Privacy Policy
Welcome to the privacy policy page for Rehab Online. Here, we outline how we collect, use, and safeguard your personal information while you engage with our website and services.
Our aim is to be open and transparent about the details we handle, ensuring you have a clear understanding of how your privacy is respected and protected. Whether you’re browsing our directory for support or seeking information, this policy will provide you with all the necessary details about how your data is managed responsibly.
Privacy Policy
Last updated: 14 May 2026
This policy explains how we collect, use, and protect personal data when you use rehab-online.org.uk. It should be read alongside our .
1. Who we are
This website is operated by CR Pathways CIC, a Community Interest Company registered in England and Wales (company number 16426629) with its registered office at 16 Ullswater Road, Kettering, England, NN16 8UD (“we”, “us”, “our”). We are the data controller for the personal data we collect through this website.
Contact us at for any questions about this policy or your personal data.
2. What this site does
Rehab-Online is an information directory that helps people in the UK find drug and alcohol rehabilitation services. We provide information about treatment providers, but we are not a treatment provider ourselves and we do not refer your details to third-party rehab centres.
3. What personal data we collect
We collect the minimum data needed to operate the site and respond to enquiries:
a) Information you give us through the contact form
- Your name
- Your email address
- Any message or details you choose to share with us
We understand that messages may include sensitive information about addiction, mental health, or someone close to you. We treat all enquiries as confidential. See section 5 for the lawful basis we rely on to handle this kind of information.
b) Information collected automatically
- A session cookie (
PHPSESSID) that the site needs to function - If you accept analytics, anonymised usage data via Google Analytics 4 — pages viewed, approximate location (city-level only), device type, and how you found the site
- Server logs containing your IP address, browser, and the pages you requested — kept for up to 30 days for security and troubleshooting
4. How we use your data
| What we do | Why | Lawful basis |
|---|---|---|
| Reply to your enquiry | So we can help with your question | Consent (you contacted us) / Legitimate interests |
| Handle sensitive details you share in an enquiry | To respond to the help you asked for | Explicit consent — by submitting the form, you are asking us to use the information you’ve shared |
| Run Google Analytics | To understand which pages help visitors and improve the site | Consent (via the cookie banner) |
| Keep server logs | Security, debugging, and protecting the site against abuse | Legitimate interests |
| Comply with legal obligations | E.g. responding to lawful requests from authorities | Legal obligation |
We do not: sell your data, share it with rehab providers, use it for marketing, profile you, or make automated decisions about you.
5. Sensitive (special category) data
Information about health — including substance use, mental health, and treatment history — is “special category” data under UK GDPR Article 9, and is given extra protection.
If you choose to include this kind of information in a message to us, we rely on your explicit consent (Article 9(2)(a)) to handle it. You give that consent by submitting the form. You can withdraw it at any time by emailing — we will then delete the message.
You don’t have to share sensitive details to use the site or get a reply from us. Share only what you’re comfortable with.
6. Who we share data with
We share data only with service providers that help us operate the site. They process data on our instructions and cannot use it for their own purposes.
| Provider | What they do | Where data is processed |
|---|---|---|
| Our WordPress hosting provider | Stores the website and your form submissions | UK / EEA |
| Google Workspace (Google Ireland Limited) | Delivers enquiry emails to us and our replies to you | EU, with onward transfers to the US under the EU-US Data Privacy Framework |
| Google Ireland Limited (Google Analytics) | Provides anonymised usage statistics — only if you consent | EU, with onward transfers to the US under the EU-US Data Privacy Framework |
We may also disclose data if required by law (e.g. court order) or if there is a serious risk to someone’s safety.
7. International transfers
Some of our service providers (Google) transfer data to the United States. They are certified under the , which the UK recognises as providing an adequate level of protection. No other transfers outside the UK or EEA are made.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Contact form enquiries and our replies | 12 months from the last contact, then deleted |
| Server logs | Up to 30 days |
| Google Analytics data | 14 months (GA4 default), then automatically deleted by Google |
| Cookie consent record | 12 months |
If you ask us to delete your data sooner, we will — see section 9.
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data (“right to be forgotten”)
- Restriction — ask us to pause processing while a query is resolved
- Object — object to processing based on legitimate interests
- Portability — receive your data in a portable format
- Withdraw consent at any time, where consent is the lawful basis
To exercise any of these rights, email . We’ll respond within one calendar month. There is no charge.
You can also complain to the UK regulator:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website:
We’d appreciate the chance to address your concern before you go to the ICO, please contact us first if you can.
10. Security
We use HTTPS encryption across the site, keep our software up to date, and limit access to enquiry data to people who need it. No system is perfectly secure, but we take reasonable steps to protect your information.
11. Children
The site is intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has submitted information to us, please contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top will show when it last changed. Significant changes will be highlighted on the website.
Contact information
If you have any questions regarding this privacy statement, please e-mail: inbox@rehab-online.org.uk