Privacy Policy

This site collects as little as it can get away with. No advertising, no profiling, and no analytics unless you allow it. This page sets out exactly what happens to the small amount that is collected.

Who is responsible

Dr Omar Y. ElBasatiny, operating as Doitrous, is the controller of the personal data described on this page. That means I decide what is collected and why, and I am the person accountable for it.

You can reach me about anything on this page at [email protected]. I answer these myself.

I am based in Egypt, so this processing falls under Egyptian Law No. 151 of 2020 on the Protection of Personal Data. Where the law of the country you are writing from gives you more than that, the GDPR for instance, I apply the higher standard rather than the local minimum. The rights set out below are written to that higher standard and are open to you wherever you are.

The short version

• Visiting the site: nothing is collected about you beyond the short-lived server logs described below, unless you allow analytics when the site asks. No cookies are set before you choose.
• Writing to me: if you email [email protected], I receive your email address and whatever you choose to write, so that I can reply.
• That is the entire list. There is no advertising network, no tracking pixel, and no data sold or shared for marketing.

Analytics, only if you allow it

I use Google Analytics 4 to count visits and see which pages people read. It is switched off until you allow it: the first time you visit, a bar at the bottom of the page asks, and no analytics cookie is set and nothing is sent to Google before you answer. If you say no, the site remembers that and does not ask again.

If you allow it, Google sets its analytics cookies and receives the page you viewed, the page that sent you, your approximate location from an anonymised IP address, and your device type. Advertising features and personalisation are switched off in my configuration, and Google may not use this data for its own purposes under the terms it processes it for me.

You can change your mind at any time by clearing this site's data in your browser; the bar will ask again on your next visit.

Your choice of theme, if you pick one, is stored in your own browser and never sent anywhere. One functional cookie exists on the separate admin subdomain that I use to edit this site. It is issued only when I sign in there; visitors to doitrous.com never receive it.

Email

If you email me, I keep the message and your address in my mailbox so that I can reply and keep a record of the conversation. You will not be added to a mailing list, because there is no mailing list.

Please do not send health information

I am a practising doctor, and people occasionally assume this site is a route to clinical advice. It is not. Do not send patient details, medical records, images of a condition, or any information about your own health by email.

This site has none of the safeguards that handling health data requires, and writing to me creates no clinical relationship of any kind. If you have a medical concern, contact your own doctor or your local emergency service. If you send health information anyway, I will delete it rather than act on it.

Legal basis for processing

Where data protection law requires a legal basis, mine are these. For analytics, your consent, given through the bar on the page and withdrawable at any time. For server logs, my legitimate interest in keeping the site secure and available. For email, taking steps at your request before any possible engagement, and my legitimate interest in responding to people who write to me.

You can object to processing carried out on the basis of legitimate interests. See your rights, below.

Who else is involved

Three service providers process data on my behalf. Each is bound to act only on my instructions, and none is permitted to use your data for their own purposes.

• Hosting provider: serves the site and keeps short-lived server logs, which include IP addresses, for security and abuse prevention.
• Google (Google Analytics): receives visit data only after you allow analytics, as described above.
• Email provider: delivers and stores the messages you send to [email protected].

International transfers

These providers may process data on servers outside your country. Where that happens, the transfer relies on the safeguards those providers have in place, such as standard contractual clauses. If you would like to know where a specific piece of data is held, ask me and I will find out.

How long it is kept

• Analytics: Google Analytics keeps visit data for the retention period set in my account, which I keep at the shortest Google offers. The reports I see are aggregate.
• Email: kept while the conversation is live, and for up to two years afterwards so I have a record of what was discussed. Deleted sooner on request.
• Server logs: retained briefly by the hosting provider, typically for a matter of days.

Your rights

In respect of personal data I hold about you, realistically an email, you can ask me to do any of the following.

• Tell you what I hold, and give you a copy of it.
• Correct it if it is wrong.
• Delete it.
• Restrict what I do with it, or object to my processing it.
• Provide it in a portable, machine-readable format.
• Withdraw consent to analytics, without affecting what came before.

Making a request

Email [email protected] and say what you want. I will not charge you for it, I will not ask you to justify it, and I will respond within one month. If I need to confirm you are who you say you are before handing over a copy of something, I will ask for the minimum needed to do that.

If you are unhappy with how I have handled your data, you are entitled to complain: in Egypt to the Personal Data Protection Centre, and elsewhere to the data protection authority of your own country. I would rather you told me first so I can put it right, but that is your choice, not a precondition.

Security

The site is served over HTTPS. The number of places your data can sit is kept deliberately small, which is the most effective security measure available to a site this size. No transmission over the internet is ever completely secure, and I cannot promise otherwise.

Children

This site is aimed at adults working in healthcare, business, and technology. It is not directed at children, and I do not knowingly collect data from them. If you believe a child has sent me something, tell me and I will delete it.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. Substantive changes will be described rather than quietly folded in. There is no archive of previous versions; if you need one, ask.