Privacy Policy

• We do not collect personal data from visitors.
• We never store your full postcode — it is sent to postcodes.io to compute distance, then forgotten. We keep only the postcode district (e.g. SW1A, an area of ~20,000 residents) as an anonymous counter of where demand comes from — details below.
• We use Umami and Vercel Web Analytics for cookieless, anonymised analytics. Vercel Analytics is disabled on /gp-letter so the contents of any Right-to-Choose letter you generate are never sent to our analytics provider.
• We also load Grow by Mediavine, which supports the advertising that keeps this site free. It is likewise never loaded on /gp-letter. Any advertising cookies it may use are gated behind the same consent banner described in the Cookies section — nothing is set until you say yes.
• Our analytics set no cookies and track you on no other sites. The only cookies this site can ever set are advertising cookies, and only after you say yes to a consent banner — see the Cookies section for exactly how that works. Our funding model is published at /sponsorship-policy.
• If you use the GP-letter generator, the details you type are saved to your browser only (localStorage) and automatically cleared after 7 days — they never reach our servers.

When you search

• Postcode: sent to postcodes.io to look up latitude/longitude. Your full postcode is never stored on our servers. We keep only the postcode district — the outward part, e.g. SW1A — an area of roughly 20,000 residents, for the aggregate demand statistics described below.
• Search queries: the sort + distance params travel through the URL only and are not stored. For each successful search we record one anonymous event: the specialty (and condition, if you picked one) plus the postcode district above. No IP address, no browser details, no session or user identifier is stored with it.

Analytics

We use Umami and Vercel Web Analytics to understand which pages get visited and which referrers send traffic. Both providers collect only aggregate, anonymised data:

• Page URL (without your search params)
• Referrer (which site you came from)
• Browser + OS (anonymised)
• Country (derived from IP, IP itself not stored)

Neither provider captures form-field values, keystrokes, session replay, or any DOM contents. No cookies are set. No tracking across other sites.

/gp-letter exclusion. Vercel Web Analytics is disabled on /gp-letter. The Right-to-Choose letter page is where you fill in personal details (full name, address, NHS number, GP details) before printing. We filter out every analytics event with a URL under /gp-letter client-side via the Vercel beforeSend hook before it leaves your browser, so even the page URL with its ?trust=&specialty= query string is never transmitted.

First-party event counting

We count a small set of anonymous events on our own infrastructure (no third party involved) to understand whether the site actually helps people act: a search was made (specialty + postcode district, as above), a GP letter was printed, a “what this means for you” action was clicked, an outbound listing link was followed, or a page was shared. Each event is a counter with a timestamp — never your IP address, browser fingerprint, cookies, session, or any letter contents.

On the GP-letter page specifically: when you print, we record thata letter was printed — plus, only if you arrived via a “Generate GP letter” link that already named a hospital and specialty in the page address, which hospital/specialty that link was for. If you chose the hospital inside the form instead, that choice is part of your letter and is never sent to us. Nothing you type into the form ever leaves your browser (the Vercel Analytics exclusion above covers third-party analytics; this paragraph covers our own counting).

The GP-letter generator lets you draft a Right-to-Choose letter for your GP. So you can come back and finish it later — or hand it to a family member to review — your form entries are saved to your browser's localStorage, under the key hospitalwaits.gp-letter.v1.

What we save: the values you type into the form — name, date of birth, NHS number (optional), home address, postcode, GP name, GP practice name and postcode — plus a timestamp of when the save happened.

Where it lives: in your browser only, on the device you used. Nothing is sent to Doctor Data Ltd, Vercel, Supabase, or any third party. Other websites cannot read it.

How long we keep it: a maximum of 7 days from the most recent save. The next time you open the GP-letter page, anything older than 7 days is automatically deleted before the form is restored. You can also delete it instantly at any time with the “Clear saved details” button on the page, or by clearing site data for hospitalwaits.co.uk in your browser settings.

Why localStorage and not a cookie: localStorage is not sent to our servers with every request (cookies are), which keeps the data strictly client-side. It is not used for tracking, advertising, or analytics — only to remember the form for you.

From late 2026, HospitalWaits may carry sponsored placements from private hospital groups and affiliate links to private medical insurance comparison services. When this happens:

• Sponsored items will be clearly labelled with a "Sponsored" badge of at least equal visual weight to the listing.
• Outbound sponsored / affiliate links carry the rel="sponsored" attribute.
• If you click a sponsored or affiliate link and subsequently take an action with the partner, Doctor Data Ltd may receive a commission. We do not collect any personal data about you from these clicks; the partner's site has its own privacy policy.
• Sponsored placements do not influence our editorial analysis or methodology. See /sponsorship-policy for the full disclosure standard.

You have the right to:

• Access any data we hold about you (we hold none unless you've actively contacted us by email)
• Delete your data — email us
• Correct your data — email us
• Complain to the ICO if you're unhappy with how we handle your data

Doctor Data Ltd
Contact: mustafa@doctor-data.co.uk

The only cookies this site can set are advertising cookies, and only with your consent. Umami analytics is cookieless by design. The GP-letter generator uses localStorage (not cookies) to remember your form entries on your own device — see the dedicated section above.

How advertising cookies work here: no advertising cookie is ever set before you answer a consent banner. While our Google AdSense application is in review, no ads serve at all. Once ads serve: if you consent, Google (acting as an independent controller for ad serving) may set cookies to measure and, with your consent, personalise ads; if you refuse, ads are non-personalised and no advertising cookies are set. You can change your choice at any time via the banner. The legal basis for personalised advertising is consent; our funding model is published at /sponsorship-policy. Advertising never appears inside hospital rankings, search results, or the GP-letter tool.