22 Rehab
Privacy notice
Last reviewed:
This notice explains what 22 Rehab does with your personal and health information — what we record, why we hold it, who can see it, and what you can ask us to do with it. It covers both this website and the clinical records we keep about your treatment. Please read it before you accept it in your patient portal.
Who is responsible for your information
22 Rehab is a single-clinician physiotherapy practice operating by home visit in Amman. Mqdad Shakir is the physiotherapist treating you and the person responsible for the records kept about you — in the language of the law, the data controller. There is no other clinician, no reception company and no third party with standing access to your file. Any question or request about your information goes to him directly.
The law this notice follows
Jordan’s Personal Data Protection Law No. 24 of 2023, which came into force on 17 March 2024. It gives you a set of rights over information about you and places duties on anyone who holds it. Health information is treated as sensitive data under that law and is held to a higher standard than an email address or a phone number. This notice is written to cover what that law requires us to tell you before we process anything.
What we collect
From the booking form: your name, mobile number, the area of concern you choose, your preferred time, and — if you give them — your email address and anything you write in the notes. If you become a patient we also record what is needed to treat you: your medical history, current medications, allergies, any relevant surgical history, the findings of your movement assessments, notes from each session, and the rehabilitation programme prescribed for you. If you use the patient portal we record when you sign in and which exercises you tick off.
Why we hold it, and what entitles us to
To assess you, treat you, track whether the treatment is working, and keep the record of your care that a healthcare provider is required to keep. We also use your contact details to confirm and remind you about appointments. Your clinical record rests on the ground the law provides for healthcare itself — processing carried out for preventive medicine, medical assessment, or the provision of care by a licensed practitioner — rather than on your consent alone. That distinction matters, and the next section explains why. We do not use any of it for marketing, we do not send bulk promotional messages, and we never sell or rent it to anyone.
When processing starts, and for how long
Processing begins the moment you submit the booking form, and continues for as long as you are a patient of the practice and for the retention period described below. We will not extend it beyond that, or begin using your information for some new purpose, without telling you and asking you first.
Your consent, and what it does and does not cover
Before your records appear in the patient portal we ask you to accept this notice, and we record both the date and which version of the text you accepted. That consent covers the portal account and the convenience of holding your record in a system you can log into. It is not what entitles us to keep a clinical record of your treatment — that stands on the healthcare ground described above, which is why withdrawing consent does not erase the record of care you have already received and does not override a retention period the law imposes on us. What withdrawing consent does do is close your portal access and stop any use of your information that depends on your agreement. You can do it at any time, and it will never affect the treatment you are offered.
Automated scoring, and what is not automated
The movement assessment is scored by the system from the boxes the physiotherapist ticks, and a draft exercise programme is generated from the compensations he records. Both are working tools for a clinician, not decisions about you: nothing here decides your treatment, your fee, or anything else affecting you without the physiotherapist reviewing it and choosing. We do not build behavioural profiles, we do not score you for any purpose outside your own rehabilitation, and none of it is shared with or sold to anyone. You may object to this scoring; the consequence is simply that your programme is written by hand instead.
We do not share your records
Your clinical information stays inside this clinic. We do not give it to employers, insurers, family members, sports clubs, coaches or anyone else without your specific, informed permission — and asking for that permission is a separate conversation each time, not something covered by accepting this notice. If you want a report sent to a doctor, surgeon or insurer, you tell us and we send it; we will not do it on our own initiative. The only exceptions are where the law requires disclosure, or where an emergency makes it necessary to protect your life or someone else’s. If we ever have to rely on one of those exceptions we will tell you, unless the law forbids it.
Who can see it inside the clinic
Only the treating physiotherapist. The system is built so that one patient can never see another patient’s information: when you sign in, the portal shows only records belonging to your own account, and this is enforced by the system rather than left to a setting anyone could get wrong. Every administrative action taken on your record is logged with who did it and when.
Companies that help us run the service
The website and database are run on hosting services, and appointment emails are sent through an email provider. These companies process your information only to store or transmit it on our behalf, under contract, and are not permitted to read it, use it for their own purposes, or pass it on. They are not given access to your clinical records for any other reason.
Where your information is stored
Your records are held in a database operated by our hosting provider. We will name that provider and the country its servers are in on this page once hosting is finalised, and we will tell existing patients before moving their data anywhere new.
How we protect it
The clinical free text in your file — your history, medications, allergies, session notes and programme — is encrypted in the database, so anyone who obtained a copy of the database itself would get unreadable text rather than your medical history. Your portal account is protected by a password we store only in scrambled form and cannot read, and every sign-in is recorded. Only the treating physiotherapist can open your file, and every administrative action taken on it is logged with who did it and when. Changing your password signs you out of every other device immediately. We will not overstate this: encryption protects the stored copy, not a running system that has to be able to read your notes in order to show them to your physiotherapist.
If something goes wrong
If your information is exposed in a way that puts it at risk, the law requires us to tell you within twenty-four hours of discovering it, and to notify the Personal Data Protection Unit within seventy-two hours. We will tell you what happened, what was affected, and what you can do about it — in plain language, not a technical notice written to be skimmed past.
How long we keep it
Booking requests that never become appointments are deleted within six months. Clinical records are kept for the period required of healthcare providers in Jordan, counted from your last appointment, because a physiotherapy record has to remain available long after treatment ends. When that period expires the record is destroyed.
Your rights
Under the Personal Data Protection Law you may: ask what we hold about you and receive a copy; ask us to correct anything inaccurate; ask us to delete your information; ask us to limit how it is used to a narrower purpose; object to processing, including the automated scoring described above; withdraw your consent; receive your information in a portable, machine-readable form; and be told if it is ever breached. Ask the clinic by phone or email. We will answer within thirty days — that is our own commitment to you — and where we cannot do what you ask, we will tell you why rather than simply not replying.
If you are not satisfied
You are entitled to complain to the Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship, which oversees this law in Jordan, and to the Personal Data Protection Council that sits above it. Using this website, or accepting this notice, does not take that right away and never will. We would rather you came to us first so we can put it right, but that is a preference, not a condition.
Patients under eighteen
Where the patient is a child, a parent or legal guardian gives consent, receives this notice, and holds the portal account. The clinical record belongs to the child and is kept on the same terms as any other patient’s.
Cookies and analytics
The public website sets no cookies and runs no analytics or advertising trackers. The patient portal sets one cookie, which exists solely to keep you signed in; it carries no advertising or tracking function and is removed when you sign out.
Changes to this notice
If we change how we handle your information we will update this page and the review date above. Where a change materially affects your records — a new country of storage, a new category of information, or a new recipient — we will ask you to read and accept the notice again rather than change it quietly.
Questions about your information
Ask Mqdad Shakir directly, by phone or email. Any request about your records — a copy, a correction, a deletion, a limit on how it is used, or withdrawing consent — goes to the same place.