1. Scope
This policy applies to belvorn.info, contact messages, newsletter requests and ordinary browsing. It explains the information Belvorn Health Ltd may receive, why it is used and the choices available to readers. The policy is written for UK visitors and is reviewed when our publishing or technical arrangements change. It does not govern external websites linked from an article.
2. Information collected
We may receive an email address when a reader joins the newsletter, plus a name and message when a reader uses the contact form. Server logs may include an IP address, browser type, requested page and time of access. We do not ask readers to submit private health histories through ordinary forms. Please avoid including sensitive personal details in a general message.
3. Legal basis
We rely on consent for optional newsletter communication and non-essential cookies. We rely on legitimate interests for site security, basic service operation and responding to a message. Where a legal obligation applies, information may be retained to meet that obligation. Consent can be withdrawn by contacting [email protected].
4. Retention
Newsletter details are kept until unsubscribe, or after 24 months without engagement. Contact messages are normally retained for 12 months after the last correspondence. Security logs are ordinarily retained for 30 days. Records needed for legal, accounting or complaint handling may be kept for up to 6 years where required.
5. Rights
Subject to applicable rules, UK readers may request access, correction, deletion, restriction, objection or a portable copy of personal information. Requests should be sent to [email protected] with enough detail to identify the request. We may need to verify identity before releasing information. A response is normally provided within one month.
6. Processors
Belvorn may use hosting, email delivery, analytics and security providers acting on written instructions. Providers receive only the information needed for their stated function. We do not sell personal information or create advertising profiles from newsletter data. Provider arrangements are reviewed as part of our operational checks.
7. International transfers
Some infrastructure providers may process information outside the UK. Where this occurs, Belvorn uses an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Details can be requested from the contact address. We consider location, access controls and retention when reviewing a provider.
8. Security
Access to contact and subscription records is limited to people who need it for editorial administration. We use account controls, encrypted connections and routine access review. No internet transmission can be described as completely risk-free. If an incident affects personal information, we will assess it and communicate where required.
9. Complaints
Readers should first contact [email protected] so we can investigate the question. A complaint may also be made to the Information Commissioner’s Office in the United Kingdom. The ICO website provides current guidance about submitting a concern. We will cooperate with a lawful request from the regulator.
10. Changes
This policy was published for the 2026 editorial year and last reviewed on 9 April 2026. Earlier wording may be retained in internal records for accountability. Material changes will be shown on this page with a new review date. Continuing to browse after an update means the revised policy is available to read.
9. International transfers
Belvorn is based in the United Kingdom, but some technical providers may process limited information in another country. Where this occurs, Belvorn will use a lawful transfer mechanism recognised under UK data protection law, such as an adequacy decision or appropriate contractual safeguards. Providers are expected to protect information using access controls, secure configuration and confidentiality duties. Readers may ask for further information about the safeguards used for a particular transfer.
- Transfers are limited to the information needed for the stated service.
- Provider access is reviewed when a service is added or materially changed.
- Requests can be sent to [email protected].
10. Processors and security incidents
Technical processors may include the hosting provider, email delivery provider, form-handling service, security monitoring provider and map provider used on the contact page. They act under written or equivalent service terms and receive only the information necessary for their function. Belvorn uses proportionate measures such as restricted access, secure configuration and routine review. If a personal data incident creates a risk to people, Belvorn will assess it promptly and notify the Information Commissioner’s Office within the applicable legal period, normally within 72 hours of becoming aware when the reporting threshold is met.
Where an incident is likely to create a high risk, affected people will be informed without undue delay in clear language. Incident records may be retained for up to six years where needed to demonstrate compliance or manage a complaint.
11. Children and automated decisions
The site is written for adults over 40 and is not directed at children. We do not knowingly ask children to provide newsletter or contact information, and a parent or guardian can contact us if information may have been submitted. Belvorn does not use personal data to make decisions that produce legal or similarly significant effects through automated processing. Routine systems may filter spam or organise messages, but a person can review a legitimate enquiry.
To exercise a right, email [email protected] or write to Belvorn Health Ltd, 37 Princes Street, Edinburgh EH1 1AA. We normally acknowledge a request within five working days and respond within one calendar month, subject to lawful extensions for complex requests. We may ask for proportionate information to confirm identity before releasing personal data.
12. Complaints and change log
Questions about privacy should first be sent to [email protected], with the subject of the request and the page or service concerned. We aim to provide a substantive response within 20 working days. A person may also complain to the Information Commissioner’s Office through its website or helpline if they remain dissatisfied. This policy was reviewed on 9 April 2026; the next revision will record its date and the material sections changed.
Previous dated review: 1 January 2026, routine wording and contact details checked. Current review: 9 April 2026, retention, processor, transfer and incident guidance expanded.
13. Data protection impact and processing records
Belvorn reviews new processing before introducing a service that could materially affect privacy. A proportionate data protection impact assessment may be completed where the nature, scale or context of processing creates a likely high risk. The assessment considers purpose, necessity, data minimisation, access, retention and safeguards. It may also record consultation with a supplier or relevant adviser.
Routine editorial publishing does not normally involve systematic monitoring or sensitive profiling. If that position changes, Belvorn will document the change, reconsider the lawful basis and update this policy before the new activity begins. Readers may ask whether an assessment was considered for a particular processing activity.
14. Sub-processors and provider review
Service providers may include the website host, email delivery service, form-handling service, security provider and Google Maps for the embedded location map. Provider access is limited by account permissions, service configuration and contractual terms where applicable. Belvorn reviews relevant providers when they are appointed and when a material service change is announced. A current provider description can be requested from [email protected].
- Hosting supports delivery of pages and technical logs.
- Email services support newsletter delivery and unsubscribe handling.
- Map services support the embedded location view and may apply their own notices.
15. Breach notification, rights and change log
If Belvorn becomes aware of a personal data breach, it will contain and assess the event promptly. Where the legal threshold is met, the Information Commissioner’s Office will normally be notified within 72 hours of awareness. People affected by a high-risk breach will be informed without undue delay using clear information about the event and recommended steps. Incident records may be retained for up to six years where required for compliance, insurance or legal advice.
Requests to access, correct, erase, restrict or object to processing should be sent to [email protected] or Belvorn Health Ltd, 37 Princes Street, Edinburgh EH1 1AA. We aim to acknowledge requests within five working days and respond within one calendar month, subject to lawful extensions for complex requests. This policy was reviewed on 9 April 2026; the previous dated review was 1 January 2026 and covered contact details, retention and cookie wording.