Privacy Policy
Last updated: June 2026
1. Who we are
This website is operated by Medora Specialist Services Ltd, a private endocrinology practice based in the United Kingdom.
Company No. 16886886. Medora Specialist Services Ltd is the data controller responsible for your personal data.
ICO Registration Number: ZC072043
2. Contact us about your data
For any questions about this policy, to exercise your rights, or to make a Subject Access Request, please contact:
3. What personal data we collect and why
3a. Patient reviews
If you submit a review, we collect your name (or chosen display name), town or area (optional), star rating, comment, and service type.
Lawful basis: Consent — you explicitly agree to your review being published before submitting.
Purpose: To display approved reviews on our website to help prospective patients make informed decisions.
3b. Blog comments
If you comment on a blog post, we collect your name and optionally your email address, along with your comment text.
Lawful basis: Legitimate interests — we have a legitimate interest in enabling discussion of health topics on our educational blog, balanced against your privacy interests.
Purpose: To moderate and publish reader comments on our Health Blog.
3c. Website analytics (blog views)
When you read a blog post, we record that the post was viewed. We do notstore your IP address. Instead, we create a one-way cryptographic hash of your IP address combined with a random daily salt. This hash cannot be reversed to identify you and changes every 24 hours. We also store a partial browser type string (e.g. "Chrome/125") and the date of the visit.
Lawful basis: Legitimate interests — to understand which health topics are most useful to our patients.
3d. Security (bot protection)
All public forms on this website use Cloudflare Turnstile, a CAPTCHA-like service, to detect and block automated abuse. A token is generated by your browser and verified server-side. We do not receive any personal information from this process.
Lawful basis: Legitimate interests — to protect our website and users from spam and malicious submissions.
4. How long we keep your data
| Data | Retention period |
|---|---|
| Pending or rejected reviews | 30 days |
| Approved published reviews | Until you request removal |
| Pending or rejected blog comments | 30 days |
| Approved published blog comments | Until you request removal |
| Website analytics (view data) | 90 days |
| Review request links | 30 days from creation |
5. Who we share your data with
We use the following third-party service providers (data processors) to operate this website. Each is bound by a Data Processing Agreement and appropriate safeguards for international data transfers:
| Provider | Purpose | Location / Safeguard |
|---|---|---|
| Supabase Inc | Database and file storage | US — Standard Contractual Clauses |
| Resend Inc | Transactional email delivery | US — Standard Contractual Clauses |
| Cloudflare Inc | Bot protection (Turnstile), CDN | US — Standard Contractual Clauses |
| Google (Fonts) | Web font delivery (Poppins typeface) | US — Standard Contractual Clauses |
| Web hosting provider | Website hosting | [To be confirmed before go-live] |
We do not sell your personal data to third parties or use it for marketing purposes.
6. Your rights under UK GDPR
You have the following rights in relation to your personal data. To exercise any of these, please contact Tracey Fillingham (details in section 2).
- Right of access — to request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification — to ask us to correct inaccurate or incomplete data.
- Right to erasure — to ask us to delete your data (the "right to be forgotten"), where it is no longer necessary for the purpose it was collected.
- Right to restriction — to ask us to pause processing your data while a dispute is resolved.
- Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
- Right to object — to object to processing based on legitimate interests.
- Right to withdraw consent — where we rely on consent, you may withdraw it at any time. This will not affect the lawfulness of processing before withdrawal.
We will respond to all requests within one calendar month.
7. Right to complain
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
We would appreciate the opportunity to address your concerns directly before you contact the ICO — please reach out to Tracey Fillingham in the first instance (section 2).
8. Children
Our services are intended for adults aged 18 and over. If you are under 18, a parent or guardian should complete any forms on your behalf. We do not knowingly collect personal data from children under 13 without verifiable parental consent.
9. Data breaches
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
10. Cookies
For information about the cookies this website uses, please see our Cookie Policy.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page indicates when it was last revised. We recommend checking this page periodically.