Privacy Policy

Effective date: 24 March 2026

Chestnut Surgery Ltd, trading in connection with Mr Christopher West, respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your personal data when you visit this website, contact us, submit an enquiry, book a consultation, or otherwise interact with us online.

1. Who we are

For the purposes of UK data protection law, the data controller is:

Chestnut Surgery Ltd
Top Floor West, Wharfebank House, Wharfebank Mills, Ilkley Road, Otley, West Yorkshire, United Kingdom, LS21 3JP

If you have any questions about this Privacy Policy or how we use your personal data, you can contact us at:

info@mrchristopherwest.co.uk
+44 7877 600600

2. Who this policy applies to

This Privacy Policy applies to visitors to this website and to people who contact us through our website forms, email, phone, WhatsApp or other online channels connected to this website.

This website and its consultation forms are intended for adults aged 18 and over.

3. The personal data we collect

Depending on how you use the website, we may collect and process the following personal data:

Information you provide directly

  • Full name
  • Email address
  • Telephone number
  • Age
  • Postcode
  • Preferred location
  • How you heard about us
  • Best time to contact you
  • Treatment area and procedure information
  • Revision or secondary surgery information
  • Free-text enquiry messages
  • Uploaded photographs
  • Notes added in connection with uploaded photographs
  • Any information you choose to provide by email, WhatsApp, phone or other direct contact

Special category and health-related data

Some website enquiries may include sensitive personal data, including photographs, details of previous surgery, treatment concerns, smoking status, medical background or other health-related information you choose to provide. We treat this information with additional care and only use it where necessary for managing your enquiry, assessing suitability for consultation, responding to your request or taking steps at your request before entering into a contract for services.

Technical and usage data

When you visit the website, we may also collect technical and usage information such as:

  • IP address
  • Browser type and version
  • Device type and operating system
  • Pages visited and time spent on the website
  • Referral source
  • Basic cookie and analytics data
  • Website performance and security logs

4. How we collect your personal data

We collect personal data in a number of ways, including when you:

  • Fill in a website contact or consultation form
  • Email us
  • Call us
  • Contact us via WhatsApp or other messaging tools linked from the website
  • Use or interact with the website and its cookie or analytics tools
  • Subscribe to marketing or tick an opt-in box for updates

5. How we use your personal data

We may use your personal data to:

  • Respond to your enquiry
  • Contact you about a consultation request
  • Assess the nature of your enquiry and direct it to the right person
  • Review photographs and notes you choose to provide in connection with your enquiry
  • Arrange appointments or consultations
  • Manage communications with you before treatment
  • Improve our website, services and patient journey
  • Monitor website traffic, engagement and performance
  • Maintain website security and prevent misuse
  • Comply with legal, regulatory and professional obligations
  • Send marketing updates only where you have given your consent

6. Our lawful bases for processing

Under UK data protection law, we rely on one or more of the following lawful bases:

Legitimate interests

We process personal data where it is necessary for our legitimate interests in operating the website, responding to enquiries, managing communication, administering the business, improving the website and keeping our systems secure, provided those interests are not overridden by your rights and interests.

Taking steps at your request before entering into a contract

Where you contact us to discuss a consultation, treatment or related services, we may process your personal data in order to take steps at your request before entering into a contract.

Consent

We rely on consent where required, including for non-essential cookies and for marketing communications where you choose to opt in. You can withdraw your consent at any time.

Legal obligation

We may process personal data where necessary to comply with legal, regulatory, tax, accounting, insurance, clinical governance or other statutory obligations.

Special category data

Where you provide health-related or other special category data through the website, we process that information only where we have a valid condition under UK data protection law, including where processing is necessary for the establishment, exercise or defence of legal claims, or where you have clearly made the information available to us in connection with your enquiry and it is necessary to respond appropriately.

7. Marketing communications

We only send marketing emails or updates if you have actively opted in, for example by ticking a consent box. You can unsubscribe or withdraw consent at any time by contacting us using the details above or by following the unsubscribe instructions in the message where available.

