Privacy notice

Thorburn Dean Holdings Ltd (“we”, “us”) is the controller of the personal information described in this notice. We are registered in Scotland, company number SC892517. Registered office: Cornerstone House, Station Road, Selkirk, Scotland, TD7 5DJ. Contact: admin@thorburndean.co.uk.

This is a corporate website for a holding company. It is not a patient or treatment website. For appointments or care questions, please contact the relevant practice directly, and please do not send patient or clinical information to our corporate email address.

This corporate information website uses hosting and security technology to deliver and protect its pages, and remembers your cookie choice. Normally the choice is stored in your browser; in the exceptional case described in section 8 a small necessary cookie is also sent with requests to this site.

Google Analytics loads through Google Tag Manager only on the corporate homepage after your explicit consent. Privacy, terms, other and clinical routes are excluded. No advertising or remarketing tools, session recording, forms, patient processing or logins are added to this website.

• Correspondence — if you email us: your name, email address, organisation, role, and what you tell us in your message and any attachments.
• Technical and security data — when you visit, our hosting provider processes technical data such as IP address, browser type, device information, the page requested and time of the request, in logs used to deliver and protect the site.
• Your cookie choices — normally stored only in your browser. In one exceptional case (section 8) a small necessary cookie is also set, and that cookie is sent with your requests to this site's host.
• Analytics data (with consent) — a homepage page view, a scroll event at 90% of the page, and email-link click intent events when a business email link is clicked in the introduction, contact section or footer. We send a fixed page title and our standard page address, and only the main address of the referring website (for example, https://example.com), not the full link. A click does not prove a lead or an email sent. Google may also collect approximate location, device and browser details and an online identifier stored in cookies.

We do not ask for, and ask you not to send, patient, health or clinical information. We do not use user IDs, session recordings, freeform capture, search terms, query strings, URL fragments or campaign identifiers in analytics events.

• Responding to business enquiries and managing business relationships — legitimate interests: our interest in answering professional, advisory and supplier enquiries, keeping records of discussions and running our business. Where you personally are a party to a contract with us, or asked us to take steps before entering one, the lawful basis is contract.
• Keeping the website and email secure — legitimate interests: our interest in preventing abuse, fraud and attacks and keeping services available.
• Meeting legal duties — legal obligation, for example company, tax and accounting records, or responding to lawful requests.
• Establishing or defending legal claims — legitimate interests.
• Optional analytics — consent.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

• Lovable and Cloudflare — website hosting, delivery and security. In use. Lovable privacy policy; Cloudflare privacy policy.
• Google Workspace — business email. In use. Google privacy policy.
• Google Tag Manager and Google Analytics — only on the corporate homepage with consent. Google business data information.
• Professional advisers, and authorities where the law requires it.

We do not sell personal information.

Our hosting, email and analytics providers may process information outside the UK, including in the United States. Google's published terms describe transfer safeguards, including standard contractual clauses and, where applicable, the UK Extension to the EU–US Data Privacy Framework. See Google's international transfer information and Workspace terms. Lovable's privacy policy describes use of the UK International Data Transfer Addendum. We are continuing to review how Lovable's processing terms apply to our Pro hosting arrangement. Contact admin@thorburndean.co.uk for the information available about these arrangements and how to obtain copies of relevant safeguards.

• Correspondence — for as long as needed to deal with the enquiry and any continuing relationship, then deleted or reviewed unless we need it for records or legal claims.
• Business and legal records — for as long as company, tax or other law requires.
• Hosting and security logs — Lovable's published policy says information is kept as long as needed to operate and secure its service, and longer for incident investigation. It does not specify a fixed period for this site's logs; we have not independently verified Cloudflare log retention.
• Cookie choice — 180 days, normally kept only in your browser; the exceptional withdrawal cookie described in section 8 is sent to this site's host with your requests. After expiry you are asked again. You can change or clear your choice at any time.
• Analytics data — Google Analytics is set to retain event-level data for 2 months and user-level data for 14 months. New activity restarts the 14-month user-data period, so it can last longer for returning visitors. These settings do not limit how long aggregated reports are kept and are separate from cookie lifetimes. Google's documentation.

The site is not cookie-free. Necessary storage is always on. Optional analytics needs your consent and is off by default. Normally, if you withdraw consent, we immediately stop sending new optional events, remove the relevant cookies that the site itself can reach, and reload the page. We cannot remove third-party or browser-protected cookies. If the browser cannot save your withdrawal, optional events stop on the current page, but an earlier choice may be restored on a later visit. Tools already loaded may stay in an open tab until it closes. We show a message asking you to clear this site's data, reject optional analytics and close the tab.

Depending on the circumstances, you have the right to:

• object to processing based on legitimate interests, and to direct marketing;
• withdraw consent at any time, without affecting earlier processing;
• access your personal information;
• have inaccurate information corrected;
• have information erased;
• restrict how we use it;
• data portability, where it applies.

To use any of these rights, email admin@thorburndean.co.uk. We may need to confirm your identity.

You can complain to the Information Commissioner’s Office (ICO) at any time. You do not need to contact us first, though we would welcome the chance to help. ico.org.uk/make-a-complaint, telephone 0303 123 1113.

We will update this notice when our practices change. The revision date is shown at the top.

Return to the homepage