Privacy Policy

1. Data Controller

Cardinal Clinic, Oakley Green, Windsor, Berkshire, SL4 5UL. Contact: [email protected].

2. Lawful Bases for Processing (UK GDPR Article 6)

We process personal data on the bases of (a) consent for marketing communications, (b) legitimate interests for responding to enquiries, and (c) legal obligation for clinical record keeping.

3. Special Category Data — Health Information (Article 9)

Health information you provide is special category data. We process it under Article 9(2)(h) — provision of health and social care — by professionals subject to a duty of confidentiality.

4. Categories of Data We Collect

Contact form submissions (name, email, phone, message); admin account credentials; cookie preferences. We do NOT collect analytics data without your consent.

5. Recipients and Sharing

Transactional emails (e.g. contact form submissions forwarded to our admissions team) are sent via Resend, acting as a data processor. Website hosting is self-managed on infrastructure within the United Kingdom. We do not share personal data with marketing third parties.

6. Retention

Contact form enquiries submitted via this website are retained for 24 months, after which they are securely deleted. Admin account credentials are retained for the life of the account. Cookie preferences are stored in your browser and are not held on our servers. Google Analytics data is retained for 14 months (configurable in GA4). Clinical records held in our clinical systems (separate from this website) are retained in accordance with NHS retention guidance (typically 25 years for adult health records).

7. Your Rights

You have the right to access, rectification, erasure, portability, restriction of processing, objection, and protection from solely automated decision-making. To exercise these rights, contact [email protected].

8. Complaints

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

9. Cookies

See the cookie banner for current preferences. We use only necessary cookies unless you opt in to analytics.