Privacy policy

1. Scope and responsibility

This policy applies to the Yarrow website and editorial contact service operated from 14 Elmwood Drive, Birmingham, B29 4AA, United Kingdom. It explains what information may be collected, why it is used and how readers can exercise their rights. Yarrow is an information publisher and does not provide clinical care. Questions about this policy may be sent to the postal address or raised through the contact page.

2. Information collected

Browsing normally creates technical records such as an IP address, browser type, approximate region and pages requested. If a reader contacts Yarrow, we may receive their name, email address, telephone number and the contents of their message. We do not ask readers to submit health records, diagnoses or medication details. Please avoid including sensitive information in a general enquiry.

3. Lawful basis

We use information needed to respond to an enquiry under legitimate interests or steps requested by the person contacting us. Where optional analytics cookies are enabled, processing is based on consent. We may retain records where necessary to comply with a legal obligation or establish, exercise or defend a legal claim. We do not sell personal information.

4. Retention

General contact correspondence is normally retained for 24 months after the last meaningful exchange, then securely deleted or anonymised. Technical security logs may be retained for up to 90 days. Consent records for cookies may be retained for 12 months so that a preference is respected. Longer retention is limited to accounting, legal or dispute records where a defined obligation requires it.

5. Service providers

Yarrow may use hosting, security, email delivery and analytics providers acting under written instructions. Providers receive only the information needed for their service and are expected to apply confidentiality and security controls. We may disclose information where required by UK law, a court or a competent regulator. We do not use personal data to make decisions with legal or similarly significant effects.

6. Cookies

Essential session cookies support basic site operation and normally expire when the browser session ends. The cookie-choice record named cookieChoice may remain for 12 months. If analytics are enabled, an analytics identifier may be retained for up to 13 months and is used in aggregated reporting. The cookies page explains categories, purposes and how browser settings can be used to manage them.

7. International transfers

Some technology providers may process limited information outside the UK. Where this occurs, Yarrow relies on an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses or another lawful safeguard. Readers may ask for more information about the relevant safeguard by writing to the address above. We assess providers before use and review material changes.

8. Security

Access to enquiry information is limited to people who need it for editorial administration. We use access controls, current software, encrypted connections and routine deletion. No online transmission can be guaranteed to be completely secure, so readers should not include unnecessary confidential details. Suspected incidents are assessed and reported where UK law requires notification.

9. Your rights

Subject to legal exceptions, UK residents may request access, correction, deletion, restriction, portability or objection to particular processing. Consent may be withdrawn at any time without affecting earlier lawful processing. To exercise a right, write to Yarrow at 14 Elmwood Drive, Birmingham, B29 4AA, United Kingdom, describing the request and the contact details used. We may ask for proportionate identity confirmation.

10. Complaints

We aim to resolve privacy concerns directly within 30 days where possible. If a reader remains dissatisfied, they may contact the Information Commissioner’s Office through its official UK channels. A complaint can be made without losing any other legal rights. We ask that the individual first gives Yarrow a fair opportunity to investigate the issue and explain the outcome.

11. Children and sensitive information

The site is intended for adults and general readers. We do not knowingly seek information from children and will delete information collected inadvertently when identified. Health information is special category data under UK law, so readers should not send it through general contact forms. If such information is received, it is restricted, assessed and deleted when no longer needed.

12. Changes and contact

This policy was reviewed on 5 October 2026 and applies from that date. Earlier versions may be requested for a reasonable period where required for accountability. Material changes will be reflected on this page with a new review date. For questions, contact Yarrow at 14 Elmwood Drive, Birmingham, B29 4AA, United Kingdom or call 020 7946 0876.

For clarity, this policy should be read alongside the cookie information displayed on this website and any notice shown at the point where information is requested. The website is intended for readers in the United Kingdom, although it may be accessible elsewhere. A visitor is not required to create an account to read ordinary editorial pages. Contact information is used only for the purpose described when it is provided, such as answering an enquiry, considering an editorial suggestion or handling a rights request.

Technical records are kept for up to 30 days for security review and service reliability, unless a longer period is reasonably required to investigate misuse or comply with a legal duty. Correspondence is normally retained for 24 months after the enquiry is closed, then securely deleted or anonymised. A formal rights request and its outcome may be retained for up to six years where needed to demonstrate compliance, with access restricted to people who need it.

Our service providers may include a UK or European hosting provider, an email delivery service and a privacy-compliant analytics provider used only where consent has been recorded. These suppliers act on documented instructions, receive only the information needed for their service and are expected to maintain appropriate confidentiality and security. We do not sell personal information or use contact messages to create advertising audiences.

People may request access, correction, deletion, restriction, portability or objection where the UK GDPR provides that right. Requests should include enough detail to identify the relevant record, but should not include unnecessary sensitive information. We normally acknowledge a request within five working days and provide a substantive response within one calendar month; complex requests may take a further two months where the law permits, and we will explain the reason.

To raise a privacy question, write to Yarrow at 14 Elmwood Drive, Birmingham, B29 4AA, United Kingdom, call 020 7946 0876, or use the contact page. We aim to respond to ordinary privacy enquiries within five working days. If a concern remains unresolved, a person may contact the Information Commissioner's Office through its official UK channels.

This policy was reviewed on 5 October 2026. Yarrow may update it when processing, technology or legal requirements change; the date at the beginning of a future version will identify the current text. Previous versions may be retained for governance purposes, while the version published on this page applies to current processing.

For the purposes of this policy, personal data includes information that identifies a person directly and information that could identify a person when combined with other records. This may include a name, email address, telephone number, message content, IP address, browser details and the date and time of a request. Yarrow does not need sensitive health details to answer an ordinary editorial enquiry, so readers should avoid including them in free-text messages.

The lawful basis for handling a contact message is normally legitimate interest in responding to a request, or consent where a person has clearly opted into a separate communication. Legal obligations may require limited retention of correspondence, security records or rights requests. A person may withdraw consent for future optional processing without affecting processing that took place before withdrawal.

Hosting, email delivery, security monitoring, consent management and privacy-focused analytics may be supplied by carefully selected processors. Processor access is limited by contract and operational need. Where a provider processes information outside the United Kingdom, Yarrow expects an applicable adequacy decision, UK International Data Transfer Agreement, UK Addendum or another lawful safeguard to be used.

Routine enquiries are normally deleted or anonymised 24 months after closure. Consent records may be held for up to 24 months after withdrawal so that Yarrow can demonstrate how a preference was obtained. Backups may retain deleted records for up to 90 days before scheduled overwriting, and records subject to a legal dispute may be retained until the matter is resolved.

A request may be made by post, telephone or through the contact page. Yarrow may ask for proportionate identity confirmation where disclosure to the wrong person would create a privacy risk. Requests are logged with the date received, category, response date and outcome, and are not used to create a marketing profile.

The policy is reviewed at least annually and after a material change in technology or processing. The current review date is 5 October 2026. A future change log will identify the effective date and a short description of the change, while earlier versions may be retained securely for governance.