8. Cookies, analytics and similar technologies

This website uses cookies and similar technologies to make the site work, remember preferences, monitor usage and improve performance. We also use a cookie consent tool so that visitors can manage non-essential cookies.

Based on the current website setup, the site may use services and tools including:

  • CookieYes for cookie consent management
  • Google services via Site Kit by Google, including analytics and search-related data
  • Jetpack services for website performance and support features
  • WhatsApp chat integration where enabled
  • Security, SMTP and website performance tools used to operate the site reliably

Essential cookies are used to make the website function properly. Non-essential analytics and similar cookies should only be set in accordance with your cookie preferences. For more detail, please see our Cookie Policy.

9. Who we share your personal data with

We do not sell your personal data. We may share personal data where necessary with trusted service providers and processors who help us operate the website and respond to enquiries, including:

  • Website hosting and website support providers
  • Email delivery and SMTP providers
  • Website form and submission storage tools, including Contact Form 7 and CF7 Submissions
  • Analytics and website performance providers
  • Cookie management providers
  • Messaging or communication tools linked from the website, including WhatsApp where used
  • Professional advisers, insurers, regulators or authorities where required

We only share the personal data needed for the relevant purpose, and only where there is a lawful basis to do so.

10. Where your data is stored

Website enquiries submitted through our online forms may be sent to our email inbox and stored within the website environment through form submission tools. Access to this information is limited to authorised personnel and service providers who need it for legitimate business purposes.

11. International transfers

Some of the third-party providers used in connection with this website may store or process personal data outside the United Kingdom. Where this happens, we take reasonable steps to ensure appropriate safeguards are in place, such as the use of adequacy regulations, standard contractual clauses, or equivalent lawful transfer mechanisms where required.

12. How long we keep your personal data

We only keep personal data for as long as reasonably necessary for the purposes set out in this Privacy Policy, including to deal with enquiries, maintain business records, meet legal obligations and resolve disputes.

As a general approach:

  • Website enquiries and consultation requests are usually retained for up to 24 months from the last meaningful contact, unless a longer period is needed for legal or administrative reasons.
  • Uploaded photographs and related enquiry notes are usually retained for up to 12 months if no consultation or treatment proceeds, unless a longer period is needed in connection with the enquiry, legal claims or complaint handling.
  • If an enquiry leads to consultation or treatment, relevant information may be retained for longer in line with legal, insurance, regulatory and professional record-keeping obligations.
  • Marketing records are kept until you withdraw consent or until they are no longer needed.
  • Analytics and technical logs are retained in line with the settings of the relevant systems and our reasonable operational needs.

13. How we keep your personal data secure

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No online system is completely secure, but we take website, email and access controls seriously and limit access to personal data to those who need it.

14. Your rights

Subject to the law and depending on the circumstances, you may have the right to:

  • Be informed about how your personal data is used
  • Request access to your personal data
  • Request correction of inaccurate or incomplete personal data
  • Request erasure of your personal data in certain circumstances
  • Request restriction of processing in certain circumstances
  • Object to processing based on legitimate interests
  • Withdraw consent where we rely on consent
  • Request data portability where applicable
  • Raise a complaint with the Information Commissioner’s Office

If you want to exercise any of your rights, please contact us at info@mrchristopherwest.co.uk.

15. Complaints

If you have concerns about how we use your personal data, we would appreciate the chance to address them first. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator.

Information Commissioner’s Office
Website: https://ico.org.uk/

16. Automated decision-making

We do not use your personal data collected through this website to make solely automated decisions about you that have legal or similarly significant effects.

17. Third-party websites

This website may contain links to third-party websites or services. If you click through to another website, that website will have its own privacy and cookie practices and we are not responsible for them.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the website, our services, the law or our data handling practices. Any updates will be posted on this page and the effective date will be updated.