How personal information is used

Dr Ehsan Goli is the data controller for information submitted through this website and for records created in private professional work. The practice is registered with the Information Commissioner’s Office under reference ZB935576. Please use the contact form for privacy questions or requests.

The enquiry form asks for your name, email address, preferred language, the general nature of your enquiry and a brief message. Please leave out detailed clinical, medical or other sensitive information at this stage.

The hosting and security infrastructure may process technical information such as an IP address, browser and device details, request time and security logs. If professional work begins, further contact details, correspondence, agreements, invoices and clinical or supervisory records may be created. The information required for those records is explained before ongoing work begins.

Making an enquiry is voluntary. The fields marked as required allow me to receive, understand and reply to your request. You can ask for an initial consultation without providing a clinical history.

• Responding to a request from you for a professional service, where necessary to take steps towards an agreement, and providing an agreed service: UK GDPR Article 6(1)(b). This includes necessary appointment, fee and correspondence administration.
• General professional enquiries, contact with people acting for an organisation, website security and proportionate administration: legitimate interests under Article 6(1)(f). The interests are responding to requests, operating the practice and protecting information.
• Complying with an applicable legal obligation, including relevant tax or disclosure requirements: Article 6(1)(c). Article 6(1)(d) applies only where processing is necessary to protect vital interests.
• Health information necessary to consider or provide health care is processed under Article 9(2)(h), together with the Data Protection Act 2018 Schedule 1 condition 2 and the professional duty of confidentiality. Information is limited to what is necessary for that purpose. Article 9(2)(f) may apply where special-category information is necessary for legal claims.

Access is limited to Dr Goli and service providers needed to operate the practice, such as website hosting and security, email transmission and mailbox services, secure record storage, invoicing or professional advisers. Providers receive only the information needed for their role and are expected to handle it under appropriate contractual and security terms.

The website is hosted through OpenAI Sites with Cloudflare infrastructure. Resend transmits the enquiry to my private Gmail inbox, provided by Google. The website does not store the message in its content database. Information is not sold or used for advertising or behavioural profiling.

Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, the transfer is covered by an applicable adequacy regulation or approved contractual safeguards. Further information about a relevant provider or safeguard can be requested using the contact form.

An enquiry that does not lead to professional work is normally deleted within 12 months of the last contact, unless it must be kept longer for a complaint, safeguarding matter or legal claim. If work begins, relevant correspondence may become part of the professional record.

Professional, financial and clinical records are kept only for the period needed to provide the service and meet legal, tax, regulatory, insurance, complaints and claims requirements. The applicable retention period is confirmed in the privacy information supplied before ongoing work begins, and records are reviewed for secure deletion when that period ends.

The site uses HTTPS, access controls, spam checks and limited technical logging. Clinical records are not stored in the website content-management system. Ordinary email and web forms still have practical security limits, which is why the form asks for only a brief message.

No advertising pixels, behavioural analytics or non-essential tracking cookies are used. Essential security and session technologies may operate when needed to deliver the site. No decision about clinical suitability is made solely by automated processing, and the site does not profile visitors.

Depending on the circumstances, you may have rights to be informed, obtain a copy of your information, correct inaccurate information, restrict processing, object, request erasure, or receive portable data. Some rights are limited where information must be kept for health care, professional obligations or legal claims.

Where processing relies on legitimate interests, you have a right to object. A request can be made using the contact form and identity may need to be verified before information is released.

You can raise a question or concern with me through the contact form. You also have the right to complain to the Information Commissioner’s Office; its website explains how to make a complaint.