Privacy & data protection
Privacy Policy
How information provided through this website may be handled.
At a glance
This policy explains how Dr-Hyphen Ltd, trading as Dr Gyles Morrison Consulting (“we”, “us” or “our”), handles personal information collected through drgylesmorrison.com, related enquiries and the Clinical UX Pulse Check. It also explains our intended approach for the Clinical UX Service Finder when that tool is launched.
You can contact us about privacy at info@drgylesmorrison.com. We aim to collect only information necessary to provide the service or respond to the request you make.
Important: Completing a free assessment and requesting its results does not automatically subscribe you to promotional emails. Where we offer optional follow-up or marketing communications, we will explain the choice separately.
Information we collect
The information we receive depends on how you interact with us:
- Website visits: technical data such as IP address, device or browser information, page requests, server logs and information used to diagnose problems or protect the site.
- Contact and speaking enquiries: name, email address, organisation, service interests, event details, availability, optional budget information and the content of your message.
- Meeting bookings: booking details, contact information and responses you enter into Calendly.
- Clinical UX Pulse Check: your assessment answers, calculated scores or profile, recommendations, email address supplied for results and any other optional information you choose to submit.
- Clinical UX Service Finder (when launched): answers describing your organisation's needs, areas of interest, optional comments, resulting support suggestions and the details you choose to supply to receive results or request contact.
- Communications: emails exchanged with us and any record of your preferences about further contact.
Please do not provide identifiable patient information, individual medical histories, confidential clinical records or sensitive personnel information in website forms or assessment responses. Contact us first if you need to discuss a project involving confidential or special-category data.
Why we use information and our lawful bases
We process personal information for specific purposes, applying an appropriate lawful basis under UK GDPR:
- Responding to enquiries and arranging work: to answer questions, discuss a possible engagement or administer an existing service. Depending on the circumstances, this is necessary for steps requested before entering a contract, performance of a contract or our legitimate interest in responding to professional enquiries.
- Providing requested assessment results: to calculate, display and send the Pulse Check profile, and Service Finder suggestions when available. The relevant basis will depend on the assessment delivery arrangement and whether any optional processing is involved; we will identify it in the relevant point-of-collection notice.
- Operating and securing the website: for maintenance, troubleshooting, fraud and misuse prevention, and service reliability, generally under our legitimate interests and, where applicable, legal obligations.
- Record-keeping: to maintain appropriate records of enquiries, services, preferences and legal or regulatory matters where needed for our legitimate interests, contractual purposes or legal obligations.
- Optional follow-up or marketing: only where permitted by applicable data protection and electronic marketing rules. If we ask for consent, you can withhold or withdraw it without losing access to your requested assessment results.
Where we rely on legitimate interests, we consider the purpose, necessity and possible impact on individuals. You can object to processing based on legitimate interests; see “Your rights” below.
Clinical UX Pulse Check
The Clinical UX Pulse Check is an indicative self-assessment of reported Clinical UX practices. It uses answers provided by respondents to calculate a profile and identify potential areas for attention. It is not an independent audit, certification, clinical risk assessment or substitute for professional advice.
When you request results by email, we use the email address for delivery. Assessment responses, profiles and email addresses may be processed together as part of generating and sending results. The precise server-side storage and deletion arrangements are being verified and will be reflected in the applicable notice before any new retention promises are made.
Submitting an assessment does not by itself authorise us to add you to a newsletter or send unsolicited promotional messages. If you separately choose to hear from us about your findings or relevant services, we will record that preference and provide a way to withdraw it. You may also choose to initiate a conversation without agreeing to general marketing.
We may examine trends to understand which topics the assessment highlights and to improve the tool, but any external reporting described as anonymous must first be assessed to ensure individuals and organisations cannot reasonably be identified, including from small samples or combinations of details.
Clinical UX Service Finder (planned)
We are developing a Clinical UX Service Finder intended to help visitors explore which kinds of professional support may fit their circumstances. When launched, it may collect answers about current ways of working, product or service needs, priorities and optional notes, then apply predefined criteria to suggest relevant areas of support.
These suggestions will be indicative. They will not constitute a formal Clinical UX Maturity Assessment, a clinical diagnosis or a binding decision about eligibility for services. Any consulting engagement would be agreed separately.
