Privacy Policy
Effective date: 1 June 2026. Data controller: Dr Oluwatosin Taiwo / Olympus Premium Health Limited.
1. Who We Are
ShorterWait is a service operated by Olympus Premium Health Limited, registered in England and Wales (Company No. 13621708), registered address 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE.
The Data Controller for personal data processed through ShorterWait is Dr Oluwatosin Taiwo, a practising NHS GP and Director of Olympus Premium Health Limited. Dr Oluwatosin Taiwo is registered with the Information Commissioner's Office (ICO) under registration number ZC143531.
For any data protection queries, please contact our Data Protection contact at tosin@op-health.co.
2. Data We Collect and Why
We collect only the data necessary to provide the Service.
A. Data you provide voluntarily
| Category | Detail |
|---|---|
| Account email & password | To create and authenticate your account (lawful basis: contract, Art. 6(1)(b) UK GDPR) |
| Payment details | Collected by Stripe during Switch Pack purchase. We never see or store your card number (lawful basis: contract, Art. 6(1)(b)) |
| GP waitlist email | If you join the GP Practice Dashboard waitlist, we store your email to notify you at launch (lawful basis: legitimate interests, Art. 6(1)(f)); you may unsubscribe at any time |
| Alert preferences | Specialty and region you select for 90-day email alerts, included in the Switch Pack (lawful basis: contract, Art. 6(1)(b)) |
B. Data collected automatically
| Category | Detail |
|---|---|
| Session cookies (Supabase) | Set upon login to keep you authenticated. Expires when you close your browser or log out. Required for account access only. |
| __cf_bm (Cloudflare) | Set by Cloudflare for bot management and security. Expires after 30 minutes. Required to protect the site from automated abuse. No personal data is shared with Cloudflare beyond what is necessary for this security function. |
| Server logs | Standard web server logs (IP address, timestamp, page visited) retained for up to 30 days for security and debugging purposes (lawful basis: legitimate interests, Art. 6(1)(f)) |
| Postcode search input | The postcode and specialty you enter in the search form are used solely to return results and are not stored against your identity |
| Aggregate analytics (Plausible) | We use Plausible Analytics, which records page views and referral sources with no cookies, no personal data, and no cross-site tracking. Data is aggregated and anonymised. See plausible.io/privacy for details. |
C. Data we do NOT collect
- We do not collect your NHS number, date of birth, or any clinical information.
- We do not collect advertising tracking data or sell data to third parties.
- We do not use third-party advertising cookies.
3. Cookies
We use the minimum necessary cookies:
| Category | Detail |
|---|---|
| sb-session (Supabase auth) | Strictly necessary. Keeps you logged in; session-scoped |
| sb-refresh-token | Strictly necessary. Refreshes your session; expires after 7 days of inactivity |
We do not use Google Analytics, Facebook Pixel, or any third-party tracking cookies. Because we use only strictly necessary cookies, we are not required to display a cookie consent banner under the UK Privacy and Electronic Communications Regulations (PECR), but we disclose this information here in the interest of transparency.
4. How We Use Your Data
- To provide and operate the ShorterWait service;
- To process your Switch Pack purchase and deliver the download;
- To send you waiting-time email alerts you have subscribed to;
- To notify GP Practice Dashboard waitlist registrants at launch;
- To maintain security, detect fraud, and debug technical issues; and
- To comply with our legal obligations.
We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
5. Third-Party Processors
We use the following sub-processors, each bound by appropriate data processing agreements and GDPR-compliant terms:
| Category | Detail |
|---|---|
| Supabase Inc. | Database and authentication hosting (EU region); stores account data and alert preferences |
| Stripe Payments Europe, Ltd. | Payment processing for Switch Pack and ADHD Switch Pack purchases; subject to Stripe's own Privacy Policy |
| Cloudflare, Inc. | Content delivery network, DDoS protection, and bot management. Cloudflare processes request data (IP address, headers) for security purposes. Data Processing Addendum in place. |
| Resend Inc. | Transactional email delivery (purchase confirmations, weekly wait-time alerts). Email addresses and alert preferences are transmitted to Resend solely for delivery purposes. |
| Plausible Analytics | Cookie-free, anonymised page view analytics. No personal data is collected or transmitted. Data is processed within the EU. |
| GitHub, Inc. | Source code hosting; does not process end-user personal data |
We do not transfer your personal data outside the UK or EEA except where a processor operates under Standard Contractual Clauses or an equivalent adequacy mechanism approved under UK GDPR.
6. Data Retention
| Category | Detail |
|---|---|
| Account data | Retained while your account is active; deleted within 30 days of account closure upon your request |
| Alert preferences | Deleted automatically 90 days after Switch Pack purchase, or on unsubscribe |
| Waitlist emails | Retained until the GP Dashboard launches or you unsubscribe, whichever is earlier |
| Server logs | Automatically purged after 30 days |
| Stripe payment records | Retained for 7 years in line with UK financial record-keeping obligations (this data is held by Stripe) |
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data. To exercise any of them, contact us at tosin@op-health.co. We will respond within 30 days.
| Category | Detail |
|---|---|
| Right of access | Receive a copy of all personal data we hold about you |
| Right to rectification | Have inaccurate data corrected |
| Right to erasure | Request deletion of your data (subject to legal retention obligations) |
| Right to restriction | Ask us to restrict processing while a dispute is resolved |
| Right to data portability | Receive your data in a structured, machine-readable format |
| Right to object | Object to processing based on legitimate interests (e.g. marketing emails) |
| Right to withdraw consent | Where processing is consent-based, withdraw at any time without affecting prior lawfulness |
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
8. NHS Data and Open Government Licence
Waiting-time data displayed by ShorterWait is Crown Copyright, sourced from NHS England's "My Planned Care" dataset and used under the Open Government Licence v3.0 (OGL). This data relates to NHS trusts and independent sector providers. It does not contain any personal data about patients or staff.
OGL licence details: nationalarchives.gov.uk/doc/open-government-licence/version/3/
9. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS 1.2+) and at rest;
- Row-level security on our database, ensuring each user can access only their own data;
- Access controls limiting database access to authorised personnel only; and
- Regular review of third-party processor security posture.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
10. Children
The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with their data, please contact us at tosin@op-health.co and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified to registered users by email at least 14 days before they take effect. The effective date at the top of this page will always reflect the most recent version.
12. Contact Us
Data Controller
Dr Oluwatosin Taiwo
Olympus Premium Health Limited (Co. No. 13621708)
82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE
ICO Registration: ZC143531
General enquiries: tosin@op-health.co
Data protection requests: tosin@op-health.co