Who we are

Maynooth Medical Centre is the data controller for the personal information described here. This notice covers this website only. It does not cover the care you receive at the practice, which is described in the practice’s own patient information.

Main Street, Maynooth, Co. Kildare, W23 E6P4
Above McCormack's Pharmacy

Questions about this notice, or about information we hold: reception@maynoothmedical.com, or telephone (01) 629 2556.

What this website does not do

We think it is clearer to start with what is absent, because it is unusual:

• The site sets no cookies that require your consent, which is why you are not asked to dismiss a banner.
• There are no advertising or social-media trackers. No Meta pixel, no Google Analytics, no advertising network of any kind.
• Fonts and scripts are served from this website rather than from a third party, so simply reading a page does not tell any other company that you visited us.
• Where we embed something from another service, such as a map, it does not load until you click it. Until then nothing is requested from that service and it learns nothing about you.
• Your medical records are not held on this website — they are held in the practice’s clinical system (Socrates).

Forms you fill in

If you fill in a form on this website, what you type is sent to the practice. Depending on the form that may include your name, date of birth, address, telephone number, email address, and clinical details relevant to the request — for example the medicines you are asking to be reissued, or a consent and the information needed to act on it.

The forms currently on this website are:

• Child Flu Vaccine
• New patient form

Lawful basis. Where a form is part of your care, we process it to provide healthcare (UK/EU GDPR Article 6(1)(e) and Article 9(2)(h)). Where a form asks for your consent to something specific, such as a vaccination, consent is recorded as part of that care and you may withdraw it by contacting the practice.

How long it stays on the website: minutes, not years. A submission is held on this website only until the practice’s own systems confirm they have received it, and is then deleted from the website. If the practice’s systems are temporarily unreachable it waits here until they are, so that your request is never lost. Once delivered, the website keeps no copy. How long the practice then keeps it is governed by the practice’s own retention policy for patient records in Socrates, not by this website.

Forms are protected against automated abuse by limiting how often the same visitor may submit. This uses no cookie and no third-party service.

Measuring how the website is used

We count how the website is used, so the practice can see whether it is useful and find the places where people get stuck. We do this ourselves, on this website, without sending anything to an analytics company.

We record, for each page view: the page, and whether you arrived from another website. Where you arrived from another website we keep only its address — google.com, for example — and never the full link or anything you searched for.

We also record progress through a form: that one was started, that it was submitted, and if it failed validation, which field failed. We never record what you typed into any field.

How you are counted. So that one person reading four pages is not counted as four people, each view carries a short code derived from your IP address and browser type combined with a secret unique to this website. The code cannot be turned back into your IP address, and your IP address itself is never stored. Nothing is stored on your device, so this does not require your consent and there is nothing for you to clear.

How long. Individual records are deleted after 90 days. Before they are deleted they are added into daily totals — how many visitors, which pages, how many completed each form — and those totals, which are not about any individual, are kept.

Our basis for this is legitimate interests: understanding whether a service the practice provides is working. We have kept it to the minimum that answers that question.

Staff accounts

People who edit this website sign in with a work account. We record the sign-in attempt, whether it succeeded, and for a failure the account name and the reason, so that somebody locked out can be helped. This concerns staff, not patients.

Where your information is held

Form submissions are delivered into the practice’s own Microsoft 365 tenant, hosted by Microsoft in the European Union. This website is hosted in the European Union. The service that carries submissions between the two runs in Microsoft’s Ireland region. Nothing described in this notice is stored outside the European Economic Area.

Microsoft acts as a processor for the practice under its own data protection terms. The agency that builds and maintains this website also acts as a processor, under a written agreement with the practice.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict its use. Write to reception@maynoothmedical.com. We will respond within one month.

Two honest limits. Information you submitted through a form has usually moved into the practice’s own systems within minutes, so a request about it is a request to the practice rather than about this website. And the website measurements described above are not linked to your name, so we cannot single out your records in them — which is the point of collecting them that way.

If you are unhappy with how we have handled your information you can complain to the Data Protection Commission, dataprotection.ie.

Changes to this notice

The parts of this notice that describe what the website does are generated from how it is actually configured, so they change when the website changes.