Privacy Notice
Last updated 3 November 2026
In short: this site sets no cookies and runs no analytics, advertising trackers or social media pixels. We only use the details you send us to reply to you, and you can ask us to delete them at any time.
Who we are
CardioMetabolic Health Foundation (“the Foundation”, “we”, “us”) is a Charitable Incorporated Organisation registered in England & Wales (registered charity no. 1216451). We are the data controller for personal information collected through this website. ICO registration no. [ICO NUMBER].
You can contact us about anything in this notice at collaborate@cardiometabolic.foundation. We are not required to appoint a Data Protection Officer; questions are handled by our trustees.
What information we collect
We collect only what we need:
- Contact form and emails: your name, email address, the role you select and the content of your message.
- Technical data: when any website is visited, the hosting network automatically processes your IP address, browser type and the pages requested, so the site can be delivered and protected from attacks. We do not use this to identify you.
- Your accessibility choices: if you use the accessibility options on this site, your choices are saved on your own device (see “Cookies and device storage”). They are never sent to us.
Please don’t send us medical details or other sensitive (“special category”) information. If you do, we will only use it to reply and will delete it when it is no longer needed.
How we use it and our lawful basis
Under the UK General Data Protection Regulation (UK GDPR) and the EU GDPR we must have a lawful basis for using your information:
| Purpose | Information | Lawful basis |
|---|---|---|
| Replying to your enquiry or partnership request | Name, email, role, message | Legitimate interests (Article 6(1)(f)): responding to people who contact us |
| Keeping a record of our correspondence | Name, email, message | Legitimate interests: running the charity and handling follow-up questions |
| Delivering and securing the website | IP address, browser data | Legitimate interests: keeping the website available and secure |
| Meeting legal or regulatory obligations | Any of the above, if needed | Legal obligation (Article 6(1)(c)) |
We never sell your information, use it for marketing without your agreement, or make automated decisions (including profiling) that affect you.
International transfers
Some of our providers process information outside the UK and European Economic Area. Where this happens, the transfer is protected by an adequacy decision (such as the UK–US Data Bridge) or by the International Data Transfer Agreement / Standard Contractual Clauses approved by the UK Information Commissioner and the European Commission.
How long we keep it
- Contact form messages and emails: up to six years, then deleted.
- Website security logs: kept by our hosting provider for a short period in line with its own retention policy.
- Accessibility choices: on your device until you reset them or clear your browser data.
How we protect it
This website is served only over an encrypted (HTTPS) connection. Access to our inbox is limited to the people who need it, and we review our service providers’ security before using them.
Your rights
You have the right to:
- Access the personal information we hold about you;
- Rectification — ask us to correct anything that is wrong or incomplete;
- Erasure — ask us to delete your information;
- Restriction — ask us to limit how we use it;
- Object to our use of it where we rely on legitimate interests;
- Data portability — receive it in a commonly used, machine-readable format;
- Withdraw consent at any time, where we rely on consent.
To use any of these rights, email collaborate@cardiometabolic.foundation. It is free, and we will respond within one month. We may need to confirm your identity first.
If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk/make-a-complaint, 0303 123 1113) or, if you live in the EU, to your local data protection authority.
Children
This website is intended for adults and healthcare professionals. We do not knowingly collect information from children under 13.
Changes to this notice
We will post any changes on this page and update the date at the top. If a change significantly affects how we use your information, we will tell you where we can.