Privacy policy
Last updated:4th November 2026
Who I am
Mercian Medical Ltd (“Mercian Medical”, “I”, “me”) is a consultancy run by David Barnes. Registered in England and Wales, company number 11630028, registered office 35 Troon, Tamworth, United Kingdom. I am responsible for the personal information described in this policy. You can contact me at dbarnes@mercianmedical.com.
What information I collect
When you use the contact form: your name, email address, company, the stage of your project and anything you choose to write in the message box.
When you email me or book a call: your name, email address and anything you include in your message or booking.
When you visit the website: basic technical information such as your browser type and the pages you visit, collected by the website platform to keep the site running securely. See the cookie policy for details.
Please don’t send confidential or commercially sensitive information through the contact form. If we go on to discuss your project, we can agree a confidentiality agreement first.
How I use it, and why I’m allowed to
Replying to your enquiry and arranging a call. Legal basis: legitimate interests (responding to people who contact me).
Discussing, scoping and delivering work for you. Legal basis: taking steps towards, or performing, a contract with you or your company.
Keeping business and accounting records. Legal basis: legal obligation.
Keeping the website secure and working. Legal basis: legitimate interests.
I don’t sell your information, use it for automated decision-making, or add you to marketing lists. If I ever want to send you updates, I’ll ask first.
Who I share it with
Only the services I need to run the business, which process information on my behalf:
Framer, which hosts this website and delivers contact form submissions to me.
My email provider, which stores email correspondence.
Booking tool, e.g. Calendly, if you book a call.
My accountant, where client records are needed for accounts and tax.
I may also share information if the law requires it.
Some of these providers may store information outside the UK. Where they do, I rely on the safeguards UK data protection law requires, such as the UK’s adequacy regulations or standard contractual clauses.
How long I keep it
Enquiries that don’t lead to work: up to 2 years, then deleted.
Client records: 6 years after the work ends, for legal and accounting reasons.
Your rights
Under UK data protection law you can ask me to: give you a copy of your information; correct it; delete it; restrict or object to how I use it; or transfer it to you or someone else. Email dbarnes@mercianmedical.com and I’ll respond within one month.
If you’re unhappy with how I’ve handled your information, please tell me first. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
Changes to this policy
If I change this policy, I’ll update the date at the top of this page.