Privacy notice
This notice explains how NHS Direct collects, uses and protects personal data. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
NHS Direct is the data controller for personal data collected through this website. To contact us about data protection, use the details on our contact page and mark your message for the attention of the data protection lead.
What we collect
- Contact form submissions — name, email address, and the content of your message, only when you send us one.
- Server logs — IP address, browser type, pages visited, and timestamps, held for a short retention period for security and troubleshooting.
- Analytics — anonymised usage data through our analytics provider, described in our cookies notice.
We do not ask for, and do not want to receive, information about your specific medical conditions. Do not send us confidential health information through this site.
Lawful basis
We rely on the following lawful bases under Article 6 of the UK GDPR:
- Legitimate interests for server logs and site security
- Consent for optional analytics cookies and marketing communications
- Legitimate interests for responding to enquiries you send us
Sharing
We use processors to operate the site — website hosting, email delivery for our contact form, and analytics. These processors act only on our instructions and are bound by data protection agreements. We do not sell or trade personal data. We do not transfer personal data outside the UK or EEA without appropriate safeguards.
Your rights
Under the UK GDPR you have the right to access, rectify, erase, restrict or object to our processing of your personal data, and to data portability where applicable. To exercise these rights, contact us using the details on our contact page.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
Changes
We may update this notice. The date at the top of the page shows when it was last changed.