Cookie Policy and Notice

For everyone who visits our website

1. Who we are

Synthesis Clinic Ltd, trading as Synthesis Clinic, is the data controller for personal data collected through www.synthesisclinic.co.uk. We are regulated by the Care Quality Commission, Provider ID 1-7720456969, and registered with the Information Commissioner's Office under registration ZA550819.

Questions about this policy go to our Data Protection Lead at dataprotection@synthesisclinic.co.uk, or by telephone on 01628 964330.

This policy sits alongside our Privacy Policy and Notice, which explains everything else we do with personal data. Read them together.

2. What cookies are, and what they collect

Cookies are small files placed on your device when you visit a website. Similar technologies, including local storage, pixels and browser databases, do the same job. Where we refer to cookies in this policy we mean all of them.

Some of the information collected through cookies is personal data. An IP address and an online identifier are personal data under Article 4(1) of the UK GDPR, even though they do not carry your name. We say this plainly because our previous cookie policy stated the opposite, and that statement was wrong.

Cookies do not give us access to your device or to anything else stored on it, and they do not read your clinical record.

3. How we ask for your consent

Cookies that are strictly necessary for the website to work are set without asking, which the law permits. Everything else is set only if you agree.

• When you first visit, a banner asks you to accept or decline. Declining is a single click, exactly like accepting.
• You can choose category by category using the manage option rather than accepting everything.
• Nothing in the analytics or advertising categories is set before you make a choice.
• You can change your mind at any time using the cookie settings link on our website, and your choice takes effect immediately.
• We keep a record of the consent you give, so that we can show what you agreed to and when.

Declining has no effect on the care you receive, on any enquiry you make, or on your ability to use the site.

4. The categories we use

We use the three categories below. Section 5 lists what sits in each.

5. The cookies on our website

The list below is generated automatically from a scan of our website, and it updates itself each month. It is therefore always current, which a list typed into a policy would not be. It gives the name of each cookie, who sets it, what it does and how long it lasts, grouped into the three categories above.

The same list also shows the choice you have made and when you made it, and lets you change it.

6. Website analytics and heatmapping

We use Google Analytics and Contentsquare to understand how our website is used. Contentsquare produces heatmaps, which show in aggregate where people click and how far down a page they read.

This tells us which information people are looking for and which pages are not working well. It is not used to identify you, it is not linked to your clinical record, and it plays no part in your care.

Both are set only if you accept analytics cookies, and both stop if you decline or later withdraw.

7. Advertising

We advertise our services online. Advertising cookies let us measure whether an advert led to a visit, and let us show our advertising to people who have already visited our website.

These are set only if you accept the advertising category. If you decline, we still advertise, and you may still see our adverts, but they are not selected on the basis of your visit to our site.

We do not sell or trade your personal data, and we do not allow any supplier to use information collected through our website for its own purposes.

8. Video and other embedded content

Some of our pages contain YouTube videos. YouTube sets its own cookies when a video loads, and those are treated as advertising cookies here because that is what they are. They are not set unless you accept that category.

9. Information sent outside the UK

Google and Contentsquare process information in the United States. Cookiebot, our consent platform, holds consent records in Ireland.

Transfers to the United States are made under the UK Extension to the EU-US Data Privacy Framework where the supplier is certified, and otherwise under the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. Our Medical and Company Director approves each arrangement following an assessment of the risk.

If you would like to know which safeguard applies to a particular supplier, ask us at dataprotection@synthesisclinic.co.uk.

10. The patient portal

Your patient portal at portal.synthesisclinic.co.uk is a separate system operated for us by Function 365 Ltd under a written processing agreement. Cookies there are necessary to keep you logged in securely and are covered by that agreement rather than by this policy.

11. Managing cookies in your browser

As well as our own controls, every browser lets you block or delete cookies. On a Mac this is under Chrome, Settings, Privacy and security, or Safari, Settings, Privacy. Blocking all cookies will stop parts of this and most other websites from working properly.

12. Your rights, and how to complain

Where cookies collect personal data, you have the rights set out in our Privacy Policy: access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. To exercise any of them, contact our Data Protection Lead at dataprotection@synthesisclinic.co.uk or telephone 01628 964330.

If you are unhappy with how we have handled your personal data, complain to us by any route that suits you. We will acknowledge within 30 days and normally within 5 working days. You may also complain to the Information Commissioner's Office at any time, on 0303 123 1113 or at ico.org.uk, whether or not you have raised it with us first.

13. Changes to this policy

We review this policy at least annually and whenever our website systems change. The current version is always on our website.