Privacy Policy

Last updated: 30 September 2026

This policy explains how Consents.org.uk handles personal information. It describes what the website does at the date above.

Who we are

Consents.org.uk is operated by Innovations and More Ltd (company number 11350220), registered office 128 City Road, London, England, EC1V 2NX. Innovations and More Ltd is the controller of the personal information described in this policy. You can contact us at admin@innovationsandmore.com.

What this website does

The website gives general information about surgical operations and lets you choose concerns and questions to prepare for a conversation with your healthcare team. Patients and other visitors do not need an account. The website does not ask them for their name, email address, date of birth, NHS number or other identifying details.

Information you may enter

Your choices. The risks or concerns and the suggested questions you tick.
Your own questions. A free-text box. The website does not ask for personal details, but you can type anything into it, so it could contain personal or health information if you choose to write it. Please do not include your name, contact details, NHS number or details of your own medical history.

When you choose “View my summary”, your choices and text are sent to our server to build the summary page shown to you. We do not save that summary. Printing happens in your own browser.

Shareable summaries

Only if you choose to create a shareable summary, we store: the operation, the risks and suggested questions you ticked, the text of your own questions, and the dates the summary was created and expires. We do not store your name, email address or IP address with it.

The link contains a long random code. Only a one-way scrambled version (a hash) of that code is stored, so the database does not hold usable links.

Anyone who has the link can open the summary until it expires, and we cannot tell who has it. Share it only with people you trust, and avoid personal details in your questions.

Expiry and deletion. A shared summary expires 14 days after it is created and can then no longer be opened. Expired summaries are permanently deleted from the database automatically, the next time the website creates or opens a shared summary.

To have a summary removed earlier, email us the link. Because summaries carry no identifying details, we cannot find one without its link.

Server and security information

The website does not use analytics and does not track visitors. Its database does not record visitor IP addresses, except for failed administrator sign-ins and surgeon sign-in or registration attempts (see below); patient access attempts are stored only as a one-way hash of the IP address (see below). As with any website, the hosting provider's servers receive your IP address and browser details when you load a page, and the hosting provider may keep standard technical logs to run and secure its service. We do not use these to profile visitors. The website may write technical error messages to the server's error log; these are not intended to contain personal information.

Administrator information

The administration area is for authorised site administrators only, not for patients. For each administrator account we store a username, a password held only in scrambled (hashed) form, and the date the account was created. When a sign-in fails, we record the IP address, the username entered and the time, to block repeated guessing. These records are kept for about one day and then deleted automatically. Signing in uses an essential cookie (see the Cookie Policy).

Surgeon accounts and subscriptions

Surgeons can create an account and subscribe to Consents Professional. For each surgeon account we store your name, your email address, your password (in scrambled, hashed form only), and subscription details: Stripe customer and subscription reference numbers, the subscription status, billing period dates, and your Surgeon Access Code (described in the next section). We use this to run your account and subscription. Your card details are entered on Stripe's own pages and are never seen or stored by us. When a sign-in or registration is attempted we record the IP address, the email address entered and the time, to block repeated guessing; these records are kept for about one day. To close your account, email us.

Surgeon Access Codes and patient access

Each subscribed surgeon has one 4-character Surgeon Access Code, which they can give to any number of patients. A patient enters only this code on the patient access page. No name, email address or other detail is asked for or stored, and there are no patient accounts. This website does not send any email.

We store the code in two forms: a keyed one-way hash, used to check the code a patient enters, and an encrypted copy, so that the surgeon can see their own code in their dashboard. We also store when the code was created and last changed. We do not record which patient used a code, or how often. The code a patient types is used only to check it and is not saved. Failed patient access attempts are recorded only as a one-way hash of the IP address and the time, for about one day, to block guessing. We do not store patients' names, dates of birth, NHS numbers or any clinical information in this system. A code works only while the surgeon's subscription is active, and stops working if the surgeon regenerates it.

Cookies

The website does not use analytics, advertising, tracking or third-party cookies. Visitors to the information pages receive no cookies. Administrators, surgeons, and patients who enter an access code receive an essential sign-in cookie. Details are in the Cookie Policy.

Where information is stored and how it is protected

The website files and database are hosted with Hostinger, which provides the servers on our behalf. The website is served over HTTPS. Administrator passwords are stored hashed, the administration area requires sign-in, repeated failed sign-ins are blocked, and shared links are random. No internet service can be guaranteed completely secure.

Who we share information with

We do not sell personal information and do not use analytics, advertising or tracking services or embedded third-party content. Our hosting provider stores and processes information as our service provider. Stripe processes payments for surgeon subscriptions under its own privacy policy (stripe.com/privacy). We may disclose information if the law requires it.

How long we keep information

Summaries you view or print: not stored by us.
Shareable summaries: 14 days, then deleted as described above.
Failed administrator sign-in records and surgeon sign-in or registration attempt records: about one day.
Surgeon Access Codes: while the surgeon's account is open (replaced if the surgeon regenerates the code).
Failed patient access attempts (a one-way hash of the IP address only): about one day.
Surgeon accounts and subscription records: while the account is open. Billing records may be kept for as long as accounting and legal rules require.
Administrator accounts: until they are removed.
Hosting logs and backups: kept by the hosting provider under its own schedule.

Why we use information

Shareable summaries: because you ask us to create the link. You choose what to include.
Surgeon accounts and subscriptions: to provide the service you sign up for.
Surgeon Access Codes: to let patients use the website as arranged by their surgeon.
Administrator accounts and sign-in protection: our legitimate interest in keeping the website and its content secure.

Your rights

Under UK data protection law you may ask for access to your personal information, and ask us to correct it, delete it, restrict its use or stop using it, where the law applies. Email admin@innovationsandmore.com. If you are not satisfied with our response, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We may update this policy if the website changes. The date at the top shows when it was last updated.