Privacy notice
This notice explains how Front Door collects, uses and shares personal data when you visit this website, contact us, or interact with advertising on the site. It is written for visitors in the United Kingdom and reflects the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Last updated: 6 August 2026.
Who is responsible
The data controller for this website is:
[Registered business name]
Company number: [Company number]
Registered office: [Full UK postal address]
Privacy email: privacy@flushshine.world
For day-to-day questions about this site, use the contact form.
What this site is (and is not)
Front Door publishes general information about NHS administration, charges and patient rights in England. It does not provide medical advice, diagnose conditions or recommend treatment. We do not ask you for clinical details, NHS numbers, medical records or information about your health conditions in order to show you advertising.
Personal data we collect
- Contact form: name, email address, topic and message content, plus the date and time of submission.
- Technical / server logs: IP address, date and time, requested URL, referrer, browser and device type, and approximate location derived from IP where our hosting provider records it.
- Cookie and similar technology data: identifiers and usage information described in our cookie policy, including advertising and measurement identifiers when you consent.
- Advertising interaction data: whether an ad was shown or clicked, rough device and browser information, and conversion or engagement signals used to measure campaigns. This is typically processed by Google on our behalf or as an independent controller for its own advertising services.
We do not intentionally collect special category data (including health data) through this website for advertising or profiling. Please do not include medical details about yourself or anyone else in the contact form.
Why we process personal data (legal bases)
| Purpose | Examples | UK GDPR legal basis |
|---|---|---|
| Reply to enquiries | Contact form messages and follow-up email | Legitimate interests (Art. 6(1)(f)) — responding to people who contact us; and/or consent where you ask us to reply |
| Run and secure the site | Hosting, abuse prevention, debugging, backups | Legitimate interests (Art. 6(1)(f)) — keeping the service available and secure |
| Store or access information on your device | Non-essential cookies, advertising tags, pixels | Consent under PECR before the technology is used; UK GDPR consent (Art. 6(1)(a)) for related personal data processing |
| Show and measure advertising | Google Ads / Google AdSense (or equivalent Google advertising products), frequency capping, conversion measurement, limited ads personalisation where enabled | Consent (Art. 6(1)(a)) for personalised advertising and for advertising cookies / similar technologies; where Google processes data for its own purposes, Google’s terms and privacy notice also apply |
| Improve content | Aggregate reading patterns, broken-link checks | Legitimate interests, or consent where analytics uses non-essential cookies that are not exempt under PECR |
| Legal compliance | Responding to lawful requests, defending claims | Legal obligation (Art. 6(1)(c)) and/or legitimate interests |
Advertising and Google
This site may display ads and measure advertising performance using Google advertising services (for example Google Ads and/or Google AdSense). Depending on your choices, Google and its partners may use cookies or similar technologies to:
- serve ads on this site;
- limit how often you see an ad;
- measure whether ads were shown or clicked;
- where you have consented, help show more relevant ads based on your activity on this site and, where applicable, other sites that use Google advertising services.
Non-essential advertising cookies and similar technologies are not set until you give consent through our cookie controls (or an equivalent consent mechanism). You can withdraw consent at any time — see cookie policy.
Further information from Google:
- Google Privacy Policy
- How Google uses information from sites or apps that use its services
- Google Ads Settings (control personalised ads when signed in to Google)
- Your Online Choices (UK)
We do not sell your personal data. We do not use information from contact-form messages to target Google ads.
Who we share data with
- Hosting and email providers that process data on our instructions to run the site and receive messages.
- Google and advertising partners, where you have consented to advertising cookies / similar technologies, or where strictly necessary for serving contextual ads in line with the tools we use.
- Professional advisers or authorities where required by law or to protect our legal rights.
We do not share contact-form contents with advertisers.
International transfers
Some providers (including Google) may process personal data outside the United Kingdom. Where that happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement / Addendum, adequacy regulations, or other lawful transfer mechanisms used by the provider.
How long we keep data
- Contact form enquiries: usually up to 12 months after the last meaningful reply, unless a longer period is needed for a dispute or legal claim.
- Server logs: typically up to 6 months, unless needed longer for security investigation.
- Cookie consent records: for the period needed to demonstrate compliance (commonly up to 24 months, or as long as our consent tool retains them).
- Advertising identifiers: controlled largely by Google and by your browser / consent choices; see Google’s notices and our cookie table for typical lifetimes.
Your rights
Under UK GDPR you may have the right to:
- access your personal data;
- rectify inaccurate data;
- erase data in certain circumstances;
- restrict or object to processing (including profiling for direct marketing);
- data portability, where processing is based on consent or contract and is automated;
- withdraw consent at any time, without affecting processing that already took place lawfully;
- complain to the Information Commissioner’s Office (ICO).
To exercise rights, email privacy@flushshine.world or use the contact form and mark the message as a privacy request. We may need to verify your identity. We aim to respond within one month.
ICO: ico.org.uk. You can complain to the ICO, but we ask you to contact us first so we can try to resolve the issue.
Children
This site is aimed at adults seeking information about NHS administration in England. We do not knowingly collect personal data from children for advertising purposes. If you believe a child has provided personal data to us, contact us and we will delete it where appropriate.
Cookies and similar technologies
Details of the cookies and similar technologies we use, including advertising cookies, consent requirements under PECR, and how to change your choices, are in the cookie policy.
Changes
We may update this notice when our processing, tools or the law changes. The “Last updated” date at the top will change. Significant changes affecting advertising or cookies will also be reflected in the cookie controls where practical.