Privacy Policy

Last updated: 15 September 2026

Motion Health Ltd. ("Motion", "we", "us" or "our") is committed to protecting personal data and respecting privacy.

Motion Health Ltd. is a company registered in England and Wales under company number 15086043.

Registered office: Sheffield Technology Parks, Sheffield, S1 2NS, United Kingdom.

Website: www.motion.org.uk
Contact: info@motion.org.uk

This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit our website, use Motion's services, communicate with us, or use the Motion platform and Motion Circle application.

Where Motion processes personal data on behalf of a care provider or other customer, that customer will generally be the data controller and Motion will generally be the data processor. In those circumstances, the customer's privacy notice will also apply and should explain why the customer's service users' data is being collected and used.

1. Who is responsible for your personal data?

The organisation responsible for personal data depends on the circumstances.

Motion as data controller

Motion is the data controller for personal data that we process for our own purposes, including:

information about prospective and existing customers and their employees;

information submitted through our website;

information relating to sales enquiries;

account, billing and contractual information;

information relating to our suppliers and business partners;

information relating to support enquiries;

website and service usage information;

information used to communicate with you about our services; and

information we use for legitimate business, security, compliance and marketing purposes.

Motion as data processor

Where a care provider or other customer uses Motion to process personal data relating to people receiving care or support, Motion generally acts as a processor on the customer's behalf.

The customer determines why that personal data is collected and how it is used. Motion processes it to provide the services in accordance with the customer's instructions and our Data Processing Agreement.

The customer remains responsible for ensuring that it has an appropriate lawful basis for processing personal data and for providing appropriate privacy information to the people whose data it collects.

2. Information we may collect

Depending on how you interact with Motion, we may collect:

Information about customers and users

This may include:

name;

job title and role;

organisation;

email address;

telephone number;

billing and payment information;

communications with Motion;

support requests;

information about how you use our services; and

information needed to administer your organisation's Motion account.

Information relating to people supported by our customers

The Motion platform may be used by care providers to record information relating to activities, goals, interests, participation and outcomes.

This may include:

name;

photographs;

interests and preferences;

goals and desired outcomes;

activity participation;

social and community engagement;

information about family members, relatives or other members of a person's circle of support; and

other information that a customer chooses to enter into the platform.

Customers should not enter information into Motion that is unnecessary for the purposes for which the service is being used.

Motion does not intend the platform to be used as a medical records system. Customers should not use Motion to store information that is unnecessary for activity planning, social engagement or quality-outcome purposes.

3. Photographs and other content

Customers may upload photographs and other content to Motion.

The customer is responsible for ensuring that it has the appropriate legal authority, permissions and/or consent to upload and use photographs and other personal information through the platform.

Motion processes customer-uploaded content on behalf of the relevant customer in accordance with the customer's instructions and our Data Processing Agreement.

4. Motion Circle

Motion Circle is a native application that enables people supported by care providers and members of their circles of support to participate in a social feed and engage with relevant content.

The information visible through Motion Circle will depend on the configuration selected by the relevant customer and the permissions assigned to individual users.

Customers are responsible for deciding who should have access to information through Motion Circle and for ensuring that appropriate permissions and safeguards are in place.

5. How we use personal data

Where Motion acts as a controller, we may use personal data to:

provide and administer our services;

create and manage accounts;

communicate with customers and users;

provide customer support;

process payments and manage accounts;

maintain and improve our services;

monitor service performance;

detect, investigate and prevent security incidents, fraud and misuse;

comply with legal and regulatory obligations;

maintain business records;

send service communications;

send relevant marketing communications where permitted by law;

understand how our services are used;

create aggregated or anonymised statistics and insights;

improve our products and services; and

establish, exercise or defend legal claims.

Where Motion acts as a processor, we process customer data only for the purposes agreed with the customer and as set out in the applicable agreement and Data Processing Agreement.

6. Aggregated and anonymised information

Motion may create aggregated and/or anonymised information from information relating to use of the platform.

