What a finished privacy policy needs to cover
1. Data collected via the contact form
Full name, email address, phone number (optional), enquiry type, and free-text message submitted through the enquiry form on contact-us.html. This should state clearly what is collected, why, and the legal basis for processing it (for example, consent or legitimate interest in responding to an enquiry).
2. How enquiry data will be handled once the form is live
Once the contact form is connected to a live email or form-handling service (see the TODO note in contact-us.html and in the project README), this policy needs to name that service, describe how submissions are transmitted and stored, and confirm whether any third-party processor is involved.
3. Retention
How long enquiry and patient contact data is kept, and the criteria used to decide when it is deleted. Any clinical record-keeping obligations that apply on top of standard marketing/enquiry data retention should be addressed separately by the practice's data protection adviser.
4. UK GDPR rights
A clear explanation of the rights available to site visitors and patients under the UK GDPR — including the right to access, correct, erase, or restrict processing of their personal data, the right to data portability, and the right to withdraw consent — along with how to exercise them.
5. Data protection contact
A named contact point (or Data Protection Officer, if applicable) for privacy questions or complaints, plus a note on the right to complain to the Information Commissioner's Office (ICO) if a concern isn't resolved satisfactorily.
6. Cookies and site analytics
If any cookies, analytics, or third-party embeds are added to the live site, this policy will need a cookie section describing what is used and how visitors can control it.