Privacy notice

Who is responsible

Mr Jay Goswamy FRCS is the data controller for the information collected through this website, registered with the Information Commissioner’s Office under number ZA502469. You can reach the practice at care@jaygoswamy.com or on 0161 5 708 807 with any question about how your details are used, or to make any of the requests set out below.

What this website collects

There are two places on this site where you can type something. The first is the appointment request form on the contact page:

• your name, telephone number and email address
• who the appointment is for, how you expect to pay, and any hospital preference
• whatever you choose to write in the free text box
• the fact that you ticked the consent box, and when

The second is the Help panel, linked at the foot of every page. If you use it to ask a question, it takes your name, your email address, your question, and your permission for the practice to reply. If you use it to tell us something is broken, or to suggest an improvement, it takes only what you write: you are not asked for your name or your email address, and neither is stored.

A report that something is broken, or a suggestion, is passed through an automated sorting step before a person sees it. It goes to n8n, an automation service hosted in Frankfurt, Germany, which asks Google’s Gemini to read what you wrote and summarise it for whoever picks it up. It also flags a report that looks like a medical question, or that appears to name somebody, so that it is handled with care rather than passed around. Nothing is generated for you to read, and no answer is composed on the practice’s behalf. A question is not treated this way. If you ask a question it goes to the practice by email and nothing automated reads it.

Either way it also records which page you were on, the size of your browser window and which browser you were using, because a report about a page is little use without them, along with your IP address, which is used only to stop the panel being flooded.

Neither the form nor the Help panel is a route for detailed medical information, and neither is a route for anything urgent. A sentence about what is going on is enough for the team to route your enquiry. If you do write something about your health, it is treated as special category data and handled with the same care as a clinical record.

There is no account to create, no tracking or advertising cookie, and no analytics profile built about you.

The telephone line

Calls to the practice number are answered by a person whenever the line is staffed. Conversations are not recorded. What the line keeps is what a telephone bill has always held: the number you called from, when you called, and whether the call was answered, so that the practice can return calls that did not get through.

If nobody can take your call, you are invited to leave a message after the tone. A voicemail is a recording you choose to make. It is held by Twilio, the practice’s telephone provider, in Dublin, Ireland, and a written transcript of it is produced automatically by Deepgram, a transcription service, processed within the European Union and stored only in the practice’s own records, so the team can read your message as well as listen to it. The transcript is an aid for the team; the recording remains the authoritative account of what you said.

Call details and transcripts are stored in the practice’s administrative records, in a database hosted by Supabase in London, United Kingdom. On the way there they pass through a small program run by Cloudflare, which receives what the telephone provider reports about a call and files it; it keeps nothing of its own. A voicemail opens an enquiry with the practice team, who will return your call. Like the website’s forms, the telephone line is not a route for anything urgent.

Voicemail recordings and their transcripts are deleted after six months, the same period as the website’s forms below, and like them it happens automatically rather than when somebody remembers.

Email to the practice

If you email care@jaygoswamy.com, including by replying to the acknowledgement the contact form sends you, your message is filed automatically in the same administrative records, so that it joins any earlier contact from you and the team can see the whole thread rather than a fragment. It reaches those records by way of the same automation service in Frankfurt, and is then held in the database in London. The mailbox itself is Google Workspace, which the practice used before any of this.

Why, and on what basis

Your details are used for one thing: to answer what you sent and arrange your care. The lawful basis is your consent, given by ticking the box on the contact form or in the Help panel, and you can withdraw it at any time by contacting the practice. Withdrawing consent does not affect anything already done with your permission.

A report that something on the site is broken carries no name and no email address. The page details and the IP address recorded alongside it are kept on the basis of our legitimate interest in keeping this website working and in preventing the form being abused.

On the telephone, a voicemail is recorded and transcribed on the basis of the choice you make to leave a message after the invitation and the tone. Where what you say concerns your health, it is special category data, handled under the condition for the provision of healthcare and with the same care as a clinical record.

Where it is stored

Enquiries and Help messages are stored in a database hosted by Supabase in London, United Kingdom. A copy of an enquiry, and of a question asked through Help, is emailed to the practice inbox so the team can reply. An appointment request is also passed straight to the practice’s own administrative records, the same records described above for the telephone line and for email, so that it reaches a named person with a reference rather than sitting as one more message in an inbox. Everything you typed on the form goes with it: your name, telephone number and email address, who the appointment is for, how you expect to pay, any hospital preference, and whatever you wrote in the free text box. Those records are held in a database hosted by Supabase in London, United Kingdom. If you use the appointment request form, an acknowledgement is sent to the email address you give, so that you know the enquiry arrived. It confirms receipt and repeats nothing of what you wrote. A report that something is broken goes instead to a private Slack channel used by the people who maintain this website, by way of the automated sorting step described above, and carries only what you wrote and the page you were on. The database is closed to public access: nothing can be read from it through this website. The site itself is hosted by Vercel.

How long it is kept

Enquiries and Help messages are deleted after six months. That happens automatically, every night, rather than when somebody remembers. The six months is this website’s own store. An appointment request that has reached the practice’s administrative records is kept there as part of your correspondence with the practice, for as long as the practice needs it to deal with you, and is deleted on request rather than on that clock. Where you go on to become a patient, the enquiry is superseded by your clinical record, which is retained under NHS records management rules rather than this notice.

Who else sees it

The practice management team, and Mr Goswamy. A report about the website itself is also seen by the people who maintain it, who also build and maintain the practice’s administrative records and can therefore see what those records hold. Your details are never sold, and are not shared for marketing. Everybody else involved is one of the hosting, email, telephone, transcription, automation and messaging providers named above, acting on the practice’s instructions.

Cookies, maps and films

This site sets no cookies of its own. There is no advertising and no tracking of any kind. The site does count its visits, and it measures its own speed: Vercel, the company that hosts it, reports how many times each page is read, the country the reader was in, and how quickly pages loaded and responded. Neither uses a cookie, neither stores anything on your device, and neither builds a record of you as an individual; nobody can tell from either that you, in particular, were here.

Two things on the site come from somewhere else and need your permission:

• the maps on the contact page, which are Google’s
• the four thyroid films on the videos page, which belong to Circle Health Group and are published on YouTube

Both set cookies and see your IP address when they load, so neither is requested until you say so. Until then you get a placeholder with a button on it. You can allow them once, for a single map or film, or for the whole site, and you can change your mind at any time using the cookie choices link in the footer. Your answer is remembered in your own browser’s storage rather than in a cookie, so declining leaves nothing behind at all.

Mr Goswamy’s own films, the four on the videos page and the introduction on the profile page, play without asking. They are hosted on his own Cloudflare Stream account rather than on a video platform, and they set no cookies and store nothing on your device. Cloudflare serves the video and sees the request, in the same way any host sees a request for a page.

Nothing else on the site depends on this. Both hospital addresses are written out in full on the clinics page alongside a map picture served from this site, which contacts nobody, and every condition is explained in writing.

Your rights

You can ask for a copy of what the practice holds about you, ask for it to be corrected or deleted, ask that it be restricted or moved elsewhere, and object to how it is used. Contact the practice and it will be dealt with within one month.

If you are not satisfied with the response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.