Privacy

Privacy statement

Last updated 24 October 2026

Who we are

Striva is practice-management software for MSK clinics (physiotherapy, chiropractic, osteopathy and sports therapy), provided by Calderwell Group Ltd, trading as Striva (“Striva”, “we”, “us”). Calderwell Group Ltd is a company registered in England and Wales, company number [●], with its registered office at Suite A, 82 James Carter Road, Mildenhall, IP28 7DE, and is registered with the Information Commissioner’s Office, registration number [●]. If you have any question about this statement or your information, email support@striva.uk.

Our two roles

When a practice uses Striva to keep its patients’ records, the practice is the controller of that information and we are its processor: we hold and handle it only to provide the service, on the practice’s instructions. If you are a patient, please contact your practice about your records.

For the people who sign in to Striva (practice owners and staff) and for the practices that subscribe, we are the controller of that account and billing information.

What we hold

• Staff accounts: name, work email address, role and permissions, and a record of sign-ins and of what was done (an audit trail).
• Subscribing practices: the practice’s name and address, the owner’s contact details, and the plan and billing status. Card details are taken and held by Stripe; we never see them.
• Patient records, on behalf of practices: contact details, appointments, clinical notes, questionnaires, documents and invoices.

Why we use it, and on what basis

We use staff and practice information to provide the service a practice has signed up for (performance of a contract) and to keep that service secure and working properly (our legitimate interests). We use patient information only to provide the service to the practice, under our agreement with it. Health information is processed for the provision of health care, as UK GDPR and the Data Protection Act 2018 allow.

Who else handles it

We never sell personal information or use it for advertising, and we do not use advertising or tracking cookies. We use a small number of suppliers, who handle information only on our instructions and only to provide their part of the service:

• Contabo hosts our servers and databases in the United Kingdom.
• Microsoft provides staff sign-in (Microsoft Entra ID).
• Stripe handles subscription billing and card payments.
• SmarterASP.NET sends our emails, such as appointment confirmations and reminders.
• Smarty, a UK mobile network, carries our text messages, such as appointment reminders. They are sent from our own SMS gateway in the UK.

Microsoft and Stripe may process some information outside the UK. Where they do, it is protected by the UK’s adequacy regulations or by the UK International Data Transfer Agreement. We may also disclose information where the law requires it.

How we protect it

• Every connection to Striva is encrypted (HTTPS).
• The most sensitive clinical information is encrypted again before it is stored, with a key kept apart from the database, so a copy of the database on its own cannot be read.
• Each practice’s information is kept in its own separate database, never mixed with another’s.
• Access is limited by role, and every access to a patient’s record is logged.

How long we keep it

Patient records are kept for as long as the practice decides; professional guidance is at least 8 years after the last treatment, and longer for children. Staff accounts are kept while the practice uses Striva and are deleted within 90 days of the practice leaving, except where the law requires us to keep a record, such as billing records, which we keep for 6 years.

Your rights

You can ask to see the information we hold about you, to have it corrected or deleted, to restrict or object to how it is used, or to receive a copy to take elsewhere. Email support@striva.uk. For patient records, please contact your practice; we will help it respond. We reply within one month.

Complaints

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.