This site is run by Paul Blatherwick, who is the data controller for the personal data described here. You can reach me at paulblatherwick@heartbeat-framework.org. The site exists to publish open-access documents. Reading them needs no account, and nothing on this site is used for advertising or to follow you to other sites. Two things do happen when a page loads — a visit count and a security check, both run by Cloudflare — and both are set out below, along with what happens to anything you choose to send me.
What is collected, and why
If you send an enquiry, the form collects your name, email address, message, and whether you would like a written reply or a callback, plus — only if you provide them — your organisation, role, and phone number. Each enquiry is also stored with the date and time it arrived and a status I use to keep track of my reply. The form does not record your IP address or browser details. This is used for exactly one purpose: responding to you, by the method you asked for. The lawful basis is legitimate interests — you contacted me, and answering you requires holding what you sent. The same applies if you write to me by email. You are under no obligation to send anything; without a way to reach you, I simply cannot reply.
Where it comes from: from you, or from your browser when a page loads. If someone else's enquiry mentions you, I hold what they wrote, for the same purpose and period, and you have the same rights over it.
Please do not include clinical information about identifiable people in an enquiry; if you need to discuss a situation, describe it without identifying anyone. If an enquiry contains health or other sensitive information anyway, I use it only to reply and delete it with the rest of the enquiry. This address is not watched for urgent help. If someone is at immediate risk, call 999; in England, NHS 111 also has a mental health option.
Analytics
Every page loads Cloudflare Web Analytics unless you switch it off below. It is a small script that tells me how often each page is read, where readers arrived from, and how quickly the pages load. I use it to see which documents are being read and to keep the site fast. That is its only purpose.
When a page loads, the script sends Cloudflare the address of the page; the address of the page you came from, if your browser passes it on; your browser and operating system and their versions; page-load timings and the browser's memory figures; and a random identifier for that single page view, which is not reused. When you leave the page it sends a second report with page-experience measurements (Core Web Vitals), including which part of the page each measurement relates to. As with any request, Cloudflare also receives your IP address and your browser's user-agent string. The dashboard shows me totals — by country, page, referring site, device type, browser and operating system — not individual visits, and I do not try to identify anyone from it.
The script sets no cookies and stores nothing in your browser. Cloudflare says Web Analytics does not use your IP address, user-agent or anything else to fingerprint you for analytics, and does not track individual visitors across the other websites it serves. It keeps the full-detail data for 7 days and then keeps a sample of about one in ten; my dashboard covers the previous six months. I have found no published period for how long Cloudflare keeps the IP address and user-agent from these requests, and no statement of where Web Analytics data is stored; it may be processed in the United States (see International transfers).
Because the script reads information from your browser, the Privacy and Electronic Communications Regulations apply. I rely on the exception for collecting statistics about how a website is used in order to improve it (PECR, Schedule A1, paragraph 5). That exception requires me to tell you what the analytics does, which this section does, and to give you a free and simple way to object, which is below. Under the UK GDPR the lawful basis is legitimate interests: knowing which documents are read and keeping the site working, with a tool that uses no cookies and shows me no individual visits.
To object, untick this box. The analytics script then stops loading in this browser, from the next page you open. Your choice is saved in this browser only, as a single entry in its local storage that holds no identifier, and it stays until you clear this browser's storage; in another browser or on another device, set it again there. Tick the box again to undo it. If your browser sends a Global Privacy Control signal or blocks site storage, the analytics does not load at all. Because the analytics holds nothing that identifies you, an email cannot switch it off for you; the box can.
The security check and its cookie
Cloudflare, which serves the site, adds a small script to every page that examines characteristics of your browser and sends the result to Cloudflare, to tell people from automated traffic and protect the site from abuse. It then sets a cookie, cf_clearance, which records the result of that check. The cookie is marked HttpOnly, so no script on the page can read it, and it lasts one year unless you delete it. That is the cookie seen when this site was tested; Cloudflare's bot protection can also set a second cookie, __cf_bm, which expires after 30 minutes of inactivity. Cloudflare says data in these cookies may be processed in its data centres in the United States.
