Privacy Policy

Introduction

CleftInject (“we”, “us”, “our”) is a non-profit organisation that operates the website cleftinject.org. We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and share your information when you use our website and services.

Information We Collect

We may collect the following types of information depending on how you interact with our website:

• Specialist registration data: Name, email address, practice details, qualifications, and other profile information provided during the registration process.
• Waiting list submissions: Name, email address, location, and any additional notes you choose to provide.
• Review submissions: Your name, email address, and the content of your review.
• Contact form enquiries: Name, email address, and message content.
• Usage data: Information about how you access and use our website, including IP address, browser type, pages visited, and referring URLs.

How We Use Your Information

We use the information we collect for the following purposes:

• To operate, maintain, and improve the CleftInject specialist directory.
• To process specialist registrations and manage user accounts.
• To verify and publish reviews submitted about listed specialists.
• To manage the waiting list for free treatment opportunities.
• To respond to your enquiries and provide support.
• To send transactional emails such as registration codes, review verification links, and account notifications.
• To monitor website usage and improve the user experience.

Data Sharing

We do not sell, rent, or trade your personal information. We may share data with trusted third-party service providers who assist us in operating our website (such as hosting, email delivery, and analytics), but only to the extent necessary for them to perform their services. All third parties are required to handle your data in accordance with applicable data protection laws.

Specialist profile information (name, practice details, qualifications) is displayed publicly on the directory as part of the core service.

Your Rights (GDPR)

If you are located in the United Kingdom or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR) and the UK GDPR:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct any inaccurate or incomplete data.
• Right to erasure: You may request that we delete your personal data, subject to certain legal exceptions.
• Right to restrict processing: You may request that we limit how we use your data.
• Right to data portability: You may request a copy of your data in a commonly used, machine-readable format.
• Right to object: You may object to processing of your personal data in certain circumstances.
• Right to complain:You have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would, however, appreciate the chance to address your concerns first.

To exercise any of these rights, please contact us at hello@cleftinject.org. We aim to respond within one month, as required by law.

Lawful Basis for Processing

Under the UK GDPR, we rely on the following lawful bases:

• Consent — for joining the free-treatment waiting list and for submitting a review. You may withdraw consent at any time by contacting us.
• Performance of a contract — for creating and managing a specialist account and listing.
• Legitimate interests — for keeping the directory accurate, preventing abuse and fraud, and maintaining the security of the service (including limited security and moderation logs).

International Data Transfers

We use trusted service providers to operate the site, some of which process data outside the UK (including in the United States): our hosting provider (Vercel), email provider (Postmark), payment processor for the Featured tier (Stripe), and mapping provider (Google Maps). Where data is transferred outside the UK, it is protected by appropriate safeguards such as the UK extension to the EU–US Data Privacy Framework or the International Data Transfer Agreement / Standard Contractual Clauses.

Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law:

• Specialist account data — for the lifetime of the account, and deleted when the account is closed or on request.
• Reviews— published reviews are retained while the specialist’s listing is active; unverified reviews are automatically deleted after 48 hours.
• Waiting list entries — retained for up to 24 months, or until you ask us to remove them, after which they are deleted.
• Security and moderation logs — retained for up to 24 months.

Cookies

Our website uses cookies to ensure essential functionality and to help us understand how the site is used. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

Data Controller & Contact

The data controller responsible for your personal data is CleftInject, a non-profit organisation. If you have any questions about this Privacy Policy or how we handle your data, or to exercise your rights, please contact us at:

CleftInject
Email: hello@cleftinject.org