Data & cookies
What gets recorded when you read these notes, why, for how long, and what you can require us to do about it.
Medical notice. Please do not send health information to the mailbox described on this page. Email is insecure, and we cannot act on clinical detail. Read the notice in full.
Nothing to register for, nothing to pay for, and no health information gathered about you. Every page can be read without supplying one personal detail. What is actually processed amounts to the technical data your browser sends unprompted, an anonymous visit count if you agree to one, and whatever you choose to put in an email. There is no advertising on this site, so there is no ad network here waiting to be handed anything.
Who is responsible
This site is operated by Alderbury Health Notes (“we”, “us”), which is the data controller for everything described below.
The project runs online and nowhere else. There is no office to visit and no telephone line to call, and a single mailbox handles every matter covered by this notice: [email protected]. Putting the word “data” in your subject line gets the message to the right place faster.
What is recorded when you visit
Whatever your browser sends by itself
Like every web server in existence, ours writes a log line each time a page is requested. That line holds your IP address, the date and time, which page you asked for, the status the server returned, the page you arrived from if any, and identifiers for your browser and operating system. It is used to deliver the site, keep it standing, diagnose faults and spot abuse. None of it is assembled into a profile of you.
An anonymous count of visits, with your agreement
We may run a web analytics service to see which notes are actually read and where people give up part-way, which is how we decide what to fix and what to write next. Those figures are looked at in aggregate. We do not use them to identify individuals and make no attempt to work out who you are.
Anything you put in an email
Write to us and we necessarily receive your address, your message, and whatever else the message contains. We use it to reply and to keep a reasonable record of the exchange. Please keep symptoms, diagnoses, test results and medical records out of it: we cannot give medical advice, and email is not a secure channel. If clinical detail arrives anyway, we will not act on it and will delete it once the exchange is closed.
What is never collected at all
- Health data, diagnoses, symptoms or medical records concerning you.
- Payment details, since nothing on this site is for sale.
- Login credentials, since there are no accounts to log in to.
- Anything knowingly gathered from a child under sixteen.
Cookies, and the category that does not exist here
Cookies are small files your browser keeps on your device. On this site they come in two kinds, and two is the complete list.
| Kind | What it does | Needs consent? |
|---|---|---|
| Necessary | Serves the pages, keeps the site secure, and remembers the choice you made in the cookie panel | No — the site cannot function without them |
| Statistics | Counts visits in aggregate so we can see which notes are read | Yes, wherever local law requires it |
There is deliberately no third row. No advertising appears on these pages, so no advertising cookie, tracking pixel, device identifier or similar marker is set by us or by anybody acting for us, and nothing recorded here is used to follow you around other websites or to target you with anything.
Where the law of your location requires consent — which includes the EU and the UK — statistics cookies are set only once you have given it. You can change or withdraw that decision whenever you like through the “Cookie choice” control at the foot of every page, or by clearing cookies in your browser. Most browsers will also let you block them outright, though blocking the necessary ones will affect how the site behaves.
The legal bases we rely on
Where the EU General Data Protection Regulation, the UK GDPR or a comparable regime applies to the processing described here, these are the grounds:
- Legitimate interests — running and securing the site, answering your correspondence, and keeping ordinary server logs.
- Consent — statistics cookies and anything similar, withdrawable at any moment.
- Legal obligation — where law requires us to retain or disclose something.
Where more than one of those regimes reaches the same processing, we apply whichever gives you the greater protection.
Who else sees any of it
We do not sell personal data, and we do not share it for anybody's commercial benefit. Several US state laws define “sale” and “sharing” broadly enough to catch ordinary advertising activity; we fall outside those definitions for the simple reason that there is no advertising here to feed.
A small number of contractors handle data for us: the host and any content-delivery network, a statistics service if you have agreed to one, and the mail system. Each of them may use the data only to do that job. A contractor may sit outside your country, the United States included. When personal data leaves the EEA or the UK, we lean on an adequacy finding or on the standard contractual clauses plus the extra safeguards those clauses require. We will also hand data over if a court or a statute leaves us no choice, or if the safety of the site and the people who read it is at stake.
How long anything is kept
- Server logs — a short period, measured in weeks to months, for security and diagnostics, after which they are deleted or anonymised.
- Aggregate statistics — retained in aggregate form for trend analysis, with no route back to an individual.
- Email correspondence — kept only as long as the matter and a reasonable record require, then deleted.
- Cookies — until the expiry shown in the cookie panel, or until you clear them, whichever happens first.
What you can require of us
Which rights you hold depends on where you live. Where they apply, you may ask us to:
- confirm what personal data we hold about you, and supply a copy of it;
- correct anything inaccurate, or erase it entirely;
- stop or narrow a particular use of it;
- provide it in a portable form;
- treat a consent you gave earlier as withdrawn from this point on;
- note that your data is not to be sold or shared in whatever sense your local law gives those words — a request we can grant immediately, since we do neither.
A request is free and does not change what you can read here. Write to [email protected]. We answer inside the time the law allows, and we may ask for enough proof to be sure the request is really from you. If you dislike the answer, you can take the matter to a data-protection authority: in the EEA, the one for the country where you live or work; in the United Kingdom, the Information Commissioner's Office.
Security
The site is served over HTTPS, and the little data we hold is guarded by measures that match its size. That is a serious attempt, not a promise of perfect safety: nothing sent across a network and nothing kept on a disk is beyond reach. It is also why this notice keeps asking you not to put clinical detail in an email.
Children
The notes are written for an adult reader. They are not marketed to children, and we do not set out to gather personal data from anyone under sixteen. If you think a child has written to us, say so and the message will be removed.
Do Not Track and Global Privacy Control
Browser Do Not Track headers have no agreed meaning behind them and we do not act on them. Where the law requires it, we do honour recognised opt-out preference signals such as Global Privacy Control.
Changes to this notice
We may revise this notice to reflect a change in our practices or in the law. The “last updated” line at the top always identifies the version in force, and any material change will be flagged on this page rather than slipped in quietly.
Contact
Data requests, editorial corrections and everything else arrive at the same address: [email protected]. The contact page explains what to put in the subject line and what we cannot help with.