Privacy notice

This notice explains what happens to information you give this website, and what happens to it afterwards. It is written to be read rather than to be complied with, so if anything here is unclear, please ask.

Who is responsible

Mathews Medical Ltd is the data controller for anything submitted through this site. It is the company through which Ms Li Jiang provides private ophthalmology services.

This notice covers the website only. Once you become a patient, the clinic where you are seen holds your clinical record and has its own privacy notice, which governs that record. The two are separate.

What this site collects

Three things, and nothing else.

What you type into the enquiry form: your name, email address, phone number if you give one, which clinic you would prefer, how you would rather be contacted, and whatever you write in the message — which often includes information about your eyes and your health.
What you answer in the suitability questionnaire, if you choose to complete it: your answers, the result it reached, and the contact details you give at the end. Your answers describe your eyes, so they are health information.
Ordinary technical information every website receives: your IP address, the page you asked for, and your browser type. Our web server writes these to its log.

Your IP address is also used, for a few minutes, to limit how many times the forms can be submitted from one place. It is held in the server’s memory for that purpose and never written to the database alongside your enquiry.

You are not asked to create an account, and nothing you do here is used to build a profile of you.

Why, and on what legal basis

To answer your enquiry and arrange care. You tick a box to say we may contact you, and that consent is the basis for using your contact details. You can withdraw it at any time by replying to any message or ringing the practice.
To handle information about your health. Health data needs a second, stronger basis under UK GDPR. Where you send it to us in order to be seen, we rely on your explicit consent; where care is then arranged, we rely on the provision of healthcare.
To keep the site working and stop it being abused — the rate limit and the server log. This is our legitimate interest in running a site that functions.
To understand which pages are useful, using the analytics described below. Also a legitimate interest, and one you can frustrate entirely with any ad blocker without losing anything on the site.

Who else sees it

Ms Jiang and her secretary, who read every enquiry.
Mailgun, which delivers the email. Enquiries are sent to the practice and an acknowledgement is sent to you, so the contents of your message pass through their servers. Their EU region is used, so that processing happens inside the EU.
Aethus, who built and maintain this site, who host it and its analytics, and who can therefore reach the database in the course of supporting it.
The clinic you are referred to, if an appointment is arranged — at which point their own privacy notice applies as well as this one.
Doctify, but only if you scroll down to the patient reviews. Those are published by Doctify rather than by us, and they are shown in a panel loaded from their servers, so your browser contacts them directly and they can see your IP address. Nothing you have typed into this site is sent to them, the panel is not loaded until you reach it, and your browser is asked not to tell them which page you were reading.

Nothing here is sold, and nothing is shared with advertisers. There are no advertising or social media trackers on this site.

What this site deliberately does not do

Some of this is worth stating plainly, because the ordinary version of a medical website does the opposite.

The clinic map is served from this site’s own server. Most sites embed Google Maps, which tells Google which hospital you were looking at. This one tells nobody.
Patient films are served from this site’s own server rather than YouTube or Vimeo, for the same reason.
Analytics are cookieless and record no identifier that follows you between sites.
There are no advertising trackers and no social media buttons anywhere on the site.
Nothing is loaded from anybody else’s server except the Doctify review panel described above, which is there because reviews are only worth reading while they are demonstrably not ours.
No cookie banner, because this site sets no cookie that needs consent. The only one it sets is the one that lets an authorised reviewer past the preview password.

Where it is kept

Enquiries and questionnaire answers are stored on a server in the United Kingdom. Email passes through Mailgun’s EU region. Nothing is transferred outside the UK or EU.

Your rights

Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us using it, and ask for it in a portable form. Where we rely on your consent, you can withdraw it at any time — that does not undo anything done before you withdrew it.

To exercise any of these, contact the practice using the details on the contact page. We will respond within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first, so that we have the chance to put it right.

Security

The site is served over an encrypted connection, the database is not reachable from the internet, and access to enquiries is limited to the people named above. No system is perfectly secure, and we will tell you and the ICO if something goes wrong in a way that puts you at risk.

Changes to this notice

If this notice changes materially we will say so on this page. It was last reviewed in September 2026.