[DO NOT MERGE] Stream web analytics data to Umami

[sjlegg]

• JS snippet in <head> to stream web analytics data to Umami (NHSE-hosted in AWS)
• New privacy policy
• Add link to privacy policy to footer
• Apply Content Security Policy (CSP) to all pages via a <meta> tag in the <head> - tested by running locally and checking logs for CSP violations, as well as LLM pixel-by-pixel comparison of screenshots before/after to check for missing fonts, style sheets etc.

[Copilot]

Pull request overview

Adds Umami web analytics and documents the associated privacy handling.

Changes:

• Injects the Umami analytics script site-wide.
• Adds and links a new privacy policy.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
eleventy.config.mjs	Adds footer link and analytics transform.
app/privacy-policy.md	Documents analytics data processing.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[annapowellsmith-nhs]

Lovely 🙌 I've deleted previous comments that are now outdated following our offline discussion.

Two minor things:

• I wonder if we want to serve the script from a prettier URL like analytics.digital-prevention-services.nhs.uk, and lose crossorigin="anonymous" - one for @csutter to decide, I think.
• Presumably the DPSP site admins will need to set up a CSP for this. Worth flagging that in this PR I think.

[csutter]

Looks good in principle!

It's not clear from the Umami docs whether different versions of the tracking script work with different versions of Umami, or if there's a risk of issues if they diverge. Either way it's probably worth us versioning the script files on the bucket like v3.3.1/script.js as part of deploying a new Umami version (in addition to the sensible use of a SHA).

I wonder if we want to serve the script from a prettier URL like analytics.digital-prevention-services.nhs.uk

We can set up an appropriate nhs.uk subdomain when the time comes (I believe www.digital-prevention-services.nhs.uk is just a CNAME and we haven't delegated a zone to us so we'll have to make a request to the DNS team).

Presumably the DPSP site admins will need to set up a CSP for this.

Can we do that in this PR? This will need a <meta> tag as we can't add custom headers on GitHub pages.

[sjlegg]

Looks good in principle!

It's not clear from the Umami docs whether different versions of the tracking script work with different versions of Umami, or if there's a risk of issues if they diverge. Either way it's probably worth us versioning the script files on the bucket like v3.3.1/script.js as part of deploying a new Umami version (in addition to the sensible use of a SHA).

I wonder if we want to serve the script from a prettier URL like analytics.digital-prevention-services.nhs.uk

We can set up an appropriate nhs.uk subdomain when the time comes (I believe www.digital-prevention-services.nhs.uk is just a CNAME and we haven't delegated a zone to us so we'll have to make a request to the DNS team).

Presumably the DPSP site admins will need to set up a CSP for this.

Can we do that in this PR? This will need a <meta> tag as we can't add custom headers on GitHub pages.

Thanks @csutter. I have added a CSP to this PR and tested it. I'll work on the version tracking in parallel. We're still waiting on an outcome of the DPIA screen for this.

Please can you provide details off this PR of how to make the request to the DNS team for the subdomain, or should this wait for the outcome of the DPIA screen first?