Privacy Policy

Please read this page carefully. It explains how Northwaite offers this website and how we handle the information you choose to share. It is written for patients, families, and other visitors. It is not an emergency notice and it is not a personal care plan.

1. Introduction

This Privacy Policy explains how Northwaite collects, uses, stores, and shares personal information when you use northwaite.com and when you communicate with us about care. It is written in plain language because health information deserves more than a slogan. Please read it before you send a form.

Personal information means information that identifies you or could reasonably be linked to you, such as your name and email address. Health information means information about a symptom, a visit, a medicine, a measurement, a report, or any other detail about health that you or someone else gives us in connection with you.

We collect less when you only read, and more when you ask us to do something: arrange a visit, explain a service, send Care Notes, or answer a message. You can use most of the public pages without telling us who you are.

This policy applies to the website and to the messages that start here. If a care relationship begins, additional clinical record-keeping may apply to the visit itself. We will not surprise you with a new purpose that is unrelated to care, administration, or the letters you asked for.

2. Who is responsible

Northwaite is responsible for the personal information described in this policy. When this policy says “we”, it means Northwaite. Questions about privacy can be sent through the contact form with the subject “Privacy”, or by email to hello@northwaite.com.

We do not ask you to deal with an unnamed advertising network in order to read the journal. If we ever use a helper to host email or store records, we remain responsible for the instructions we give that helper and for choosing helpers who are capable of looking after health-related information with care.

3. Information we collect

Information you type into a form is the main source. The appointment form collects your name, email address, chosen department, preferred clinician, preferred date and time of day, visit type, and the note you write about the concern. The contact form collects your name, email, subject, and message. The subscribe form collects your name, email, chosen topic, and your confirmation that you want Care Notes. The unsubscribe form collects the email to be removed and any reason you choose to give.

If you email hello@northwaite.com, we receive whatever you include: the address you wrote from, the subject, the body, and any attachment. Attachments can contain more sensitive detail than a person meant to send. Please send only what the question needs.

If you write about another person — a child, a partner, a parent — we receive that person’s information as well. Please share it only if you are permitted to, and tell them when it is appropriate.

We also receive technical basics that most websites see, such as the browser type and the pages requested, so the site can be delivered and so we can notice a fault. We do not use that technical stream to build a marketing portrait of your health.

We do not ask for a telephone number or a street location through these pages, and we do not want payment card numbers in a form. If a message includes them by accident, we will avoid using them and we will delete them from the message thread when we can do so without losing the care request itself.

4. Health information in particular

Health information is sensitive even when it feels ordinary to the person writing it. A sentence about sleep, a blood pressure log, a child’s fever, a medicine name, or a worry about a report can all be health information. We treat the notes on the appointment and contact forms as potentially sensitive for that reason, even if the box looks like an ordinary message field.

Please do not send photographs of injuries, full copies of identity documents, or an entire historical record unless we have asked for a specific item and you are comfortable sending it. A short description is usually enough to arrange a conversation. The detailed review belongs in the visit.

We use health information to decide whether we can offer an appointment, which clinician to suggest, how much time to reserve, what to ask you to bring, and how to reply safely. We do not use it to sell products, to build advertising audiences, or to fill a journal article with your story.

Quotes on the public website are not presented with full names and clinical detail that would identify a person. We will not publish your story on the website without a separate, clear agreement.

5. How we use information

We use personal information to answer the message you sent, to propose or manage an appointment, to confirm a fee, to send the written materials a visit requires, to send Care Notes if you subscribed, to stop Care Notes if you unsubscribed, to keep a record of what was agreed, to improve the clarity of our pages, and to protect the website and our patients from misuse.

A specific example helps. If you request a cardiology visit and mention home readings, we use that note to offer an appropriate length of time and to remind you to bring the log. We do not add you to a commercial heart-product list. If you subscribe and choose “family care”, we use the topic to keep the letter relevant. We do not swap that choice with a data broker.

We may use de-identified or aggregated observations — for example, that many people ask how to prepare for a preventive visit — to decide what the journal should explain next. Those observations are not a substitute for your record and are not sold.

If the law that applies to us requires a particular use or disclosure, we will comply. If the law gives us a choice, we prefer the narrower use.