I rely on the exception for storage and access that is strictly necessary to protect the site and the information sent through it, and to prevent or detect fraud and technical faults (PECR, Schedule A1, paragraph 4), so this does not ask for your consent. The processing behind it rests on legitimate interests: keeping the site and the people who use it safe. Cloudflare also uses information from this check, as a controller in its own right under its privacy policy (cloudflare.com/privacypolicy), to protect its network generally. You can delete these cookies in your browser settings at any time.
There are no analytics, advertising or marketing cookies.
No decision with legal or similarly significant effects is made about you by automated means. Cloudflare's security check can automatically challenge or block traffic that looks automated; if that happens to you in error, email me and I will look into it.
Where it lives, and who handles it
- Cloudflare serves the site, runs the analytics and the security check described above, hosts the database that stores enquiries, and routes email sent to this address. Enquiries are stored in a Cloudflare database under an account controlled solely by me. It runs in Western Europe, but it was not created with Cloudflare’s EU-only setting, so Cloudflare does not guarantee where it runs. Cloudflare's network is global, so data passing through it may be handled outside the UK on its way. For hosting, the enquiry database, email routing, and the analytics and logs shown to me, Cloudflare acts as my processor under its Data Processing Addendum. For the security of its own network, including the bot check, Cloudflare also uses request data such as IP addresses as a controller, under its own privacy policy.
- Email. Email sent to this address is received by Cloudflare’s email routing and forwarded to my personal mailbox, whose provider holds it on my behalf. Email I send from this address goes out through Amazon Web Services (Simple Email Service), which acts as my processor under the AWS Data Processing Addendum. The enquiry form itself sends no email: an enquiry is stored, and I read it there.
- Nothing you send is sold, traded or used for marketing, and it is not passed to anyone beyond the services named here unless the law requires it. There are no mailing lists here.
International transfers
- Cloudflare may process data in the United States and in other countries where it has facilities. Transfers to the United States rely on the UK–US data bridge — the UK Extension to the EU–US Data Privacy Framework, recognised by the Data Protection (Adequacy) (United States of America) Regulations 2023. Where that does not apply, Cloudflare relies on the EU standard contractual clauses with the UK Addendum.
- Amazon’s email service is used in its United States (Oregon) region. Transfers to the United States rely on the UK–US data bridge; otherwise on the standard contractual clauses in the AWS Data Processing Addendum. My personal mailbox provider may also handle email outside the UK, under its own safeguards.
- Ask and I will send you a copy of the safeguards relied on.
What is not collected
No advertising trackers and no marketing cookies. Cloudflare's security check does examine characteristics of your browser, to tell people from automated traffic; that is described under The security check and its cookie, and it is used only for security.
Server logs
Like any host, Cloudflare keeps operational logs of requests to the site, such as IP addresses. The logs I can see are short-lived: the longest, the record of email routed to this address, is kept for up to 30 days. Cloudflare keeps its own logs for as long as it needs them under its privacy policy; I have found no fixed period published.
How long it is kept
Enquiries, and the correspondence that follows them, are kept for 12 months after the last message in the conversation, so that a thread can be picked up if you come back to it. After that I delete the enquiry from the database and the emails from the mailbox, including its deleted-items folder. I check for anything past that point at least once every three months. Ask and yours will be deleted sooner — the same address deals with both. Analytics data is kept by Cloudflare for the periods given above.
Your right to object
You have the right to object to any processing I carry out on the basis of legitimate interests. For the analytics, use the box above. For anything else, write to me and I will stop unless I have a compelling reason to continue, which I will explain.
Your rights
You can ask what is held about you, ask for a copy, ask for correction, ask for deletion, or ask me to restrict how your data is used, at any time and free of charge: paulblatherwick@heartbeat-framework.org. I will reply within one month. Some rights depend on the circumstances; if I cannot do what you ask, I will tell you why.
If you are unhappy with how your data has been handled, you can complain to me, by email or through the contact form. I will treat anything that reads as a complaint as one, though it helps if you say so. I will acknowledge it within 30 days, look into it, keep you informed, and tell you the outcome. You also have the right to complain to the UK data protection regulator — the Information Commissioner's Office until 30 September 2026, the Information Commission from that date — at ico.org.uk.