Privacy Policy

Last updated: May 2026

1. Introduction

This privacy policy explains how Dr Stuart O'Flanagan ("we", "us", "our") collects, uses, and protects personal data in connection with the website drstuartoflanagan.com and the private consultancy practice operating from Blackrock Clinic, Suite 16, Rock Road, Blackrock, Co. Dublin, A94 E4X7.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the ePrivacy Regulations (S.I. 336/2011).

2. Data Controller

The Data Controller for personal data processed via this website and in the course of clinical practice is:

For data protection enquiries, please contact our Practice Manager at the email address above.

3. What personal data we collect

Through this website, we may collect the following categories of personal data:

• Contact form submissions: name, email address, phone number, and the contents of your message.
• Email correspondence: any information you choose to share when contacting us by email.
• Website usage data (via Google Analytics): anonymised information about your visit, including IP address (in truncated form), browser type, device type, pages visited, time spent on pages, and referral source. Analytics cookies are only set with your consent.

In the course of clinical practice (outside this website), we additionally process special category personal data including health information. This is governed by the separate practice privacy notice provided to you at the point of clinical contact.

4. How we use your data (legal basis)

We process personal data on the following lawful bases under Article 6 GDPR:

• Consent (Art. 6(1)(a)): for non-essential cookies and analytics, and for responding to enquiries you submit via the contact form.
• Legitimate interests (Art. 6(1)(f)): for responding to direct email enquiries, for the security and proper functioning of the website, and for keeping records of correspondence.
• Legal obligation (Art. 6(1)(c)): where we are required to retain records under medical, tax, or regulatory law.
• Provision of health care (Art. 9(2)(h)): for the processing of health-related information in the context of clinical care.

5. Cookies and tracking

This website uses cookies to function correctly and to understand how visitors use the site.

Strictly necessary cookies are required for the site to operate and do not require consent.

Analytics cookies are set by Google Analytics and are only loaded if you provide consent via the cookie banner. Google Analytics collects information about how you use the site (pages visited, time spent, device type, approximate location based on truncated IP) to help us improve content. You can withdraw consent at any time by clearing cookies in your browser or via the cookie settings on this site.

Google Analytics data is processed by Google LLC, which may involve transfers to the United States. These transfers are governed by the EU–US Data Privacy Framework and Standard Contractual Clauses.

6. Sharing your data

We do not sell your personal data. We may share data with:

• Our hosting provider (LetsHost.ie): who stores the website and associated form submissions on secure servers based in Ireland.
• Google LLC: for analytics (with your consent), as described above.
• Email service providers: who handle the delivery of email correspondence.
• Regulatory bodies (e.g. Irish Medical Council, Data Protection Commission): where required by law.
• Professional advisers (legal, accounting): where necessary and subject to confidentiality obligations.

We do not share contact form or enquiry data with any third party for marketing purposes.

7. How long we keep your data

• Contact form / email enquiries (non-clinical): retained for up to 2 years from last contact, then deleted.
• Clinical records: retained in accordance with Irish Medical Council guidance — typically a minimum of 8 years for adults, and to age 26 or 8 years (whichever is longer) for minors.
• Analytics data: retained by Google Analytics for 14 months by default.
• Records required for legal or tax purposes: retained for as long as legally required.

8. Your rights

Under GDPR you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the data we hold about you
• Right to rectification — to correct inaccurate data
• Right to erasure — to have your data deleted (subject to legal retention requirements)
• Right to restrict processing
• Right to data portability
• Right to object to processing based on legitimate interests
• Right to withdraw consent at any time, where consent is the lawful basis
• Right to lodge a complaint with the Data Protection Commission

To exercise any of these rights, please contact our Practice Manager at clinic@drstuartoflanagan.com. We will respond within one month.

9. Complaints

If you are unhappy with how your personal data has been handled, you have the right to lodge a complaint with the Irish Data Protection Commission:

10. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. This includes SSL encryption of the website, secure hosting infrastructure, restricted access to data on a need-to-know basis, and regular review of our practices.

11. Children

This website is not directed at children under 16. We do not knowingly collect personal data from children under 16 through the website. Clinical care for minors is provided only with the consent of a parent or guardian and in accordance with separate clinical privacy arrangements.

12. Changes to this policy

We may update this privacy policy from time to time. Any updates will be posted on this page with a revised "Last updated" date. Material changes will be brought to your attention via a notice on the website homepage.