6. Why we are allowed to do this

Different places describe the legal basis for handling information in different words. In substance, we rely on the following reasons, using whichever formulation applies where the handling takes place.

We handle information because you asked us to take a step before or during a care arrangement: you requested a visit, you asked a question, you subscribed, or you told us to unsubscribe. That request would be impossible to honour without the details you provided.

We handle information because it is necessary to provide and administer care, to keep accurate records of what was said, and to follow up safely. Health information, where the law treats it as a special category, is handled for health-care purposes under the responsibility of our clinicians and the confidentiality that belongs to that work.

We handle a smaller amount of information because we have a legitimate interest in running a readable, secure website, understanding which explanations are failing people, and protecting staff and patients from abuse. We balance that interest against your privacy. You can object to a non-essential use, such as an optional letter, and we will stop it.

Where a rule requires consent, we ask for it in the form itself — for example, the box that confirms you want Care Notes. You may withdraw that consent through the unsubscribe page. Withdrawal does not undo handling that was already lawful.

7. Subscribe and unsubscribe

Care Notes are optional. The subscribe form records your name, email, topic preference, and the fact that you ticked the confirmation box. We use that record to send the letters and to prove, if needed, that the list was opt-in.

Every letter is accompanied in spirit by the unsubscribe page, which is linked from the footer of this website. You may also use the contact form to say “please unsubscribe” and include the email address. We will treat a clear request as sufficient even if you do not give a reason.

Unsubscribing stops Care Notes. It does not automatically delete an appointment thread, a clinical summary, or a question you asked the care desk. Those may still need to be kept for the reasons in the retention section. If you want a broader deletion request, say so plainly and we will explain what we can remove and what we must keep.

Please do not subscribe someone else unless they asked you to and you have told them. If we learn that an address was added without a genuine request, we will remove it.

8. Cookies and local storage

This website is a static collection of pages with scripts that run in your browser. The appointment, contact, subscribe, and unsubscribe forms check that required fields are complete on your device. They are not built to send those fields to a server as part of this published site. A confirmation message appears in the page after the check succeeds.

Because of that design, the forms do not set an account cookie in order to log you in. We do not run a third-party advertising cookie. If a future version of the site needs a strictly necessary cookie to remember a choice you made, we will describe it here before relying on it for anything beyond the operation of the page.

Your browser may keep its own history of pages you opened. That history is controlled by your browser, not by a Northwaite profile. You can clear it in your browser settings.

Font files may be requested from a font host so the pages match the intended design. That request reveals to the font host that your browser asked for the font, which is a normal part of loading a web page. If you prefer not to make that request, your browser will show a fallback typeface and the content will still be readable.

9. When we share information

We do not sell personal information. We do not trade email lists. We do not give health notes to advertisers.

We share information inside Northwaite with the coordinator and the clinician who need it for your request. A cardiology note is not circulated to the whole organisation for curiosity.

We share information with helpers who process it only on our instructions — for example, an email provider that carries a reply, or a secure store for clinical records if a visit goes ahead. Helpers are not allowed to use the information for their own marketing. We ask them to protect it and to tell us if something goes wrong.

We may share information if we are legally required to, if it is necessary to prevent serious harm, or if a regulator or court with proper authority asks in a way we are obliged to answer. Where the law lets us tell you, we will. Where a disclosure is made to protect someone from serious harm, we will record why it was made.

If Northwaite were ever reorganised so that another care organisation took responsibility for existing requests, we would tell affected people and ensure the successor honoured this policy or an equivalent protection.

Sharing buttons in the header and footer open a share page on another service and pass the public address of our website. They do not pass your form contents. Do not use those buttons to transmit a private health story.

10. How long we keep information

We keep information only for as long as the purpose requires, plus any period we must keep for legal, insurance, or clinical-record duties. Those periods are not identical for every item.

A subscribe record is kept while you remain on the list and for a short period afterwards so we can show that an unsubscribe was honoured and so a mistaken resubscribe can be spotted. An unsubscribe request is kept long enough to suppress the address.

A casual question that never becomes a visit is kept only as long as needed to answer it and to handle any follow-up you reasonably expect, unless a safety concern means a longer note is justified.

