Privacy notice

Leathen Healthcare IT Solutions Ltd, registered in England and Wales under number 10345413, registered office The Haven, 2 Awsworth Lane, Cossall, Nottingham, NG16 2RZ, England.

For data protection questions, subject access requests or anything else in this notice, email [email protected] with "Data protection" in the subject.

This is the answer to the question most practices actually want to ask, so it is first.

Simple Surgery holds no patient identifiable information and no clinical records. A practice website is a public noticeboard. It does not connect to your clinical system, it has no patient login, it takes no bookings and it holds no records. Appointment requests and prescription ordering happen on your existing NHS suppliers' systems, which we link to and never see inside.

There is no patient contact form and no message box. Nothing on a Simple Surgery website invites a patient to type anything about themselves, which is a deliberate design decision rather than an omission: it means a practice cannot accidentally end up receiving clinical information through a route nobody is monitoring.

The one thing a patient can type is a search of the practice's own pages. That query appears in the page address, so it reaches our hosting provider's request logs in the same way any web address does. It is not sent to the practice, not stored by us, and not connected to anything. Even so, it is the only patient-entered text anywhere in the system, so we would rather name it than let you find it.

The personal data we do hold is about practice staff and the people who contact us, and it is set out below.

We act in two different capacities, and it matters which one applies:

1. As a data controller, for information about the people who buy from us and enquire: your name, your practice email address, and your billing relationship with us. We decide what to do with that, so this notice governs it.
2. As a data processor, for the content your practice publishes on its own website, including the names and photographs of your staff. Your practice decides what goes on your website. We only store and serve it, on your instructions.

For the second, your practice is the controller and your own privacy notice applies. We act on your instructions, do not use that content for our own purposes, and will return or delete it when you ask.

The terms governing that relationship are published in full as our data processing agreement, which is the Article 28 schedule your ICB will ask for.

When you enquire. Your name, practice name, email address, current website address and your message. We use it to reply to you and to follow up once if you asked us to. Lawful basis: legitimate interests, and steps taken at your request before entering a contract.

When you buy. Practice name, ODS code and a contact email address. We use these to create your website, send you your password, and support you afterwards. Lawful basis: performance of a contract.

Payment details. Handled entirely by Stripe. We receive a customer reference, a subscription reference and the result. We never receive your card number.

When you ask for the guide by email. Your email address, used to send the guide. Lawful basis: consent. Every one of those emails can be replied to with "stop" and that is the end of it.

Your website content. Whatever your practice publishes, including staff names, job titles and photographs. Lawful basis: your practice's, as controller. We process it under your instructions.

Server logs. Our hosting keeps request logs that include IP addresses, for security and for diagnosing faults. We also count enquiry submissions per IP address for an hour to stop form spam. Lawful basis: legitimate interests in keeping the service secure and working.

• No advertising, no profiling, no selling. Your data is not shared with anyone for marketing, ever.
• No tracking on this website. There are no analytics scripts, no advertising pixels and no third party embeds on simplesurgery.co.
• No cookies on this website. Visiting or reading anything here sets no cookies at all, which is why there is no cookie banner.
• No AI training. Nothing you send us, and nothing on your website, is used to train any model.

This marketing website sets no cookies.

A practice website built with the template sets exactly one cookie, and only after a member of staff signs in to the admin panel. It holds a signed session token, nothing else. It is httpOnly so scripts cannot read it, marked secure, restricted with sameSite=lax, and it expires on its own. It is strictly necessary for signing in, so it needs no consent under the Privacy and Electronic Communications Regulations.

Patients visiting a practice website are never given a cookie by us. If a practice chooses to add a privacy friendly analytics tool of its own in Advanced settings, that is the practice's decision and belongs in the practice's own privacy notice.

We use a small number of specialist suppliers to run the service. Each one is contracted as a processor, each has a published data processing agreement, and none of them is permitted to use your data for their own purposes. The full list, with what each one holds, is on our security and service information page.

Beyond those suppliers, we share personal data with nobody, except where the law requires it, or where we need to take advice from our own accountants or lawyers.

Application processing and primary content storage are configured for the London region. Pages are delivered to patients through Vercel's global content delivery network.

Vercel and some of our other suppliers may process service data internationally under their applicable data transfer safeguards. Their published terms state that their primary processing facilities are in the United States and that data may be processed wherever they or their sub-processors operate. Configuring our application region does not by itself confine every log, cached page and piece of operational data to the UK, and we would rather say so than let you infer a guarantee we cannot give.

Payment processing through Stripe and email through Resend are international by nature.

Where personal data leaves the UK, the transfer is covered by the terms of each supplier's data processing agreement, which incorporate the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.

The table on our security and service information page sets out where each supplier processes data. If your practice needs this confirmed in writing for its information governance records, email us and we will do that.

• Enquiries that do not become customers: 12 months, then deleted
• Guide email addresses: used to send the guide, not added to any list
• Your account and website content: for as long as you are a customer, and 30 days after your service ends, then deleted
• Invoices and payment records: kept by Stripe, and retained for six years to satisfy UK tax law
• Server logs: retained by our hosting provider on its own schedule, typically around 30 days

You can download all of your website content yourself at any time, from Advanced settings in your admin panel.

Everything is served over HTTPS. Passwords are stored as salted scrypt hashes and never in plain text. Each practice's content is stored under its own key and every request is checked against a session bound to that practice.

The full picture, including what our security model does not yet do, is on our security and service information page. We would rather you read that before buying than discover it afterwards.

Where we are the controller, you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct anything that is wrong
• Delete it, where we do not need it for a contract or for tax records
• Restrict or object to how we use it
• Give you a portable copy of it

Email [email protected]. We reply within one month, free of charge.

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. Complaining to the ICO does not cost anything and does not affect your service with us.

Where your practice is the controller, and a request concerns your website's content, we will pass it to you and support you in answering it.

We update this notice when what we do changes. The date at the top is when it last changed, and we will email customers about anything material.