06Privacy
What we collect, what your browser stores, and who else sees you.
This notice covers this website only. Health records held on behalf of a clinic are governed by the custody model and the data processing agreement with that clinic, not by this page.
The controller for this website
[LEGAL ENTITY NAME], [REGISTERED ADDRESS], company number [COMPANY NUMBER]. Questions about this notice, or any request under section 06, go to [PRIVACY EMAIL].
Our data protection officer is [DPO NAME OR "not required — see below"]. Our supervisory authority is [YOUR REGULATOR], and you may complain to them directly without going through us first.
This site sets no cookies
There is no cookie banner on this site because there is nothing to consent to. We set no cookies, first-party or third-party. We run no analytics, no tag manager, no advertising or conversion pixel, and no session cookie. Nothing is written to localStorage or sessionStorage.
A banner asking permission to do nothing is theatre, and we would rather be checkable than reassuring. Here is the whole of what this site puts in your browser:
If we later add anything that needs consent, a banner appears at the same time and this section changes on the same day. It will not appear quietly.
What you hand us on purpose
The form in section 05 of the home page asks for three things: your work email, your organisation, and your question. That is all it asks and all we receive.
The form is not yet connected to a mailbox. Until it is, nothing you type into it leaves your browser — it confirms on screen and is discarded when you close the tab. When we do connect it, the tick-box beside it will still be the consent, and this paragraph will say where the message goes and who processes it: [INTAKE PROCESSOR], retained [RETENTION PERIOD].
We do not add you to a mailing list, we do not enrich your email against any data broker, and we do not pass it to a sales tool.
Two, and both of them are for type
Loading this page fetches our typefaces from Google:
- fonts.googleapis.com — the stylesheet that names the fonts.
- fonts.gstatic.com — the font files themselves.
Those are requests your browser makes directly to Google, which means Google can see your IP address, your user agent, and which page you were on. Google states it sets no cookies for these requests. We have no agreement with Google covering your visit, and we cannot see or log anything about it.
We are not comfortable with that on a site about data custody, and we are moving both files onto our own servers so that no third party sees a visitor at all. Tracked as [TICKET], due [DATE]. Until then this section is the honest answer rather than the flattering one.
Hosting
This site is served by Vercel Inc. As our hosting processor they handle standard access logs — IP address, user agent, the URL requested, and a timestamp — under their data processing terms. Retention on our account is [LOG RETENTION]. We do not build profiles from these logs and we do not use them for analytics.
Why we are allowed to do this
- Serving the page you asked for, including the access logs that come with it — legitimate interests (GDPR Art. 6(1)(f)): you asked for a page, we have to deliver it and keep the service standing up.
- Answering your access enquiry — legitimate interests, or steps towards a contract (Art. 6(1)(b)) where you are asking to become a customer.
We rely on consent for nothing on this site, because we do nothing on this site that requires it. No special category data — nothing about anyone's health — is collected by this website.
What you can make us do
Under the GDPR you may ask us to give you a copy of what we hold about you (Art. 15), correct it (Art. 16), delete it (Art. 17), restrict what we do with it (Art. 18), hand it to you in a portable format (Art. 20), or object to our relying on legitimate interests (Art. 21).
Write to [PRIVACY EMAIL]. We answer within [N] days and we do not ask you to prove your identity beyond what is needed to be sure we are not disclosing your data to somebody else. If we refuse, we tell you why and we tell you how to complain.
How you will know this changed
The version number and date at the top of this page change whenever the substance does. Material changes — a new processor, a new category of data, anything that would need consent — are announced [N] days before they take effect, and we keep the previous versions available at [ARCHIVE URL] so you can see what moved.
Reporting a problem with this site
If you find a vulnerability, our disclosure terms and contact are on the custody page and at /.well-known/security.txt. We will not send a lawyer.