Privacy Policy
Last updated: 21 September 2026
HospitalGuide.org.uk is operated by Innovations and More Ltd (company number 11350220), whose registered office is 128 City Road, London, England, EC1V 2NX.
For privacy questions, account deletion requests, or other data protection matters, email admin@innovationsandmore.com.
This policy describes the personal information this website actually collects and how it is used. It is not a claim of third-party certification or of legal compliance.
Who is responsible
Innovations and More Ltd is responsible for personal information processed through this website.
What this website collects
Browsing without an account
You can read experiences and submit an experience without creating an account. When you visit a page, the website starts a PHP session so that security tokens for forms can work. That session is stored in a cookie in your browser. See the Cookie Policy.
Like most websites, the hosting infrastructure and web server may log basic technical information, which can include IP addresses, as part of normal operation. We do not control those hosting-level logs and we do not set a retention period for them.
Experience submissions
When you share an experience, we store the text you write, the hospital and category you select, and any optional fields you choose to complete (for example speciality, a related web link, or a photo). You may optionally leave a name and email address for moderators only. Those contact details are not shown on public pages.
If you are logged in when you submit, the submission is linked to your account so you can see its moderation status. That link is not shown on public pages. If you are not logged in, the submission is not linked to an account.
Approved submissions are published on this website. Rejected or pending submissions are not shown on public pages. Photos and links submitted with an experience are only shown on the public experience page after the experience is approved.
Rate limiting
To reduce spam, the website stores a one-way salted hash of your IP address with submissions and with login, registration, and password-reset attempts. That hash cannot be reversed by the application to recover your IP address. It is not displayed publicly and is not attached to published experiences as an identifier for other visitors.
The application does not currently delete these hashed rate-limit records on a fixed schedule.
Reports
If you report a published experience, we store the reason you give and which experience it relates to, so a moderator can review it.
Optional accounts
If you create an account, we store your name, email address, and a hashed password — never the password itself. An account is only used to save favourite hospitals and to show you the status of submissions linked to that account. Account details are not shown on public pages and are not shown alongside published experiences.
There is no self-service account deletion button. To ask us to delete your account, email admin@innovationsandmore.com. If an account is deleted, experiences already submitted remain in the record as they are, with no link back to an account.
Password reset
If you request a password reset, we store a hashed reset token with an expiry time and send a message to the email address on the account using the server’s built-in mail function. We do not use a separate named email marketing or transactional-email product in the application code.
Photos
If you attach a photo to an experience, the file is stored on the web server and associated with that experience. Do not upload patient-identifiable images or other confidential information.
How information is used
- To operate Hospital Guide: publish moderated experiences, hospital pages, and related content
- To moderate submissions and reports
- To run optional accounts, favourites, and password reset
- To apply simple rate limits against spam and abuse
- To respond if you contact us
We do not sell personal information. The application does not include advertising, payment processing, or analytics products.
Cookies
The application sets a session cookie that is needed for the site to work (form security and, if you log in, keeping you signed in). It does not set analytics or advertising cookies. Details are in the Cookie Policy.
Third parties
The website is hosted by a third-party web hosting provider. That provider’s infrastructure may process technical logs and store the website’s files and database. We have not independently mapped every location of that provider’s servers or backups, so we do not state that transfers outside the UK do or do not occur.
Password-reset messages are sent using the hosting server’s mail function. Delivery can involve the recipient’s email provider.
If you include a link in an experience, that link points to a website we do not operate. Those other websites have their own practices.
This application does not integrate a payment provider, analytics service, advertising network, or social-media tracking pixel.
Retention
We have not set automated deletion periods in the application for the following, except where noted:
- Published experiences, including optional photos and links, remain until a moderator deletes them or we agree to remove them after a valid request
- Optional moderator-only name and email on a submission remain with that submission until it is deleted or we remove those details after a request
- Account records remain until we delete the account after a request
- Favourite hospitals remain until you remove them or the account is deleted
- Password-reset tokens are marked used after a successful reset and are set to expire after one hour for use, but unused or used rows are not automatically purged by the application
- Hashed rate-limit records are not automatically purged by the application
- Reports remain until handled in the admin tools
Hosting-level logs, if any, follow the hosting provider’s own practices, which we do not set in this application.
Security
Passwords are stored as hashes. Sessions use HTTP-only cookies with a SameSite restriction. Forms use a CSRF token. Uploaded images are type-checked and stored outside direct script execution. This is a description of measures in the code. It is not a guarantee against unauthorised access, and this website has not undergone an independent security certification.
Your privacy rights
Depending on your circumstances, UK data protection law may give you rights including access to personal information we hold about you, correction of inaccurate information, erasure, restriction of processing, and objection. You may also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your information has been handled.
To exercise a right or raise a privacy concern, email admin@innovationsandmore.com. We may need to ask you for enough information to identify the relevant records. Public experiences are designed to be anonymous; if you did not leave contact details or an account, we may not be able to match a request to a particular submission.
Children and patient information
This website is intended for doctors sharing workplace information. Do not submit information that identifies patients or other individuals who have not agreed to be identified.
Changes
If this policy changes, we will update this page. The date at the top will change when we do.
Contact
Innovations and More Ltd
Company number 11350220
128 City Road, London, England, EC1V 2NX
admin@innovationsandmore.com