Privacy policy
How Chestnut Surgery Ltd collects, uses and protects your personal data.
Effective date: 24 March 2026
Chestnut Surgery Ltd, trading in connection with Mr Christopher West, respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store and protect your personal data when you visit this website, contact us, submit an enquiry, book a consultation, or otherwise interact with us online.
1. Who we are
For the purposes of UK data protection law, the data controller is:
Chestnut Surgery Ltd
Top Floor West, Wharfebank House, Wharfebank Mills, Ilkley Road, Otley, West Yorkshire, United Kingdom, LS21 3JP
If you have any questions about this Privacy Policy or how we use your personal data, you can contact us at:
2. Who this policy applies to
This Privacy Policy applies to visitors to this website and to people who contact us through our website forms, email, phone, WhatsApp or other online channels connected to this website.
This website and its consultation forms are intended for adults aged 18 and over.
3. The personal data we collect
Depending on how you use the website, we may collect and process the following personal data:
Information you provide directly
- Full name
- Email address
- Telephone number
- Age
- Postcode
- Preferred location
- How you heard about us
- Best time to contact you
- Treatment area and procedure information
- Revision or secondary surgery information
- Free-text enquiry messages
- Uploaded photographs
- Notes added in connection with uploaded photographs
- Any information you choose to provide by email, WhatsApp, phone or other direct contact
Special category and health-related data
Some website enquiries may include sensitive personal data, including photographs, details of previous surgery, treatment concerns, smoking status, medical background or other health-related information you choose to provide.
We treat this information with additional care and only use it where necessary for managing your enquiry, assessing suitability for consultation, responding to your request or taking steps at your request before entering into a contract for services.
Technical and usage data
When you visit the website, we may also collect technical and usage information such as:
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and time spent on the website
- Referral source
- Basic cookie and analytics data
- Website performance and security logs
4. How we collect your personal data
We collect personal data in a number of ways, including when you:
- Fill in a website contact or consultation form
- Email us
- Call us
- Contact us via WhatsApp or other messaging tools linked from the website
- Use or interact with the website and its cookie or analytics tools
- Subscribe to marketing or tick an opt-in box for updates
5. How we use your personal data
We may use your personal data to:
- Respond to your enquiry
- Contact you about a consultation request
- Assess the nature of your enquiry and direct it to the right person
- Review photographs and notes you choose to provide in connection with your enquiry
- Arrange appointments or consultations
- Manage communications with you before treatment
- Improve our website, services and patient journey
- Monitor website traffic, engagement and performance
- Maintain website security and prevent misuse
- Comply with legal, regulatory and professional obligations
- Send marketing updates only where you have given your consent
6. Our lawful bases for processing
Under UK data protection law, we rely on one or more of the following lawful bases:
Legitimate interests
We process personal data where it is necessary for our legitimate interests in operating the website, responding to enquiries, managing communication, administering the business, improving the website and keeping our systems secure, provided those interests are not overridden by your rights and interests.
Taking steps at your request before entering into a contract
Where you contact us to discuss a consultation, treatment or related services, we may process your personal data in order to take steps at your request before entering into a contract.
Consent
We rely on consent where required, including for non-essential cookies and for marketing communications where you choose to opt in.
You can withdraw your consent at any time.
Legal obligation
We may process personal data where necessary to comply with legal, regulatory, tax, accounting, insurance, clinical governance or other statutory obligations.
Special category data
Where you provide health-related or other special category data through the website, we process that information only where we have a valid condition under UK data protection law, including where processing is necessary for the establishment, exercise or defence of legal claims, or where you have clearly made the information available to us in connection with your enquiry and it is necessary to respond appropriately.
7. Marketing communications
We only send marketing emails or updates if you have actively opted in, for example by ticking a consent box.
You can unsubscribe or withdraw consent at any time by contacting us using the details above or by following the unsubscribe instructions in the message where available.
8. Cookies, analytics and similar technologies
The website only uses cookies for analytics and social media measurement if you choose Accept on the cookie banner. If you choose Reject, none of them are set.
Remembering your choice:
Your browser stores whether you chose Accept or Reject under the name cw-consent, so the banner does not ask again on every page. This stays on your device and is not sent to anyone.
Google Analytics:
With your consent, Google Analytics sets the cookies _ga and _ga_VK4ZNQBG6Q. They count visits and show which pages people read, so we can see how the website is used. They last up to 2 years.
Meta Pixel:
With your consent, the Meta Pixel sets the cookie _fbp and tells Meta which pages of this website you view. We use it to measure how Instagram and Facebook bring people to the site. The cookie lasts up to 90 days.
Reviews and Instagram feed:
The Google reviews and the Instagram feed on the homepage load through Elfsight, which may store settings for those widgets in your browser.
Changing your mind:
Choose Cookie settings at the foot of any page to accept or reject again. Choosing Reject removes the Google Analytics and Meta cookies this website set.
10. Where your data is stored
Website enquiries submitted through our online forms may be sent to our email inbox and stored within the website environment through form submission tools.
Access to this information is limited to authorised personnel and service providers who need it for legitimate business purposes.
11. International transfers
Some of the third-party providers used in connection with this website may store or process personal data outside the United Kingdom.
Where this happens, we take reasonable steps to ensure appropriate safeguards are in place, such as the use of adequacy regulations, standard contractual clauses, or equivalent lawful transfer mechanisms where required.
12. How long we keep your personal data
We only keep personal data for as long as reasonably necessary for the purposes set out in this Privacy Policy, including to deal with enquiries, maintain business records, meet legal obligations and resolve disputes.
As a general approach:
- Website enquiries and consultation requests are usually retained for up to 24 months from the last meaningful contact, unless a longer period is needed for legal or administrative reasons.
- Uploaded photographs and related enquiry notes are usually retained for up to 12 months if no consultation or treatment proceeds, unless a longer period is needed in connection with the enquiry, legal claims or complaint handling.
- If an enquiry leads to consultation or treatment, relevant information may be retained for longer in line with legal, insurance, regulatory and professional record-keeping obligations.
- Marketing records are kept until you withdraw consent or until they are no longer needed.
- Analytics and technical logs are retained in line with the settings of the relevant systems and our reasonable operational needs.
13. How we keep your personal data secure
We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
No online system is completely secure, but we take website, email and access controls seriously and limit access to personal data to those who need it.
14. Your rights
Subject to the law and depending on the circumstances, you may have the right to:
- Be informed about how your personal data is used
- Request access to your personal data
- Request correction of inaccurate or incomplete personal data
- Request erasure of your personal data in certain circumstances
- Request restriction of processing in certain circumstances
- Object to processing based on legitimate interests
- Withdraw consent where we rely on consent
- Request data portability where applicable
- Raise a complaint with the Information Commissioner's Office
If you want to exercise any of your rights, please contact us at info@mrchristopherwest.co.uk.
15. Complaints
If you have concerns about how we use your personal data, we would appreciate the chance to address them first.
You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator.
Information Commissioner's Office
Website: https://ico.org.uk/
16. Automated decision-making
We do not use your personal data collected through this website to make solely automated decisions about you that have legal or similarly significant effects.
17. Third-party websites
This website may contain links to third-party websites or services.
If you click through to another website, that website will have its own privacy and cookie practices and we are not responsible for them.
18. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to the website, our services, the law or our data handling practices.
Any updates will be posted on this page and the effective date will be updated.