Encrypted at rest using AWS-managed encryption keys. Access restricted to the FlowNexa Lambda execution role via IAM policies.
• AWS Lambda — EU-West-2 (London) region. Serverless execution — data is not persisted within the function beyond the execution context.
• AWS SES — EU-West-2 (London) region. Transactional email dispatch only — email content is not stored by FlowNexa beyond dispatch confirmation.
• AWS Amplify — EU-West-2 (London) region. CDN delivery of the capture page. No personal data is stored at the Amplify layer.
• Google Sheets — Accessed via Google Apps Script API. The qualified physiotherapist's private Google Sheet is controlled by the professional and subject to Google's privacy policy.

All data in transit is encrypted using TLS 1.3. All API endpoints are served over HTTPS. CORS is configured to allow requests only from authorised FlowNexa domains.

Your personal data is shared only with the following parties:

• The qualified physiotherapist — Your structured enquiry, lead score, and contact details are shared with the relevant qualified physiotherapist in your local area via email alert and Google Sheets access. This professional is the intended recipient of your enquiry.
• Amazon Web Services (AWS) — As our infrastructure provider, AWS processes data on our behalf as a data processor. All processing occurs in EU-West-2 (London).
• Google — As a data processor for the Google Sheets sync function. Google Workspace data processing terms apply.

We do not share your data with any other third parties, affiliates, marketing companies, or data brokers.

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:

To exercise any of the above rights, contact hello@flownexa.io with the subject line "Data Subject Request." We will acknowledge within 72 hours and fulfil within 30 days.

FlowNexa uses an automated scoring algorithm to classify your enquiry as Hot, Warm, or Cold based on your form responses. This classification determines the priority with which the qualified physiotherapist is alerted to your enquiry.

This automated classification does not produce legal effects or significantly affect you — it is a routing and prioritisation tool only. The qualified physiotherapist makes all professional judgements independently after reviewing your full enquiry details.

The FlowNexa Physiotherapists lead qualification page does not use cookies, tracking pixels, session storage, or any client-side tracking technology beyond the form submission itself. No analytics, advertising, or retargeting cookies are placed on your device.

If you are not satisfied with our response, you may lodge a complaint with the Information Commissioner's Office:

This privacy policy was last updated in July 2026. Material changes will be communicated via email to any party whose data we hold, prior to those changes taking effect. The current version is always available at flownexa.io/privacy-physiotherapy.html.