Privacy Policy

This Privacy Policy explains how information collected through samdawkins.com is used. It is written in plain English and intended to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Last updated: October 2026.

Who we are

The data controller for the information collected through this website is Dr Sam Dawkins (Consultant Cardiologist, GMC 6143008). Dr Dawkins is registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZA512700. For any data-protection enquiries please contact Dr Dawkins’s secretary at clinic@samdawkins.com or call 020 3423 7483.

This privacy policy covers the website only. Personal and clinical information you share during a consultation, by phone, or by email with the practice or hospital is governed by the relevant hospital’s privacy notice (Cleveland Clinic London, Nuffield Manor Hospital, or the John Radcliffe / Oxford University Hospitals NHS Foundation Trust), which you can request directly from the hospital.

What information the website collects

1. Information you give us voluntarily. If you contact Dr Dawkins or his secretary by email, phone, or the enquiry form on this site, we receive whatever information you choose to share, typically your name, contact details, and the reason for your enquiry. We use that information to respond to you and to follow up if necessary.

The enquiry form. When you submit the form, your message is delivered by email to Dr Dawkins and his medical secretary so we can respond. To protect the form from automated abuse we use Cloudflare Turnstile, which performs a passive check to confirm you’re a human; it does not set tracking cookies. Delivery is handled by Resend (Resend, Inc.), whose email infrastructure processes the message in its EU region (Ireland) solely to transmit it to the recipient inboxes and does not use it for any other purpose. Under UK GDPR, transfers to the EEA are covered by the UK’s adequacy decision. Any onward transfer to the United States for Resend’s corporate operations relies on the UK–US “data bridge” (the UK extension to the EU–US Data Privacy Framework). Please do not include highly sensitive medical detail in the form. A short summary is enough for us to reach you and continue the conversation securely by phone or through your hospital record.

Referrals from clinicians. Clinicians can refer a patient using the referral form on the For Referrers page. The form collects the referrer’s name and email address (and, optionally, their role and organisation), together with the patient’s name, a phone number or email address for the patient, and a brief reason for referral. The referring clinician confirms that the patient has agreed to be referred. The referral is delivered by email to Dr Dawkins and his medical secretary through the same services as the enquiry form (Cloudflare Turnstile and Resend, described above). Because a referral includes information about the patient’s health, it is processed for the purpose of providing healthcare (UK GDPR Article 9(2)(h)), and once received it is handled in the same way as a referral sent by email or letter. When Dr Dawkins’s team contacts a referred patient, they will confirm the details with them, and the relevant hospital’s privacy notice applies from then on.

2. Cookies and similar technologies. The website uses a small number of cookies. Some are strictly necessary for the site to function. Others are set by third-party services we embed:

Doctify: embedded review carousel on the About page and home page.
Google Maps: maps on the Locations page and home page. These only load when you click “Show map” on the map you want to see.
YouTube: embedded procedure video on the PFO and ASD closure page (loaded in YouTube’s privacy-enhanced mode).

Embedded third-party content is not loaded until you give consent through the cookie banner. If you decline, those embeds are replaced with a placeholder. You can change your choice at any time using the Cookie settings link in the footer.

3. Server logs. The website is hosted on Cloudflare Pages. Cloudflare automatically logs basic technical data (IP address, browser type, referring URL, time of request) for security, abuse-prevention and aggregate analytics. Cloudflare’s privacy practices are set out at cloudflare.com/privacypolicy. We also use Cloudflare Web Analytics to count visits and see which pages are read. It does not use cookies, does not identify you, and does not track you across other websites.

We do not use Google Analytics, advertising trackers, or social-media pixels on this site.

Lawful basis for processing

Where you submit information voluntarily (for example through the enquiry form or by emailing the secretary), we process it on the basis of legitimate interest in responding to your enquiry (UK GDPR Article 6(1)(f)), or on the basis of contract if you go on to become a patient (Article 6(1)(b)).

An enquiry or referral often includes information about your health, which is special category data. We process it for the purpose of providing healthcare (Article 9(2)(h)), and it is handled by Dr Dawkins and his medical secretary, who are subject to a duty of confidentiality.

Cookies for embedded third-party content are set on the basis of your consent (Article 6(1)(a)), which you can withdraw at any time.

We do not sell, trade, or rent personal information. We may share it only with:

The hospital where Dr Dawkins’s practice is administered (Cleveland Clinic London, Nuffield Manor Hospital or the John Radcliffe Hospital), where this is necessary to arrange or deliver care.
Service providers who help us run the website and handle correspondence: Cloudflare (hosting and Turnstile), Resend (form delivery), Microsoft (Microsoft 365 email), Doctify (the review widget) and Google (Maps and YouTube).
Where we are required to do so by law.

How long we keep information

If an enquiry or referral leads to a consultation, it becomes part of your medical record and is kept in line with the relevant hospital’s medical-records retention policy, which follows the NHS Records Management Code of Practice (for adults, usually at least eight years after the last treatment). Enquiries that do not lead to a consultation are deleted within 12 months. Server logs are retained by Cloudflare for the period set out in their policy.

Security

The website is served exclusively over HTTPS. Cookie consent and minimisation of third-party content reduce the data processed by external services. Email to Dr Dawkins and his secretary is handled on Microsoft 365. Once you become a patient, your records are held on the systems of the hospital where you are treated (Cleveland Clinic London, Nuffield Health or, for NHS patients, Oxford University Hospitals NHS Foundation Trust).

Your rights

Under UK GDPR you have the right to:

request access to the personal information we hold about you;
request correction of inaccurate or incomplete information;
request erasure of your information, where we no longer need it;
object to or restrict our processing in certain circumstances;
data portability where applicable;
withdraw consent at any time, where consent is the basis for processing.

To exercise any of these rights please contact Dr Dawkins’s secretary at clinic@samdawkins.com.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your information has been handled. The ICO can be contacted at ico.org.uk or 0303 123 1113.

Changes to this policy

This Privacy Policy may be updated from time to time. The “last updated” date at the top of the page indicates when it was last revised. By continuing to use the website after changes are posted, you accept those changes.

Contact

For any questions about this Privacy Policy, please contact Dr Dawkins’s secretary at clinic@samdawkins.com or 020 3423 7483.