Once a clinical relationship exists, the record of the visit is kept for the period required of health records in the place the care is provided. That period is often longer than a marketing list, because you, or a clinician who sees you later, may need to know what was decided. We will not keep a clinical record “forever just in case” beyond those duties.

When a retention period ends, we delete or irreversibly de-identify the information. Backups may linger for a limited technical cycle and are then overwritten. We do not mine expired backups for new uses.

11. Security

We use practical safeguards matched to the sensitivity of the information: access limited to people who need it, care in how email threads are handled, and a preference for collecting the minimum in the first message. No method of sending information across the internet is perfectly secure. Email in particular can be intercepted or misaddressed. Do not use email for a crisis, and think carefully before attaching a full record.

You play a part in security. Use an email account only you can open. Do not forward a clinical summary into a crowded thread. Be wary of any message that pretends to be Northwaite and asks for a password or a payment card. We will not ask for your password. If a message feels wrong, contact us through this website rather than through any link in the suspicious message.

If we learn of a breach that creates a real risk for you, we will tell you and, where required, tell the relevant authority, as the applicable rules instruct. We will describe what happened, what we are doing, and what you can do.

12. Your choices and requests

You may ask us what personal information we hold about you, ask for a copy, ask us to correct something that is wrong, ask us to delete something we do not need to keep, ask us to limit a particular use, or object to a use that is based on our legitimate interests rather than on a care duty. You may also unsubscribe at any time.

To make a request, use the contact form or email hello@northwaite.com with the subject “Privacy request”. Tell us the email address you used and what you want. We may need to confirm that you are the person the information is about, or that you are entitled to act for them, before we release anything. We will not send a clinical summary to an unverified stranger.

Some requests cannot be completed in full. We may refuse deletion of a health record we are required to keep, or refuse a copy if releasing it would seriously harm someone. If we refuse, we will explain the reason unless explaining would itself cause the harm, and we will tell you how to complain.

There is no charge for a reasonable request. If a request is repetitive or unfounded we will say so before doing a large amount of work.

You may also complain to the data-protection or health-privacy authority that applies where you live. We would like the chance to put things right first, and we ask that you write to us as well so we can try.

13. Children and young people

The public journal is written for adult readers. It is not a children’s service and it does not invite children to create profiles. A parent or guardian may request paediatric care and, in doing so, provide information about a child. That information is used for the care request and is handled with the same confidentiality as other health information, with the added care that belongs to a child’s record.

We do not knowingly collect personal information directly from a child through a subscribe form. If you believe a child subscribed without a guardian’s knowledge, tell us and we will remove the address.

Older young people sometimes need part of a conversation to be private from the adult who brought them. Clinical confidentiality in that situation follows the rules that apply to the young person’s capacity and best interests. This policy does not reduce those protections.

14. Different places

People read this website from many places, and the rules that protect personal information are not identical everywhere. We apply this policy as a baseline. Where a stricter rule applies to a particular person or to a particular act of handling, we follow the stricter rule.

If information is looked after from more than one place — for example, because an email provider stores a mailbox away from where you sat when you typed — we take that into account when we choose helpers and when we assess risk. We do not move health information to a new helper casually.

This policy does not name a single country as your location, and it does not ask you to pretend you live somewhere you do not. If a right in this policy is described in general words, use it. If you need the formal name of a local right, tell us where the issue arose and we will respond with the specific route that applies.

15. Changes to this policy

We will update this policy when our practices change or when we can explain them more clearly. The date at the foot of the page will change with the text. If a change would affect Care Notes or a way we use health information for a new purpose, we will not hide the change in a sentence halfway down. We will describe it where subscribers and patients can see it, and we will seek consent again if the law requires that.

Previous versions can be requested through the contact form if you need to know what the policy said when you sent a particular message.

16. How to contact us about privacy

Write through the contact form with the subject “Privacy”, or email hello@northwaite.com. Describe what happened or what you want done. Include the email address connected with the information. We will reply by email.

Please do not include more health detail than the privacy question needs. A request for a copy of a record can name the visit date and the clinician. It does not need a fresh description of every symptom.

This contact path is for privacy and for ordinary questions. It is not monitored as an emergency service. If you are in danger, contact your local emergency service rather than waiting for a privacy reply.

Last updated 12 October 2026.