Legal
Privacy notice
This notice explains what personal data Simplify HCS Limited collects, why we collect it, how long we keep it and what rights you have. It covers our website and our direct relationship with customers. Patient data processed inside our products is covered separately, in the processor section below.
Last reviewed
Who we are
Simplify HCS Limited is a company registered in England and Wales, company number 13667511. We are registered with the Information Commissioner’s Office under registration ZB235652.
For questions about this notice or about how we handle personal data, contact us at admin@notes-hub.com or through our contact form. We have not appointed a Data Protection Officer; send data protection questions to the same email address.
Controller or processor: which applies
The distinction determines who is legally responsible for your data and who answers a request about it. We are a controller for some data and a processor for other data, and the two are handled differently.
Where we are the controller
We decide why and how the data is used. This covers: enquiries sent through our contact form, email and telephone correspondence, customer account and billing records. This website sets no cookies and uses no analytics.
Where we are a processor
Our customers — GP practices, dental practices and software suppliers — decide why and how patient data is used. When that data passes through our products, we act on the customer’s documented instructions under a written data processing agreement. The customer is the controller. If you are a patient and you want to know what a practice holds about you, ask that practice; we cannot answer for them.
What we collect and why
| Data | Why we collect it | Lawful basis | How long we keep it |
|---|---|---|---|
| Name, email, organisation, message content from our contact form | To answer your enquiry | Legitimate interests — responding to a request you sent us | As long as we need to answer your enquiry, then deleted |
| Customer contact and account details | To provide the product and support it | Performance of a contract | The life of the account, plus 12 months |
| Billing and transaction records | To invoice, and to meet accounting obligations | Legal obligation | Six years from the end of the accounting period |
| Website measurement data | None collected. This website uses no analytics. | Not applicable | Not applicable |
Who we share data with
We do not sell personal data and we do not share it for advertising. We use a small number of sub-processors to run the service:
- Google Cloud / Firebase — hosting, database and file storage, in London (europe-west2).
- Vertex AI (Google Cloud) — AI drafting in SafeDeploy, in London (europe-west2). Google does not use this content to train its models.
- Resend — email delivery, in the United States.
We may disclose personal data where we are legally required to do so, for example in response to a court order or a lawful request from a regulator.
Where your data is held
Our products store data with Google Cloud in London (europe-west2). This website is served by Firebase Hosting, part of Google Cloud. Our email provider, Resend, is in the United States, so email addresses and message content — including messages sent through our contact form — are transferred there for delivery.
AI and personal data
SafeDeploy uses Google’s Gemini models through Vertex AI in London to produce drafts. Content sent to it is not used to train models. Every AI output in our products is a draft that a human reviews, edits and approves before it is filed.
Your rights
Under UK GDPR you have the right to access your data, to have inaccurate data corrected, to have data erased in some circumstances, to restrict or object to processing, and to data portability. Where we rely on consent, you can withdraw it at any time.
To exercise any of these rights, email admin@notes-hub.com. We will respond within one month. If you are asking about data held by a practice that uses our products, contact that practice — they are the controller.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you raised it with us first so we can put it right.
Security
We apply technical and organisational measures appropriate to the risk. We publish an NHS Data Security and Protection Toolkit assessment each year (2025-26: Standards met). If you believe you have found a security vulnerability, email admin@notes-hub.com.
Changes to this notice
We update this notice when our processing changes. The review date is at the top of this page. Material changes affecting customers are notified directly rather than only posted here.