Privacy Notice

Who we are

Beacon Pain Clinic is the data controller for personal data submitted through this website and related clinic systems. Contact details are at the end of this notice.

What we collect

• Consultation requests (online registration): name, date of birth, gender/pronoun, address, phone, email, insurance preference, optional notes, optional GP referral file, and technical metadata (IP address and browser type) for security and abuse prevention.
• How the visit reached the form: when it can be seen, the first page opened on this website, the referring website (domain only), campaign tags such as source, medium and campaign name, and whether the visit included a Google ad click. The ad click identifier itself is not stored. If the arrival cannot be seen reliably, the source is recorded as Unknown. A visit with no referring website and no campaign tag is recorded as Direct. This is stored with the enquiry in the clinic portal so staff can see which visits become consultation requests and agreed appointments. It is not sent to Google Analytics.
• GP referrals: uploaded clinical documents (PDF/Word/image), optional GP contact details, optional patient name and date of birth for matching, and an acknowledgement that the upload is a lawful clinical referral.
• Website use: cookies and similar technologies as described in our cookie banner; analytics may record page activity without storing medical content from forms.

Health-related information is special-category personal data under GDPR.

Why we process your data (lawful bases)

• Healthcare and clinic administration — to assess requests, arrange appointments, and provide pain-management services (GDPR Art. 6 and Art. 9 grounds for healthcare provision, as applicable).
• Legitimate interests / security — to protect the service against spam, malware, and unauthorised access (rate limits, honeypots, antivirus scanning of uploads).
• Legal obligations — where we must retain or disclose information under Irish law.

Where we ask for consent (for example, agreeing to this Privacy Notice on the registration form), we record the time, a policy version identifier, and related acknowledgements (fee acknowledgement and accuracy declaration where applicable).

How we store and protect data

• Data in transit is protected with HTTPS.
• Uploaded files are stored on secured clinic servers with restricted access (not published as open web downloads). Staff access referral and registration records through an authenticated portal.
• Uploads are checked for allowed file types and scanned for malware where antivirus is available. In production, uploads may be rejected if scanning cannot be completed.

We do not claim application-level encryption of every stored file beyond host and access controls. Ask the clinic if you need details of hosting and disk security for a formal review.

Who can access your data

Authorised clinic staff (and system administrators under clinic control) may access registration leads and GP documents as needed to process referrals and care. We do not sell your personal data.

We may use IT hosting and email providers as processors under contract. They only process data on our instructions.

How long we keep data

Online consultation requests (patient leads) are retained for up to 365 days by default, then anonymised or deleted by our retention process, unless a longer period is required for ongoing care or legal reasons.

GP referral documents that have been archived are subject to a similar retention window (clinic setting, default aligned with lead retention) and may then be deleted, including files on disk.

Incomplete registration drafts (step-one captures) are cleaned under the same retention rules.

Your rights

Under GDPR you may have rights to access, rectify, erase, restrict, or object to certain processing, and to lodge a complaint with the Data Protection Commission (dataprotection.ie). To exercise rights relating to data held by the clinic, contact us using the details below. We may need to verify your identity before acting.

Cookies

Essential cookies support security (for example CSRF protection) and session features. The session keeps the first-page source described above until the consultation form is submitted or the session ends. Non-essential analytics cookies are only used where you consent via the cookie banner. Google Analytics does not receive the enquiry, the referral letter, or the source stored on the enquiry.

Changes

We may update this notice. The version identifier and date above will change when we do. Continued use of the site after updates means you should review this page periodically.

Contact