Where information has been genuinely anonymised so that individuals can no longer be identified, it is no longer personal data.

We may use genuinely anonymised or aggregated information to:

understand patterns of platform use;

measure service performance;

improve our products;

develop new features;

produce research, benchmarking or industry insights; and

support our business planning and reporting.

We do not use customer data to train artificial intelligence models.

7. Legal bases for processing

Where Motion acts as a controller, we will rely on one or more lawful bases under applicable data protection law.

These may include:

Contract: where processing is necessary to provide our services or administer a contract.

Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by the rights and interests of individuals.

Legal obligation: where processing is necessary to comply with a legal or regulatory requirement.

Consent: where we rely on consent, we will request it appropriately and explain how it can be withdrawn.

We will only process special category data where an appropriate legal basis and special category condition exists.

8. Sharing personal data

We may share personal data with:

our customers, where appropriate;

service providers and subprocessors who help us provide our services;

cloud hosting and infrastructure providers;

providers of email, communications, monitoring and security services;

professional advisers;

payment providers;

law enforcement, regulators or other authorities where legally required;

purchasers or prospective purchasers of our business in connection with a corporate transaction; and

other parties where required or permitted by law.

Our current subprocessor information is available through the Motion Trust Centre.

9. International transfers

Motion aims to keep personal data within the United Kingdom and/or European Economic Area as described in our contractual documentation and Trust Centre.

Some service providers may process information outside the UK or EEA.

Where personal data is transferred outside the UK, we will use an appropriate legal safeguard where required, such as an adequacy regulation, the UK International Data Transfer Agreement, UK Addendum to EU Standard Contractual Clauses, or another lawful transfer mechanism.

10. Security

Motion takes reasonable and appropriate technical and organisational measures to protect personal data.

Our security measures include, where applicable:

encryption in transit;

encryption at rest;

access controls;

least-privilege access;

multi-factor authentication for appropriate internal systems;

monitoring and logging;

vulnerability management;

backups and recovery procedures;

security testing; and

staff access controls.

Motion is Cyber Essentials Plus certified.

Further information is available in our Security & Reliability documentation.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to satisfy legal, accounting, contractual or regulatory requirements.

Where Motion acts as a processor, customer data will be retained and deleted in accordance with the applicable contract and the customer's instructions.

Following termination of a customer's subscription, Motion may retain limited information where necessary to comply with legal obligations, resolve disputes, enforce agreements or maintain appropriate business records.

12. Your rights

Depending on the circumstances and applicable law, individuals may have rights including:

the right to be informed;

the right of access;

the right to rectification;

the right to erasure;

the right to restrict processing;

the right to object to processing;

the right to data portability; and

rights relating to certain automated decision-making.

Where Motion acts as a processor, requests concerning customer-controlled data should generally be made to the relevant care provider or other customer. Motion will assist its customers with such requests where required by the Data Processing Agreement.

13. Marketing

Where we send direct marketing communications, we will do so in accordance with applicable data protection and electronic communications laws.

You can unsubscribe from marketing communications at any time by following the unsubscribe instructions in the relevant communication or contacting us.

Service and transactional communications may still be sent where necessary to provide the service.

14. Cookies and similar technologies

Our website and services may use cookies and similar technologies for functionality, security, analytics and other purposes.

Where consent is required, we will obtain it before using the relevant technology.

You can manage certain cookie preferences through your browser or any cookie-management tools provided on our website.

15. Data protection complaints

If you have a concern about how Motion has handled your personal data, please contact us first at:

info@motion.org.uk

We will acknowledge and investigate data protection complaints in accordance with our data protection complaints process.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Where appropriate, we will notify customers or users of material changes.

The latest version will always be made available through the Motion website.

17. Contact us

If you have questions about this Privacy Policy or Motion's processing of personal data, contact:

Motion Health Ltd.
Sheffield Technology Parks
Sheffield
S1 2NS
United Kingdom

Email: info@motion.org.uk

Company number: 15086043