This privacy policy explains how Waypoint Medical Ltd collects, uses and protects personal information through the Bladder Health Programme website at waypointbladderhealth.co.uk. It covers patients and members of the public who use the consultant finder and enquiry form, and clinicians and their secretaries who use the secure clinician area.
Who we are
The Bladder Health Programme is run by Waypoint Medical Ltd. It helps people with bladder conditions, such as recurrent urinary tract infections, painful bladder syndrome and interstitial cystitis, find and contact a specialist consultant.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Waypoint Medical Ltd is the data controller for the information collected through this website.
If you have any questions about this policy or how we handle your information, please contact us at enquiries@waypointmedical.co.uk.
Information we collect from patients
When you send an enquiry using the form on our website, we collect:
- Your first and last name
- Your email address
- Your phone number, if you choose to give it
- Your postcode
- The bladder concerns you select, and anything else you choose to tell us in your message
- The consultant or consultants you have chosen, and the location you picked for each
- Your confirmation that you give permission for your details to be shared with the consultants you have chosen
- The date and time of your enquiry, and a scrambled, one-way code made from your device's internet address, which we use only to help prevent misuse of the form
The concerns you select and anything you write about your health are health information. The law treats health information as special category data, and we take particular care with it.
Using the consultant finder does not require you to give us any personal information. When you search by postcode or town, your browser sends what you typed to a free location lookup service (postcodes.io for postcodes, or OpenStreetMap for town names) to find where it is, so that nearby consultants can be shown. We do not store your search.
How we use patient information
We use the information you give us only to:
- Pass your enquiry to the consultant or consultants you have chosen, so that they or their secretary can contact you
- Send you an email confirming that we have received your enquiry
- Help you if your enquiry cannot be matched to a consultant, or if you contact us about it
- Keep the website secure and prevent misuse of the enquiry form
We do not use your information for marketing, we do not sell it, and we do not use it for automated decision-making or profiling.
Who can see your enquiry
- The consultants you choose, and the secretaries or personal assistants who work with them, can see your enquiry in our secure clinician area. Other consultants cannot see it.
- A small number of Waypoint Medical administrators can see enquiries to manage the service, for example to make sure each enquiry reaches the right consultant.
Emails we send to consultants and administrators about a new enquiry contain no patient details, only a link to the secure clinician area, which requires a password and a code sent by text message.
Once a consultant contacts you and arranges your care, they become responsible for the information they hold about you as part of that care, under their own privacy policy and that of their hospital or clinic.
Legal basis for using patient information
We rely on your consent (UK GDPR Article 6(1)(a)) and, for health information, your explicit consent (UK GDPR Article 9(2)(a)). You give this when you complete the form, tick the box giving permission to share your details with the consultants you have chosen, and send your enquiry.
You can withdraw your consent at any time by contacting us. This does not affect anything done before you withdrew it, and it does not affect information a consultant already holds as part of your care.
We use the scrambled code made from your internet address, and the spam protection described below, on the basis of our legitimate interests (UK GDPR Article 6(1)(f)) in keeping the service secure.
Information we collect from clinicians and secretaries
If you use the secure clinician area, we hold your name, your login email address, your mobile number (to send you sign-in codes), the consultants you work with, your acceptance of our clinician terms of use, and records of sign-ins and actions taken in the clinician area. We use this to give you secure access, to make sure you see only the enquiries you are entitled to see, and to keep an audit trail. Our legal basis is our legitimate interests (UK GDPR Article 6(1)(f)) in running a secure service, and the arrangements under which you take part in the programme.
Services we use
We use a small number of trusted providers to run the website. They act on our instructions and may only use the information to provide their service to us:
- Our website hosting provider, which stores the website, the enquiries and the clinician accounts, and sends our emails.
- Twilio, which sends the sign-in codes by text message to clinicians and secretaries. It receives their mobile numbers only.
- Google reCAPTCHA, which protects the enquiry form against spam and abuse.
- Google Maps, which shows consultant locations on a map, only if you allow it (see Cookies below).
- postcodes.io and OpenStreetMap, which turn a postcode or town you search for into a location. They receive only what you type in the search box.
Twilio, Google and OpenStreetMap may process information outside the UK, including in the United States. Where this happens, the transfer is protected by safeguards recognised under UK data protection law.
We do not use advertising cookies, tracking cookies or analytics platforms. This website does not use Google Analytics or any similar third-party tracking tools.
Cookies
We keep cookies to a minimum. When you first visit, we ask whether you are happy for Google Maps to load. You can change your choice at any time using "Cookie settings" at the bottom of the main page.
- Your cookie choice: a small cookie (bhp_cookie_choice) remembers whether you chose "Accept" or "Essential only", for 12 months. This is essential.
- Google reCAPTCHA: protects the enquiry form from spam and abuse. It loads only when you start using the form, and is needed to send an enquiry, so we treat it as essential. Google may set cookies and receives information about your device and how you use the form. Google's Privacy Policy and Terms of Service apply.
- Google Maps: shows where our consultants are on a map. It loads only if you choose "Accept" (or press "Load map"), and Google may then set cookies. If you choose "Essential only" you can still search for consultants and contact them.
- Clinician sign-in: if you are a clinician or secretary using the secure clinician area, we use essential cookies to keep you signed in securely and, if you choose, to remember a trusted browser for up to 12 hours.
Our pages also use fonts from Google Fonts. These do not set cookies, but Google receives your device's internet address when the fonts load.
How we protect your information
- The website uses an encrypted connection (HTTPS).
- Enquiries are stored on our hosting provider's server, outside the public part of the website, and can only be seen through the secure clinician area.
- Everyone using the clinician area signs in with a password and a code sent to their mobile phone, and sees only the enquiries they are entitled to see.
- Passwords are stored in a scrambled form that cannot be reversed.
- Access and changes in the clinician area are recorded in an audit log.
How long we keep information
We keep enquiries for up to 24 months from the date you send them, after which they are securely deleted, unless you ask us to delete them sooner or we need to keep them longer to deal with a complaint or meet a legal obligation. Information a consultant holds as part of your care is kept by them under their own policies.
We keep clinician and secretary account details for as long as the account is active, and for up to 24 months afterwards for audit purposes.
Your rights
Under UK GDPR, you have the following rights regarding your personal information:
- Right of access: you can ask for a copy of the information we hold about you
- Right to rectification: you can ask us to correct inaccurate information
- Right to erasure: you can ask us to delete your information
- Right to restrict processing: you can ask us to limit how we use your information
- Right to object: you can object to us using your information on the basis of our legitimate interests
- Right to withdraw consent: you can withdraw your consent at any time
- Right to data portability: you can ask for your information in a structured, machine-readable format
To use any of these rights, please contact us at enquiries@waypointmedical.co.uk. We will respond within one month.
Children
The Bladder Health Programme is intended for adults. If you are under 18, please ask a parent, guardian or your GP for help before sending an enquiry.
Complaints
If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection.
- Website: ico.org.uk
- Helpline: 0303 123 1113
Changes to this policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated date.
Contact us
Waypoint Medical Ltd
Bladder Health Programme
enquiries@waypointmedical.co.uk
waypointbladderhealth.co.uk