Policy
Privacy
This site is for dental professionals, and it collects very little. This page says exactly what, why, who else sees it, and how to get it back or get rid of it.
Last updated [TO CONFIRM — set to the date this goes live].
Who's responsible
Dr Elaine Halley is the data controller for this site — meaning I'm the one who decides what's collected and what happens to it, and I'm the one to complain to if it goes wrong.
| Legal entity | [TO CONFIRM — sole trader, or the registered company name and number] |
| Address | [TO CONFIRM — the registered or correspondence address] |
| ICO registration | [TO CONFIRM — the ICO registration number for this entity] |
| Contact | [TO CONFIRM — an email address for data protection enquiries] |
I don't have a Data Protection Officer, and at this scale I'm not required to. Anything you want to raise comes to me directly.
What I collect, and why
The enquiry form
The contact form asks what you're after and then asks only what's relevant to that. Depending on which you pick, it collects:
| Always | Your name, your email address, and your practice if you choose to give it |
| Learning with me | Which thing you're interested in, and what you're trying to get better at |
| Booking me to speak | Your organisation, and an approximate date |
| A second opinion | Your GDC number, and your summary of the case |
I use this to reply to you and, if it goes somewhere, to carry on the conversation. That's it — it isn't used to build a profile of you, and it doesn't go into the mailing list unless you tick the box.
Lawful basis: legitimate interests. You've contacted a professional to ask a professional question, and replying to you is the obvious and expected use of what you sent. If you'd rather I didn't hold it after we're done, say so and I'll delete it.
Case summaries — please keep them anonymous
If you're asking for a second opinion, the form asks you not to include patient names, dates of birth, or anything else that identifies the person. I mean it. Send me the clinical picture, not the patient.
If identifying details do arrive — it happens — I'll remove them from what I keep and reply without repeating them. If a photograph or a scan arrives with data embedded in it, the same applies. Your own duty to your patient sits with you, so if you're unsure whether to send something, don't.
The newsletter form
The footer form collects your email address and nothing else. You have to tick the consent box for it to go anywhere.
Lawful basis: consent. Every email has an unsubscribe link, it works immediately, and you never have to ask me for permission to use it.
Server logs
Like any website, this one runs on a server that keeps short-lived logs — IP address, the page requested, the time, the browser. That's used for keeping the site up and dealing with abuse, on the basis of legitimate interests. It isn't used to identify you and isn't linked to anything else.
Who else handles it
Four companies are involved in running this site. None of them may use your details for their own purposes.
| Netlify United States | Hosts this site and receives anything you send through its forms. |
| EmailOctopus United Kingdom | Holds the mailing list and sends the emails. |
| Google Fonts United States | Serves the two typefaces this site uses. It sets no cookies, but Google receives your IP address as part of sending the fonts. |
| JotForm United States | Handles study club registration, if you sign up. That form is on JotForm's own site, and their privacy notice covers it. |
Two of those are in the United States, so some of this leaves the UK. Where it does, the transfer relies on the standard contractual protections those suppliers put in place — the UK's approved mechanism for exactly this. If you'd like the detail, ask.
Beyond that: nothing is sold, nothing is shared for anyone else's marketing, and there's no advertising network involved anywhere on this site. If I'm ever legally required to hand something over, I will, and I'll tell you unless I'm not allowed to.
How long I keep it
| Enquiries | 24 months from our last contact |
| Case summaries | 12 months, or sooner once we've finished discussing the case |
| Newsletter subscription | until you unsubscribe |
| Form submission copies | 12 months in the form tool, separately from the mailing list |
When something reaches the end of that, it's deleted rather than archived. Ask me to delete it sooner and I will.
What you can ask me to do
Under UK GDPR you can ask me to:
| Show you | A copy of everything I hold about you |
| Correct it | Fix anything wrong or incomplete |
| Delete it | Erase what I hold, where there's no reason I have to keep it |
| Pause it | Restrict what I do with it while something's in dispute |
| Object | Tell me to stop relying on legitimate interests — including a flat objection to marketing, which I have to honour with no argument |
| Move it | Receive what you gave me in a portable format |
| Withdraw consent | Unsubscribe, at any time, without affecting anything done before you did |
Email me and I'll deal with it within a month, free of charge. I may ask you to confirm who you are first, which is a protection for you rather than an obstacle.
There's no automated decision-making or profiling on this site. Nothing here decides anything about you.
If you're not happy
Tell me first and I'll try to sort it. You don't have to, though — you can go straight to the Information Commissioner's Office, the UK regulator, at ico.org.uk/make-a-complaint ↗ or on 0303 123 1113. Complaining to them costs nothing and doesn't affect anything between us.
Changes
If this page changes, the date at the top changes with it. If the change is significant — a new supplier, a new purpose, anything that alters what happens to what you've already sent — I'll email anyone on the list rather than quietly editing the page.
Patients
This site is for dental professionals and holds no patient records. If you're a patient of Cherrybank Dental Spa ↗, your records sit with the practice under its own privacy notice, and this page has nothing to do with them.