Privacy Policy
Last updated: 24 February 2026
1. Who We Are
This website (WaitSmart, hereafter “the Service”, “we”, “us” or “our”) is operated by Search Ventures Ltd (Company No. 10588553), a company registered in England and Wales, based at 82A James Carter Road, Mildenhall, IP28 7DE. The Service provides publicly available Accident & Emergency waiting time data aggregated from NHS hospital trust websites. We act as the data controller for any personal data processed through the Service within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Data We Collect
We are committed to collecting as little personal data as possible. The Service does not require you to create an account, log in, or provide any personally identifiable information to use it. Specifically:
- Postcodes. When you use the “Find my A&E” or “Get directions” features, the postcode you enter is sent directly from your browser to a third-party geocoding service (postcodes.io) and a routing service (OSRM). We do not store, log, or retain postcodes you enter.
- Server logs. Our web server may automatically record standard access logs including your IP address, browser type, referring URL, pages visited, and date/time of access. These logs are used solely for security monitoring, error diagnosis, and capacity planning.
- No user accounts. We do not collect names, email addresses, payment information, or any other registration data.
- Analytics. We use Google Analytics (provided by Google LLC) to collect anonymised usage data such as pages visited, time on site, and general geographic region. Google Analytics uses cookies to distinguish unique users. This data helps us understand how the Service is used and improve it. Google Analytics does not collect your name, email address, or other personally identifiable information through our implementation. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. For more information, see Google’s Privacy Policy.
3. Legal Basis for Processing
To the extent that any data we process constitutes personal data under the UK GDPR, we rely on the following lawful bases:
- Legitimate interests (Article 6(1)(f) UK GDPR) - processing server log data for security, error monitoring, and service improvement. We have assessed that these interests do not override your fundamental rights and freedoms, given the limited nature and short retention of such data.
- Performance of a service - processing the postcode you voluntarily provide in order to deliver the directions and travel-time calculation you have requested.
4. Third-Party Services
The Service relies on the following third-party services, each of which may receive limited data directly from your browser when you use certain features:
- Google Analytics (Google LLC) - anonymised site usage analytics. Sets cookies to distinguish users and track page views. Subject to Google’s Privacy Policy.
- postcodes.io (Ideal Postcodes Ltd) - postcode-to-coordinate lookup. Subject to their own privacy policy.
- OSRM (Open Source Routing Machine) - driving route, time, and distance calculation. Receives origin and destination coordinates only.
- OpenStreetMap - map tile rendering. Subject to the OpenStreetMap Foundation privacy policy.
We have no control over and accept no responsibility for the privacy practices of these third-party services. We encourage you to review their respective privacy policies.
5. Data Retention
- Postcodes: Not stored. Processed in real-time in your browser and not transmitted to our servers.
- Server logs: Retained for a maximum of 90 days, after which they are automatically deleted.
- Hospital waiting time data: Retained indefinitely for historical trend analysis. This data is sourced from publicly available NHS trust websites and does not contain any personal data.
6. Your Rights Under UK GDPR
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to any personal data we hold about you:
- Right of access (Article 15) - the right to obtain confirmation of whether we process your personal data and, if so, to request a copy.
- Right to rectification (Article 16) - the right to have inaccurate personal data corrected.
- Right to erasure (Article 17) - the right to request deletion of your personal data in certain circumstances.
- Right to restrict processing (Article 18) - the right to request that we limit how we use your data.
- Right to data portability (Article 20) - the right to receive your personal data in a structured, machine-readable format.
- Right to object (Article 21) - the right to object to processing based on legitimate interests.
To exercise any of these rights, please contact us using the details in Section 10 below. We will respond to valid requests within one calendar month.
7. International Transfers
Your data may be processed by third-party services hosted outside the United Kingdom. Where this occurs, we take reasonable steps to ensure that appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including reliance on adequacy decisions or standard contractual clauses where applicable.
8. Children’s Privacy
The Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us and we will take steps to delete such data promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top of this page indicates when this policy was most recently revised. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.
10. Contact & Complaints
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at the email address displayed on the website.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection: