Last updated: 29 July 2026
This privacy notice explains how Simpliy Limited collects and uses personal information when you visit or administer this website. It applies to the website itself and is separate from the GP practice’s patient privacy notice.
The GP practice’s patient privacy notice explains how the practice uses information about patients, including medical records and information used to provide healthcare. This website does not collect patient enquiries or medical information directly. Links to appointments, prescriptions, online consultations and other healthcare services take you to external services with their own privacy notices.
Who is responsible for website information?
Simpliy Limited is the data controller for the personal information described in this website privacy notice.
Simpliy Limited is registered in England and Wales under company number 17342355. Its registered office is 66 Paul Street, London, England, EC2A 4NA. Simpliy Limited also trades as Simpliy Primary Care and Hampson Miller.
For privacy questions, requests or complaints relating to this website, contact the Data Protection Officer at dpo@simpliy.uk.
Information we collect
Information collected when you browse the website
Our website systems may automatically collect limited technical information needed to provide and protect the website, including:
- your internet protocol (IP) address;
- the date and time of your visit;
- the pages and files requested;
- your browser, device type and operating system;
- the website or page that referred you to this website; and
- security, diagnostic and error information.
We use this information to deliver pages, maintain security, investigate faults, prevent misuse and understand the performance of the website.
Google Analytics
We use Google Analytics to understand how people use the website and to help us improve its content, navigation, accessibility and performance. Analytics information may include:
- pages viewed and time spent on the website;
- general interaction and navigation information;
- approximate location, such as country, region or city;
- browser, device and operating-system information;
- the source of a visit, such as a search engine or referring website; and
- pseudonymous cookie or device identifiers.
We do not use Google Analytics to identify patients, collect medical information, make decisions about individuals or deliver targeted advertising. We do not send names, email addresses, NHS numbers or medical details to Google Analytics.
Google Analytics is activated only where the required cookie choice has been made. You can change or withdraw your choice at any time through the website’s cookie settings. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.
Google Analytics 4 uses IP addresses at the point of collection to derive general location information and then discards them before the IP address is logged by Analytics. More information is available in Google’s Privacy Policy.
Cookies and similar technologies
The website uses strictly necessary cookies and similar technologies to operate securely and remember choices such as cookie preferences. These do not require consent where they are essential to provide the website.
Google Analytics cookies are non-essential and are controlled through the website’s cookie settings. The website’s separate cookie notice gives more detail about the cookies in use, their purposes and how long they last.
Website administration accounts
If you are an authorised member of GP practice staff or a Simpliy administrator, we may process your name, work email address, username, account permissions, login records and website activity. We use this information to manage access, provide support, maintain an audit trail and protect the website.
Privacy enquiries and complaints
If you contact our Data Protection Officer, we will process the contact details, correspondence and any other information needed to respond to your request or investigate your complaint. Please do not send medical information to Simpliy. Patient or clinical matters should be sent directly to the GP practice through an appropriate channel.
Why we use your information
Under UK data protection law, we must have a lawful basis for using personal information. We rely on:
- Legitimate interests to operate, secure, maintain and improve the website; manage authorised administration accounts; prevent misuse; diagnose faults; and respond to general privacy enquiries. We balance these interests against the rights and expectations of website users.
- Consent for non-essential analytics cookies and related Google Analytics processing where consent is required. You may withdraw this consent at any time through the cookie settings.
- Legal obligation where we must use or retain information to meet a duty imposed by law, including responding to information-rights requests and data protection complaints.
We do not intentionally collect special-category information, such as health information, through this website.
Who we share information with
We share personal information only where necessary and proportionate. Recipients may include:
- our UK-based website hosting, infrastructure, backup, security and technical-support suppliers;
- Google, where Google Analytics is enabled in accordance with your cookie choice;
- professional advisers, insurers or auditors where reasonably necessary; and
- regulators, law-enforcement bodies, courts or other authorities where disclosure is required or permitted by law.
We do not sell website-user information. We do not share it for targeted advertising.
Links to external healthcare services
This website links to services operated by other organisations, which may include NHS bodies, online consultation providers, appointment or prescription services, mapping services and other healthcare organisations.
When you follow an external link, the other organisation is responsible for the information it collects. Its own privacy notice and cookie information will apply. Simpliy does not receive the information you enter into those external services unless this is expressly stated at the time.
Where information is processed
The website and its core hosting data are located in the United Kingdom.
Google Analytics is a global service, and Google or its authorised subprocessors may process analytics information outside the United Kingdom. Where a restricted international transfer takes place, we rely on appropriate contractual and legal safeguards, such as applicable standard contractual clauses and the UK international data transfer addendum or another lawful transfer mechanism. Further information is available in Google’s data processing terms.
How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected:
- routine server, diagnostic and security logs are normally retained for up to 30 days, unless they are needed for longer to investigate a security incident, fault or misuse;
- Google Analytics user-level and event-level information is retained for no longer than 14 months, while aggregated reports may remain available for longer;
- cookie-choice records are normally retained for up to 12 months before the website asks you to confirm your choice again;
- administration-account information is kept while access is authorised and is removed or anonymised when it is no longer required; relevant security and audit records may be retained for up to 12 months;
- privacy-request and complaint records are normally retained for up to three years after the matter is closed; and
- deleted information may remain in encrypted backups for up to 30 days before being overwritten.
We may retain information for longer where this is required by law, needed to establish or defend legal claims, or necessary to investigate a security incident.
How we protect information
We use appropriate technical and organisational measures designed to protect website information. These include encrypted connections, controlled administrative access, role-based permissions, secure backups, software updates, security monitoring and procedures for managing incidents and data breaches. Access is limited to people and suppliers who need it for an authorised purpose.
No internet service can be guaranteed to be completely secure. If we identify a personal-data breach, we will assess it, take appropriate action and notify affected individuals and the Information Commissioner’s Office where the law requires us to do so.
Your data protection rights
Depending on the circumstances, you may have the right to:
- ask for a copy of your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to processing based on legitimate interests;
- receive certain information in a portable format; and
- withdraw consent where processing is based on consent.
These rights are not absolute and may not apply in every situation. To exercise a right, email dpo@simpliy.uk. We may need to confirm your identity before acting on a request.
Automated decision-making
We do not use website information to make solely automated decisions that have legal or similarly significant effects on individuals.
How to make a complaint
If you have concerns about how Simpliy has handled website information, email dpo@simpliy.uk. We will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO). You can find guidance at ico.org.uk/make-a-complaint, call 0303 123 1113, or write to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this notice
We may update this notice when the website, our suppliers or the law changes. The latest version will be published on this page and identified by the “Last updated” date.
Contact us
Data Protection Officer
Simpliy Limited
66 Paul Street
London
EC2A 4NA
Email: dpo@simpliy.uk