Before the tool begins collecting identifiable data, we will confirm its data flow, delivery method, lawful bases, retention arrangements and any optional follow-up, and provide clear information at the point of collection. We will not treat completion of the Service Finder as automatic permission for marketing.
Results emails, follow-up and marketing
If you ask us to email assessment results or respond to a question, we may send the message needed to fulfil that request. Such a message is distinct from an ongoing mailing list or promotional campaign.
Where a tool offers an optional checkbox to be contacted about your results or relevant ways we could help, it will be separate from the request for results and will not be preselected. Where we offer newsletter or broader marketing subscriptions, we will present those as a separate choice.
We record communication preferences where necessary to respect them. You can ask us to stop optional follow-up or marketing at any time by contacting info@drgylesmorrison.com or using an unsubscribe mechanism where provided. Applicable electronic marketing rules may differ for corporate and individual subscribers, and we will apply them as appropriate.
Appointment scheduling and Calendly
We use Calendly for appointment scheduling. Depending on how booking is offered, it may open on Calendly's website or within an embedded calendar or pop-up on ours. When you book, information you enter may be handled by Calendly to display availability, create the appointment and send booking-related communications.
Calendly may use cookies or similar technologies in connection with its service. Booking pages and embeds may involve processing by Calendly as described in Calendly's privacy information. The live embed and its cookie behaviour should be checked as part of the website's cookie review.
Service providers, recipients and international transfers
We use external services as needed to operate the website and related tools. These may include our website host (DreamHost), WordPress and installed plugins, email-delivery or mailbox providers, Calendly, and services used to operate the assessments. Relevant providers may access information only as needed for their role and under applicable arrangements; some may act as independent controllers for particular activities.
Some providers may process or access data outside the UK. Where personal information is transferred internationally, we will assess the destination, applicable adequacy arrangements or other lawful safeguards and provide further details on request. A complete list of subprocessors, countries and transfer safeguards has not yet been verified and must be checked against the services actually enabled on the site.
We may also disclose information when required by law, or where necessary to establish, exercise or defend legal claims. We do not publish identifiable assessment submissions as public case studies without an appropriate basis or permission.
How long we keep information
We aim to keep personal information only for as long as it is needed for the purpose for which it was collected, including a reasonable period to deal with enquiries, deliver requested results, administer services, respect communication preferences, manage security or comply with legal obligations.
Different categories may require different periods. For example, assessment delivery records may not need to be retained as long as contractual or accounting records. Our specific schedules for identifiable Pulse Check responses, assessment emails, Service Finder responses, website logs and form submissions are under review; any published period must match the actual deletion and backup procedures.
You can ask us about retention for information relating to you, including whether it can be deleted earlier, subject to applicable exceptions.
Security and confidentiality
We use proportionate technical and organisational measures intended to protect personal information from unauthorised access, misuse or loss. No internet transmission or storage system can be guaranteed to be completely secure. We restrict access according to operational need and review arrangements when introducing new services.
Please do not send confidential patient records or sensitive personal information through ordinary website forms unless an appropriate secure method and data-processing arrangement have been agreed.
Your data protection rights
Subject to the applicable conditions and exemptions, UK data protection law may give you rights to access your information, correct inaccuracies, request erasure, restrict or object to processing, and receive certain information in a portable format. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing.
You have the right to object to direct marketing at any time. You may also object to certain processing based on legitimate interests.
To exercise a right or ask a privacy question, email info@drgylesmorrison.com. You also have the right to complain to the UK's Information Commissioner's Office (ICO).
Assessment calculations and automated suggestions
The Pulse Check uses answers to generate an indicative assessment profile. The planned Service Finder will use responses and defined rules to suggest possible types of support. These tools are designed to provide guidance rather than make decisions that produce legal or similarly significant effects for individuals.
We do not present their outputs as an independent assessment of an organisation's safety, clinical quality or regulatory compliance. You can contact us for more information or a human discussion about a result.
Changes and contact
We may update this policy as our services, technology and legal obligations change. Material changes in how assessment data is used may also require an updated notice at the point of collection.
Privacy contact: info@drgylesmorrison.com or our contact page.
Draft revised: 16 October 2026. This version requires the operational checks listed in the accompanying publication checklist before publication as a final privacy notice.