1. Scope and Controller

This policy explains how Bralven Health Ltd handles information when you visit bralven.site, contact the editorial desk or subscribe to updates. The data controller is Bralven Health Ltd, 78 Colmore Row, Birmingham B1 1AA, United Kingdom. Questions or data rights requests can be sent to [email protected].

2. Information Received and Data Minimisation

We collect only the information necessary to operate the publication, respond to correspondence, manage newsletter subscriptions, and maintain site security. This may include:

  • Newsletter subscribers: Email address and consent timestamp.
  • Contact correspondence: Name, email address, subject and message content.
  • Technical data: IP address, browser type, operating system, requested URL, and access timestamps in standard security logs.

We do not collect special category data or ask readers to submit sensitive medical or financial information through website forms.

3. Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), our lawful bases for processing personal data include:

  • Consent: For newsletter delivery and non-essential cookie storage (which you may withdraw at any time).
  • Legitimate Interests: For responding to editorial enquiries, investigating reported errors, maintaining site security, and preventing abusive activity.
  • Legal Obligation: Where compliance with UK statutory requirements is necessary.

4. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Newsletter records: Retained until you unsubscribe, then permanently removed within 30 days.
  • Contact correspondence: Retained for up to 24 months after ticket closure for audit and reference purposes.
  • Server security logs: Retained for up to 90 days before automated rotation and deletion.

5. Your Rights Under UK GDPR

Under UK data protection law, you have specific rights regarding your personal data, including the right to:

  • Request access to the personal data we hold about you (Subject Access Request).
  • Request correction of inaccurate or incomplete information.
  • Request erasure of your personal data where there is no good reason for us to continue processing it.
  • Object to processing where we rely on legitimate interests.
  • Request restriction of processing under certain circumstances.
  • Request transfer of your personal data to another party (data portability).
  • Withdraw consent at any time for consent-based processing.

To exercise any of these rights, please email [email protected]. We aim to respond within one calendar month.

6. Processors and Third-Party Services

We work with trusted third-party providers who process data strictly under written contractual terms in compliance with UK data protection laws. These service providers include:

  • Website hosting and secure infrastructure providers.
  • Email delivery and newsletter dispatch services.
  • Map embedding providers (e.g., Google Maps on the contact page, subject to reader consent).

7. International Data Transfers

Where third-party service providers process data outside the United Kingdom, we ensure appropriate safeguards are in place, such as UK Adequacy Regulations or the UK International Data Transfer Addendum (IDTA) to standard contractual clauses.

8. Security Measures

We implement technical and organizational security measures to safeguard information against accidental loss, unauthorized access, alteration, or disclosure. This includes SSL/TLS encryption in transit, strict access control, and regular security reviews.

9. Personal Data Breach Handling

If Bralven becomes aware of a personal data breach, we will contain the incident, investigate the root cause, and assess risks to individuals. Where required by UK GDPR, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a reportable incident and inform affected individuals without undue delay.

10. Minors and Automated Decisions

This publication is intended for a general adult audience (40+) and does not knowingly collect data from children under 16. Bralven does not conduct automated decision-making or profiling that produces legal or significant effects.

11. Complaints and Regulatory Authority

If you have any concerns regarding how we handle your personal data, please contact us first at [email protected] so we can investigate and address the issue promptly. You also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk.

12. Changes and Policy Review

We review this Privacy Policy annually. The current edition was published on 9 September 2026. Material revisions will be posted on this page with an updated revision date.