Privacy Policy

• We store personal data only if you give it to us: your email address (with the hospital and specialty you asked us to watch, if the page named them) when you sign up for an email update, or your message, the page you came from and, if you add it, your email address when you send us feedback. You can browse the whole site without giving us anything.
• We never store your full postcode in our database. It is sent to postcodes.io to compute distance. To make repeat searches quick, our hosting provider keeps a copy of postcodes.io's answer, which includes the postcode; it refreshes the copy when that postcode is searched again more than a day later, and we do not control when the copy is deleted. We keep only the postcode district (e.g. SW1A) in an anonymous record of where searches come from — details below.
• We use Vercel Web Analytics for cookieless, anonymised analytics. Vercel Analytics is disabled on /gp-letter so the contents of any Right-to-Choose letter you generate are never sent to our analytics provider.
• The site shows no adverts. Since 16 October 2026 it loads no advertising, consent or Grow by Mediavine scripts on any page. Our funding model is published at /sponsorship-policy.
• Our analytics set no cookies and track you on no other sites, and our own code sets no cookies at all. If you visited before 16 October 2026, the Cookies section says what Google's or Grow's scripts may have left in your browser and how to delete it.
• If you use the GP-letter generator, the details you type are saved to your browser only (localStorage) and never reach our servers. They are deleted the next time you open the page more than 7 days after your last change, or straight away with “Clear saved details”. When you print, we count the print and which of the two letters it was, as described below.

When you search

• Postcode: sent to postcodes.io to look up latitude/longitude. Your full postcode is never stored in our database. To make repeat searches quick, our hosting provider keeps a copy of postcodes.io's answer, which includes the postcode; it refreshes the copy when that postcode is searched again more than a day later, and we do not control when the copy is deleted. We keep only the postcode district — the outward part, e.g. SW1A — in the anonymous search records described below.
• Search queries: the sort + distance params travel through the URL only and are not stored in our database. For each successful search we record one anonymous event: the specialty (and condition, if you picked one) plus the postcode district above. No IP address, no browser details, no session or user identifier is stored with it, only a yes/no mark if the request looks automated.

If you sign up for an email update

We store your email address, the kind of page you signed up on (for example a results page or a hospital's page), the hospital and specialty you asked us to watch if that page named them, the date and time, and random codes that identify your sign-up. We use them only to send you the waiting-time update you asked for. To stop it, email mustafa@doctor-data.co.uk and we will delete your address. A backup copy of the sign-up list is made each week and each copy is deleted after 90 days, so a deleted address is gone from those copies within 90 days.

If you send us feedback

We store your message, the date and time, the address of the page you were on if you clicked “Tell us” at the bottom of one of our pages (never anything after a “?” in it), whether our automated-traffic filter flagged the message, and your email address if you chose to give one. Unless the filter flagged it, a copy is emailed to us through Resend, an email delivery service, and arrives in our Microsoft 365 inbox. We use it to read your suggestion, to improve the site and, if you gave an address, to reply. Please do not include medical details.

Analytics

We use Vercel Web Analytics to understand which pages get visited and which referrers send traffic. It collects only aggregate, anonymised data:

• Page URL, with everything after the “?” removed in your browser before it is sent (so never the postcode you searched with)
• Referrer (which site you came from)
• Browser + OS (anonymised)
• Country (derived from IP, IP itself not stored)

It does not capture form-field values, keystrokes, session replay, or any DOM contents. No cookies are set. No tracking across other sites.

/gp-letter exclusion. Vercel Web Analytics is disabled on /gp-letter. The Right-to-Choose letter page is where you fill in personal details (full name, address, NHS number, GP details) before printing. We filter out every analytics event with a URL under /gp-letter client-side via the Vercel beforeSend hook before it leaves your browser, so even the page URL with its ?trust=&specialty= query string is never transmitted.

First-party event counting

We count a small set of anonymous events ourselves, in our own database rather than through an analytics company, to understand whether the site actually helps people act: a search was made (specialty + postcode district, as above), a GP letter was printed, a “what this means for you” action was clicked, an outbound listing link was followed (with the kind of page it was on: a results, procedure or national page), a page was shared, an email sign-up form came into view or was submitted, or the “Private alternatives” box came into view. Each event records what happened and, for most, the kind of page it happened on; some also record the hospital or specialty that page is about, which action or listing was clicked, or how a page was shared. Each has a timestamp and a yes/no mark if it looks like automated traffic — never your IP address, browser fingerprint, cookies or session, and never anything you type into the GP letter.

