0115 684 8929 Request a call back

Privacy notice

Draft — not yet reviewed. This page was written as a starting point for a solicitor, not as finished legal text. It has not been reviewed by anyone qualified to review it, and it should not be relied on as it stands. It must be checked and signed off before the site takes a payment or accepts an enquiry.

The short version

If you fill in a form on this site, or buy a guide, you give us information about yourself. Some of it is information about your health. This page explains what happens to it.

Health information needs special treatment

Most personal data — a name, an email address — is ordinary personal data. Information about your health is not. Under Article 9 of the UK GDPR it is special category data, and it may only be processed on a narrower set of grounds with additional safeguards.

This site collects it in two ways, and the second is less obvious than the first:

  • Directly. The message box on the contact form invites you to describe your symptoms. Whatever you write there is health information.
  • By inference. Downloading a guide about prolapse implies something about your health just as clearly as writing it down would. A record saying that a named person downloaded that guide is health data about that person.

The second point shapes how this site is built. Download links carry a one-way hash rather than your email address, order records are keyed by that hash, and the mailing list is tagged generically — it is never told which guide you bought, or which condition you asked about. What you purchased is held by Stripe, which needs it to process the payment.

Lawful basis

{{ TODO: needs sign-off — confirm the Article 6 basis and, separately, the Article 9 condition. The likely pairing for enquiries is Article 6(1)(a) consent with Article 9(2)(h), provision of health care by a professional bound by professional secrecy. For guide sales it is Article 6(1)(b), performance of a contract. This must be confirmed by someone qualified, not assumed. }}

Where an enquiry actually goes

When you send a message through the contact form, this is what happens to it.

What you wrote is stored in a database run by Cloudflare, and nowhere else. It is not copied into an email and it is not copied into the triage spreadsheet.

Two things are created alongside it. An email to the practice saying an enquiry has arrived, carrying your name, your contact details, the topic you picked, how you would prefer to be contacted, and whether you are happy for us to leave a voicemail — but not your message. And a row in a spreadsheet used to keep track of what has been answered, carrying the same fields, again without your message.

Both of those carry a link. Reading what you wrote means following it, and that page is restricted to named people at the practice.

This is deliberate. An email gets forwarded and a spreadsheet gets shared, and neither is a good home for a paragraph about your symptoms.

Who sees it

{{ TODO: needs sign-off — name the specific roles with access to the enquiry record }}

These processors are used:

  • Cloudflare — hosting, storage of the guide files, and the database that holds enquiries.
  • Google Workspace — a spreadsheet used to triage enquiries. It holds a name, a topic and a reference, and never the message you wrote.
  • Resend — sending download and notification emails.
  • Stripe — payment processing.
  • Campaign Monitor — the mailing list, if you have asked to receive one.

How long it is kept

Enquiries that do not lead to an appointment are deleted after 12 months. That is not a policy someone has to remember — a deletion date is written onto each enquiry when it arrives, and a job runs nightly to remove anything past it.

{{ TODO: needs sign-off — retention for enquiries that DO become appointments, which become part of a clinical record and are governed separately; and retention for order records and mailing-list entries }}

Your rights

You can ask what is held about you, ask for it to be corrected, ask for it to be deleted, withdraw consent, or object to it being used. Write to care@morgangynaecology.co.uk.

If you are not satisfied with the response you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

{{ TODO: needs sign-off — confirm what is actually set. At the time of writing the site sets no analytics or advertising cookies; if any are added, this section and a consent mechanism are both required. }}

We use Cloudflare Web Analytics to count visits to this site. It sets no cookies and does not identify you.

Mr George Morgan is registered with the General Medical Council.