Privacy notice.

Who I am

The Green Thistle is the trading name of James Clyne Gunn, a sole trader based in Inverness, Scotland. I'm the data controller for the information described here. You can reach me at james@thegreenthistle.co.uk, including with any question or complaint about how I handle your information.

What I collect, and why

When you use the contact form or email me

I receive your name, your email address, which kind of enquiry you've chosen, and whatever you write in your message. I use it to reply to you and, if we go on to work together, to do that work. The lawful basis is my legitimate interest in responding to enquiries and, where we agree to work together, the contract between us.

If you tell me about your health

Please share only what you're comfortable sharing. I don't need your medical records to answer a general question, and the contact form asks you not to include health details unless you want to. Information about your health is special category information. If you choose to tell me about your health, I rely on your explicit consent to use it (UK GDPR Article 9(2)(a)), and I use it only to reply to you. You can withdraw that consent at any time by asking me to delete it. I keep it only for as long as our conversation needs it, and it is never passed on. I don't provide clinical care through this website and I don't keep clinical records for it.

When you sign up for Thistle Notes or Highland updates

I keep your email address, whether you told me you're a patient or carer, a clinician, or a clinic or business, which page you signed up on, and whether you asked for Highland updates. I use them to send you Thistle Notes (four emails a year), a short note in between when something important changes and, if you asked, Highland updates, and to make each email relevant to you.

Saying you're a patient or carer, or asking for Highland updates, may suggest an interest in cannabis-based medicines, so I treat it as health-related information and ask for your explicit consent, which you give by ticking the box. Sign-ups are held in Netlify Forms (see below). I haven't yet chosen the service that will send these emails, and I'll update this notice to name it before the first one goes out. I'll never share your details with a clinic or anyone else, or use them for anything other than these emails. You can withdraw your consent at any time by emailing me, and once emails are being sent, by using the unsubscribe link in every one.

When you visit the site

To see which pages are read and roughly how many people visit, I use GoatCounter, a small independent service that counts visits without cookies, without identifying you and without following you to other websites. It records the page you viewed, the site that sent you here, and general information such as your country, browser type and screen size. GoatCounter briefly uses your IP address to avoid counting the same visit twice, but doesn't store it. The lawful basis is my legitimate interest in knowing which pages are useful, so that I can improve the site. You can object at any time, free of charge, using the button under "Cookies and similar technology" below.

Who handles your information for me

These services process information on my behalf. Some of them are outside the UK, and for each I've said what protects your information when it leaves the UK.

• Netlify (Netlify, Inc., United States) hosts this website and collects contact form messages and newsletter sign-ups through Netlify Forms. Netlify states that it takes part in the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection for transfers to organisations that take part. Netlify's privacy policy.
• GoatCounter counts visits. It is run from Ireland and stores its data in Finland and Germany, inside the European Economic Area. It doesn't store IP addresses and doesn't set cookies. GoatCounter's privacy policy.
• Google provides my email. Where Google moves data to the United States, it states that it takes part in the UK Extension to the EU-US Data Privacy Framework. How Google handles data transfers.

How long I keep it

Enquiries are kept for up to two years after our last contact, or for as long as we're working together and for six years afterwards where the law on business records requires it. Newsletter and Highland update addresses are kept until you unsubscribe. Visit counts are kept as totals that don't identify anyone. I delete anything else as soon as it's no longer needed.

Cookies and similar technology

This site doesn't use advertising cookies or tracking pixels, and it doesn't set cookies of its own. GoatCounter doesn't use cookies either, but its counting script does read one small setting in your browser's local storage, called "skipgc", which is how GoatCounter knows not to count a browser. The law on cookies and similar technology allows this without asking you first, because it's used only for statistics about how the site is used, you're told about it here, and you can object easily and free of charge.

Don't count my visits

Press the button to stop your visits being counted in this browser. It saves the "skipgc" setting, and the site then doesn't load the counting script at all. It applies only to this browser on this device: if you clear this site's data, or use another browser, you'd need to press it there too.

Your rights

You can ask me what information I hold about you, ask me to correct it or delete it, object to how I'm using it, or ask for a copy. Where I rely on your consent, you can withdraw it at any time. Email me and I'll deal with it within a month.

Complaints

If you're unhappy with how I've handled your information, please tell me first: email james@thegreenthistle.co.uk with "Data protection complaint" in the subject line. I'll acknowledge your complaint within 30 days and tell you what I'm doing about it. If you're still unhappy, you can complain to the Information Commission, the UK's data protection regulator, at ico.org.uk.

Changes

If I change this notice, the new version will appear here with the date below.