Events sent from the page itself (all of the above except searches and outbound links) also carry a running number: 1 for the first event of that kind since our site was loaded in your browser tab, 2 for the second, and so on, so that an action repeated in the same tab can be counted once. The number is held only in that tab's memory: it is never saved on your device, and it starts again from 1 when you reload or close the tab.

On the GP-letter page specifically: when you print, we record that a letter was printed and which of the two letters it was (“New referral” or “I'm already on a waiting list (switching trust)”) — plus, only if you arrived via a “Generate GP letter” link that already named a hospital and specialty in the page address, which hospital/specialty that link was for. If you chose the hospital inside the form instead, that choice is part of your letter and is never sent to us. Printing the same letter again on the same visit to the page is not counted again (pressing “Clear saved details” starts a new letter). Nothing you type into the form is ever sent to us (the Vercel Analytics exclusion above covers third-party analytics; this paragraph covers our own counting).

The GP-letter generator lets you draft a Right-to-Choose letter for your GP. So you can come back and finish it later — or hand it to a family member to review — your form entries are saved to your browser's localStorage, under the key hospitalwaits.gp-letter.v1.

What we save: what you enter in the form — name, date of birth, NHS number (optional), home address and postcode, GP name, GP practice name, address and postcode, and for the waiting-list letter the hospital you are waiting at and how long you have waited and expect to wait — plus which letter you picked, the hospital and specialty you chose, and a timestamp of when the save happened.

Where it lives: in your browser only, on the device you used. None of it is sent to Doctor Data Ltd, Vercel, Supabase or anyone else, with two exceptions: when you print, the print count described above records which of the two letters you chose (and, if you came from a link that named them, that link's hospital and specialty); and each “Look up postcode” button sends the postcode you typed in that box, and none of your other details, to postcodes.io, which sends back the area name. Other websites cannot read it.

How long it stays: until it is deleted. The next time you open the GP-letter page more than 7 days after your last change, it is deleted instead of being restored. You can also delete it at any time with the “Clear saved details” button on the page, or by clearing site data for hospitalwaits.co.uk in your browser settings. If you never open the GP-letter page again, we have no way to delete it, so on a shared computer press “Clear saved details” when you have finished.

Why localStorage and not a cookie: localStorage is not sent to our servers with every request (cookies are), which keeps the data strictly client-side. It is not used for tracking, advertising, or analytics — only to remember the form for you.

From late 2026, HospitalWaits may carry sponsored placements from private hospital groups and affiliate links to private medical insurance comparison services. When this happens:

• Sponsored items will be clearly labelled with a "Sponsored" badge of at least equal visual weight to the listing.
• Outbound sponsored / affiliate links carry the rel="sponsored" attribute.
• If you click a sponsored or affiliate link and subsequently take an action with the partner, Doctor Data Ltd may receive a commission. We do not collect any personal data about you from these clicks; the partner's site has its own privacy policy.
• Sponsored placements do not influence our editorial analysis or methodology. See /sponsorship-policy for the full disclosure standard.

You have the right to:

• Access any data we hold about you (your email sign-up, any feedback you sent us, and anything you sent us by email)
• Delete your data — email us
• Correct your data — email us
• Withdraw your consent to the email update at any time — email us and we will delete your address
• Object to, or ask us to restrict, how we use your data, or ask for a copy of your sign-up details in a machine-readable form — email us
• Complain to us. If you are unhappy with how we have handled your data, please tell us first at mustafa@doctor-data.co.uk. We will acknowledge your complaint within 30 days, look into it and tell you the outcome.
• Complain to the regulator, the Information Commission, which still calls itself the ICO (until 30 September 2026 it was the Information Commissioner's Office), at ico.org.uk or on 0303 123 1113. In most cases the ICO recommends raising your concern with the organisation first.

Doctor Data Ltd, a company registered in England and Wales, company number 13168780.
Registered with the ICO as a data controller, registration ZB946370.
Data protection officer, and contact for anything about your data: Mustafa Ghafouri, mustafa@doctor-data.co.uk

Our own code sets no cookies. Vercel Web Analytics is cookieless by design. The GP-letter generator uses localStorage (not cookies) to remember your form entries on your own device — see the dedicated section above.

On 16 October 2026 we removed all advertising, and Grow by Mediavine, from the site. If you visited before then, your browser may still hold FCCDCF, a cookie that Google's consent banner set on this site, and any other data that Google's or Grow's scripts saved here. To delete them, clear the cookies and site data for hospitalwaits.co.uk in your browser settings; that also deletes any GP letter you saved.