Consultant Patient Ltd
Version 1.6 · Effective date: 14 October 2026
This privacy policy explains how Consultant Patient Ltd handles personal data when you email us or visit our website. Registration as a Consultant Patient is not open yet. We will update this policy as our activities develop.
Consultant Patient Ltd (“we”, “us” or “the Company”) is the data controller responsible for the personal data described in this policy. Registered in England and Wales, company number 17085858.
Contact details:
ICO Registration Number: ZC142572
This Privacy Policy explains how the Company collects, uses, stores, and protects personal data in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR).
At present, individuals share personal data with the Company by contacting us directly by email. When you visit our website, some technical information is also processed so that the site can work (see section 4). This policy describes how we handle both.
When you email us, we process the information in your email and subsequent correspondence. This typically includes:
If you email participant@consultantpatient.com to register your interest in becoming a Consultant Patient, we ask for your name and the country you live in. We use your country of residence to answer questions about eligibility. Registration will open first to people living in the United Kingdom, and we confirm eligibility by email.
Please do not include health information or other sensitive personal details in your initial enquiry. We do not ask for this information when you register your interest or make a general enquiry.
If you include health information in your initial enquiry, we will not use those details to assess your enquiry. We will respond without repeating the health information and promptly delete the original email. We will retain only the contact information needed to manage your enquiry and a minimal record of the action taken, without the health details.
Our website is hosted on Webflow. When you visit it, Webflow processes technical information needed to deliver pages to your device and keep the site secure, such as your IP address, browser type and the pages you request. Section 12 also explains Webflow’s use of some technical log data for its own purposes.
We use the information you send us to:
We do not use your data for unrelated purposes, and we do not sell it or share it for marketing.
We process ordinary contact details and correspondence on the basis of our legitimate interests under Article 6(1)(f) UK GDPR. Our legitimate interests are to respond to enquiries, manage correspondence, notify people who registered interest when registration opens, and keep appropriate business records.
Where we process personal data to comply with a legal obligation, including handling data protection rights requests, we rely on Article 6(1)(c) UK GDPR. We retain the limited request records described in section 9 to demonstrate how requests were handled and respond to related complaints.
Technical data from website visits is processed on the basis of our legitimate interest in running a website that works and is secure.
You can object to processing based on our legitimate interests at any time by contacting privacy@consultantpatient.com.
We do not currently seek to collect special category data, such as health information, through the website or by general email enquiry. If this changes in future, we will provide separate privacy information before collecting or using that data.
We use Microsoft 365 for business email and document storage. Our Exchange Online email data is stored at rest in the United Kingdom. Microsoft processes data under its data protection terms. UK storage at rest does not mean that every aspect of processing takes place in the UK; see section 12.
Access within the Company is restricted to authorised people who need it for the purposes described in this policy.
We share personal data only where necessary for the purposes described in this policy, including:
Where service providers process personal data on our behalf, we use providers that offer appropriate data protection terms and safeguards.
We keep correspondence only for as long as needed to respond to you, manage any follow-up, and maintain a reasonable record of our communication.
General enquiries will normally be retained for up to 12 months after our last correspondence with you, unless:
We keep registration-interest records for up to 12 months after our last contact with you, unless you ask us to delete the records sooner. If registration opens during that time, we may invite you to register. Registering your interest does not itself register you as a Consultant Patient.
You can ask us to delete your correspondence by emailing privacy@consultantpatient.com. When we delete an email, our email provider keeps it in recovery storage for up to 14 days before it is permanently removed. We keep a minimal record of a deletion request and our response for two years after the request is closed, to demonstrate how we handled it and respond to any related complaint. This record contains only the information needed to identify the request, the relevant dates and the action taken. It does not retain the information you asked us to delete.
We keep the request record for longer only where necessary for an unresolved complaint, a legal claim or a legal requirement. We review and document any extension and delete the record when it is no longer needed.
Webflow retains website technical data in connection with providing its hosting service and meeting applicable legal requirements. Its data processing agreement provides for deletion of personal data processed on our behalf after the agreement ends, unless retention is legally required. Webflow’s published documents do not specify a separate visitor-log retention period.
We apply appropriate technical and organisational measures to protect personal data, including secure business email and storage, restricted access, appropriate authentication, and encryption in transit where supported.
Depending on the circumstances and the legal basis for processing, your rights under UK GDPR include the right to:
To exercise your rights, email privacy@consultantpatient.com. We normally respond within one calendar month. If the law permits more time, we will explain why and when you can expect a response.
Our Exchange Online email data is stored at rest in the United Kingdom. Our website provider, Webflow, is based in the United States and stores website-visitor data there.
Webflow acts as our processor under its Data Processing Addendum. It also uses some technical log data for its own security and service purposes, as described in Webflow’s privacy policy. Transfers to Webflow in the United States are covered by the UK Extension to the EU–US Data Privacy Framework. Webflow’s data processing terms also provide contractual transfer safeguards where applicable.
Microsoft’s processing may involve transfers outside the United Kingdom, including to the United States and other countries where Microsoft or its subprocessors operate, subject to its contractual commitments. Microsoft’s Products and Services Data Protection Addendum applies the European Commission’s standard contractual clauses and the UK International Data Transfer Addendum to relevant transfers from the United Kingdom.
You can contact privacy@consultantpatient.com for information about the transfer arrangements and how to obtain a copy of any relevant safeguards.
Registration as a Consultant Patient is not open yet. Before opening registration or asking you to provide health information, we will provide a privacy notice covering those activities. It will explain what we collect, why, the legal basis, who we share it with, and how long we keep it.
The principles stated across this website will apply:
Our website uses Cloudflare’s _cfuvid session cookie through our website hosting service. It helps protect the website against abusive traffic by distinguishing visitors who share the same IP address when applying limits to incoming requests.
This cookie is used for necessary website security, rather than advertising or analytics. We rely on the strictly necessary exception under UK cookie rules and do not request consent for it.
If we introduce additional cookies or similar technologies, we will update this policy and obtain consent where required.
We may update this policy to reflect changes in our activities or legal requirements. We will publish the updated version and effective date on this page and make material changes clear. Where required, we will provide further information or obtain consent before using personal data for a new purpose.
If you have a concern about how we handle your personal data, you can raise a data protection complaint with us by contacting privacy@consultantpatient.com.
We will acknowledge your complaint within 30 days, investigate it and inform you of the outcome without undue delay.
You also have the right to raise a concern with the Information Commissioner’s Office, the UK data protection regulator.
You can contact the ICO or find further information at: ico.org.uk
Consultant Patient Ltd
For data protection queries or to exercise your rights: privacy@consultantpatient.com
For organisations and general enquiries: contact@consultantpatient.com
To register your interest in becoming a Consultant Patient: participant@consultantpatient.com (please don’t include any health details in your first email)