Privacy notice

Last updated: 1 November 2026

This notice explains what personal information the Eastern Paediatric Epilepsy Network (EPEN) collects, why we collect it, how long we keep it and what your rights are. It covers this website, emails to the network, our meetings and invitations to our members’ workspace.

Who we are

EPEN is a clinical network of healthcare professionals caring for children and young people with epilepsy in the East of England. EPEN is responsible for the personal information described in this notice (the “data controller”).

If you have a question about this notice or how we use your information, email [email protected].

What we collect and why

When you visit this website

This website does not ask you to sign up or give any personal information. Like all websites, it needs some technical information to work and to stay secure:

• Your browser sends our web host and our security provider your IP address, browser type and the pages you visit. They use this to deliver the website and protect it from attacks, and keep it in short-term server logs.
• We count visits using Cloudflare Web Analytics. It does not use cookies, does not identify you and only gives us totals, such as the number of visits to each page.
• The fonts on this website are stored on our own server, so loading a page does not contact Google or any other font service.

Our lawful basis is our legitimate interests in running a secure, working website.

When you email us

If you email the network, we receive your name, email address and anything you include in your message. We use this to reply to you. Our email account is provided by Google (Gmail). We delete emails when they are no longer needed to deal with your enquiry. Our lawful basis is our legitimate interests in responding to enquiries.

Please do not send information that could identify a patient. Contact the child’s clinical team instead.

When you attend a meeting

Any healthcare professional in the region can attend our meetings. At the meeting you can register your attendance by scanning a QR code, which opens a Google Form. We collect:

• your name and email address
• your job role and the hospital or organisation you work for
• whether you would like an invitation to our members’ workspace

We use this to email you a certificate of attendance for your continuing professional development (CPD) records, and to send a workspace invitation if you ask for one. The certificate is created and emailed by Document Studio, an add-on that works inside our Google account.

We delete the form responses after each meeting, once certificates have been sent and any invitations made. Our lawful basis is our legitimate interests in running network meetings and providing attendance certificates.

Our members’ workspace

Our members’ workspace is on the FutureNHS Collaboration Platform, which is run by NHS England. If you ask to join, we send your name and email address to the platform so it can invite you. Once you join, NHS England is responsible for the information you give the platform, and its own privacy notice applies.

If you choose to show the map

The map of our network hospitals on the About page is provided by Google Maps. It only loads if you select “Show the map”. Google may then set cookies on your device and receive your IP address and information about your browser. Google’s use of this information is covered by the Google privacy policy. If you would rather not use Google Maps, the page also lists all our hospitals.

Cookies

Cookies are small files that websites store on your device. This website does not set any cookies for visitors, so you will not see a cookie banner.

• Security cookies: our security provider, Cloudflare, may set cookies to tell people from automated traffic and protect the website. These are strictly necessary, so we do not need to ask for consent.
• Google Maps: Google may set cookies only if you choose to show the map (see above).
• Website editors: WordPress sets login cookies only for the few people who log in to update the website.

You can block or delete cookies in your browser settings. The website will still work.

Who we share information with

We never sell personal information or use it for marketing. We use these service providers, who only handle information on our instructions or to provide their service:

• Namecheap: hosts this website
• Cloudflare: security, speed, visitor counts and protecting email addresses on the website from spam
• Google: email (Gmail), meeting registration (Google Forms and Sheets) and, only if you choose, the map
• Document Studio: creates and emails attendance certificates
• NHS England: runs the Futures Collaboration Platform

Some of these providers may process information outside the UK. Where they do, they use safeguards approved under UK data protection law, such as the UK–US data bridge or international data transfer agreements.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is wrong
• ask us to delete your information
• object to us using your information, or ask us to limit how we use it

To use any of these rights, email [email protected]. We will reply within one month.

Complaints

If you are unhappy with how we have used your information, please contact us first at [email protected]. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: make a complaint on the ICO website or call 0303 123 1113.

Changes to this notice

We will update this notice if we change how we use personal information. The date at the top shows when it was last updated.