What this request collects, and what it does not.

What this form collects

• The clinic website, and the clinic name if you give one.
• Three bands: enquiries a month, advertising a month, and who works enquiries today. Bands, not figures.
• Your name, your role, your work email, and your phone number if you give one.

That is the whole of it. There are no other fields, and the server rejects anything it was not asked for.

What it is used for

1. To receive and assess the account review you asked for.
2. To work out whether Vertex and the clinic are a sensible commercial fit.
3. To reply to you and to talk with you about that review.
4. To keep a limited record of the request for the period set out below.
5. To keep the form working: stopping spam and floods, limiting the rate of requests, and catching accidental duplicates.

Nothing else. We normally review requests within two working days.

The lawful basis: legitimate interests

Vertex relies on legitimate interests for all of the above. In plain English: you are a business contact who asked a supplier to look at your clinic, and we need your business and contact details to work out who you are, to do the review and to tell you the answer. Doing that is in Vertex's commercial interest and is what you asked for, so we do not ask you to consent to it separately.

We weighed that interest against your privacy before relying on it. The short version: you gave these details voluntarily, in a professional capacity; only limited business and contact information is collected; no patient or special-category information is requested; there is no automated marketing follow-up; the effect on you is low; and you can object or ask for deletion at any time. The written assessment is LEGITIMATE-INTERESTS-ASSESSMENT.md, kept with this page.

How long it is kept

• The request itself — 12 months from the day it arrives. At that point the record is deleted automatically, unless the clinic has become a client, in which case the business and contact details it needs have already moved into the separate client record and are kept under that record’s own policy.
• Anti-abuse information — 30 days at most. That means the one-way hash of the sending IP address, the country and network the request came from, an automated bot score, and how long the form took to fill in.
• Technical keys — 6 hours or less. The short-lived values that stop the same request being recorded twice, and the counters behind the rate limit.

These periods are set as expiry times on the storage itself, so deletion happens whether or not anyone remembers to do it. The request is not kept on beyond 12 months in case it becomes useful later.

What else is recorded, and why

• The time the request arrived and the page it was sent from, so the record makes sense.
• The anti-abuse information above, only to stop floods and automated abuse. The IP address itself is never stored — only a one-way hash of it, which cannot be turned back into an address.

There is no tracking, no advertising pixel, no analytics and no profiling on this form. No cookie is set. What the browser keeps while you fill the form in stays in the browser.

Who else handles it

• Cloudflare serves this page, runs the code that receives the request, and stores the record in Cloudflare Workers KV.
• Resend delivers the single notification email that tells the Vertex account team a request has arrived.

Both act for Vertex as processors, under contract, and only for the purposes above. Nothing from this form is sold, shared for anyone else’s marketing, or sent to an advertising platform.

Where it is processed, and transfers outside the UK

We would rather be accurate than reassuring, so: this information is not held only in the UK.

• Cloudflare Workers KV replicates data across Cloudflare’s global network. Copies of the intake record may therefore sit on servers outside the UK, including outside the European Economic Area. We do not claim UK-only storage, because it would not be true.
• Resend processes and stores message data in the United States. The notification email, and Resend’s own delivery logs for it, are handled there.

Both transfers are covered by the data processing agreement Vertex has with each provider, which incorporates the standard contractual clauses and the UK International Data Transfer Addendum. Those are the safeguards we rely on for taking this information out of the UK.

Resend also keeps its own service records — message and delivery logs — on its own schedule as part of running the email service. That is separate from, and not governed by, Vertex’s 12-month retention of the intake record described above.

Your rights

• Object. Because we rely on legitimate interests, you can object to this processing. Tell us at privacy@vertexmedic.com and we will stop, unless we have a compelling reason we can show that overrides your objection.
• Ask for deletion. Write to privacy@vertexmedic.com and we will erase the request before the 12 months are up, unless there is a genuine legal reason we have to keep limited information for longer — in which case we will tell you what and why.
• See it, correct it, or take it with you. You can ask what we hold, have it put right if it is wrong, and ask for a copy.
• Complain. If you are in the UK you can complain to the Information Commissioner’s Office, though we would rather you came to us first.

How to reach us about privacy

Write to privacy@vertexmedic.com. Use it for any privacy question, to object to this processing, or to ask us to delete your request. Quote the reference on your receipt and we can find the record straight away. You can also simply reply to any email we send you about the review.