Legal
Privacy notice
This notice explains what personal data Simplify HCS Limited collects, why we collect it, how long we keep it and what rights you have. It covers our website and our direct relationship with customers. Patient data processed inside our products is covered separately, in the processor section below.
Last reviewed
Who we are
Simplify HCS Limited is a company registered in England and Wales, company number 13667511, with its registered office at 4 Henley Gardens, Pinner HA5 2DE. We are registered with the Information Commissioner’s Office under registration ZB235652.
For questions about this notice or about how we handle personal data, contact us at admin@notes-hub.com or write to the registered office above. Our data protection contact is [PLACEHOLDER: DPO or data protection contact name and email].
Controller or processor: which applies
The distinction determines who is legally responsible for your data and who answers a request about it. We are a controller for some data and a processor for other data, and the two are handled differently.
Where we are the controller
We decide why and how the data is used. This covers: enquiries sent through our contact form, email and telephone correspondence, customer account and billing records, and any website measurement data described in our cookie notice.
Where we are a processor
Our customers — GP practices, dental practices and software suppliers — decide why and how patient data is used. When that data passes through our products, we act on the customer’s documented instructions under a written data processing agreement. The customer is the controller. If you are a patient and you want to know what a practice holds about you, ask that practice; we cannot answer for them.
What we collect and why
| Data | Why we collect it | Lawful basis | How long we keep it |
|---|---|---|---|
| Name, email, organisation, message content from our contact form | To answer your enquiry | Legitimate interests — responding to a request you sent us | [PLACEHOLDER: enquiry retention period] |
| Customer contact and account details | To provide the product and support it | Performance of a contract | [PLACEHOLDER: customer record retention period] |
| Billing and transaction records | To invoice, and to meet accounting obligations | Legal obligation | Six years from the end of the accounting period |
| Website measurement data | [PLACEHOLDER: state what, if any, analytics are in use] | [PLACEHOLDER: consent, or state none collected] | [PLACEHOLDER: retention period, or state none collected] |
Who we share data with
We do not sell personal data and we do not share it for advertising. We use a small number of sub-processors to run the service. The current list, with what each one does and where it stores data, is maintained on our trust page and is dated.
We may disclose personal data where we are legally required to do so, for example in response to a court order or a lawful request from a regulator.
Where your data is held
Our hosting region is [PLACEHOLDER: hosting region] with [PLACEHOLDER: hosting provider]. [PLACEHOLDER: state whether any personal data is transferred outside the UK, and if so the transfer mechanism relied on — UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum.]
AI and personal data
Some of our products use AI to produce drafts. Whether any personal data reaches a model provider, whether it is used to train models, and how long it is retained are answered explicitly on our trust page. Every AI output in our products is a draft that a human reviews, edits and approves before it is filed.
Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased in some circumstances, to restrict or object to processing, and to data portability. Where we rely on consent, you can withdraw it at any time.
To exercise any of these rights, email admin@notes-hub.com. We will respond within one month. If you are asking about data held by a practice that uses our products, contact that practice — they are the controller.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you raised it with us first so we can put it right.
Security
We apply technical and organisational measures appropriate to the risk. Our certifications, with certificate numbers and expiry dates, are listed on the trust page. If you believe you have found a security vulnerability, email [PLACEHOLDER: security disclosure email address].
Changes to this notice
We update this notice when our processing changes. The review date is at the top of this page. Material changes affecting customers are notified directly rather than only posted here.