Privacy Policy

Privacy Policy

This sets out how SimpleMed and its partners use and protect any information that you give us when you use this website.

Who we are. SimpleMed, including SimpleMed+ (plus.simplemed.co.uk) and the SimpleMed apps, is a product of Lili’s Ark Limited, a company registered in England and Wales with company number 15424953. Its registered office address is available on the Companies House register. Lili’s Ark Limited is the controller of the personal data described in this policy under UK data protection law, namely the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. To contact us about this policy or your personal data, please use our contact page.

We are committed to ensuring that your privacy is protected. Should we ask you to use any information by which you can be identified, it will always be used in accordance with this privacy statement.

We may collect the following information:

• Name
• Contact information including email address
• Demographic information such as postcode, preferences and interests
• IP-address
• Browser type
• Global information on our members use of the site (i.e. period of time spent watching videos, browsing notes, questions completed)
• Any information our analytics and advertising provider, Google (via Google Analytics and Google Ads), may require for site usage analytics and to measure our adverts, as defined in its privacy policy.

You can exercise your right to restrict the collection or use of your personal information in the following ways:

• When you fill in a form on the website, at times there will be an option to opt-in to marketing e-mails. In the absence of this box we will not contact you for marketing purposes.
• You can allow or decline optional analytics and advertising cookies in the privacy banner. After making a choice, use the “Cookie settings” control at the foot of each page to change it at any time. Essential cookies used for security, sign-in and requested features are not affected by this choice.
• If you have already agreed to allow direct marketing, you may change your mind by contacting us.

If you are concerned that any information we are holding on you is incorrect or you would like us to delete any information, please contact us. Our GDPR compliance lead is Dr. Marcus Judge.

1. General

SimpleMed (“we” or “us”) take the privacy of your information very seriously. Our Privacy and Data Protection Policy is designed to tell you, the user of our website simplemed.co.uk and any other services provided by us via and technology or media (the “Service”) about our practices regarding the collection, use and disclosure of personal and other information about you or your business that may be provided via the or collected through other means such as an online form, email or telephone communication.

This policy applies to information provided by our users and registered members. We process information where it is needed to provide the Service, meet legal obligations or pursue a legitimate interest described in this policy. Where consent is required, we ask for it separately and you can withdraw it at any time. Using the Service alone does not grant consent to optional analytics or advertising cookies.

You can manage them in the privacy banner and change your choice later using the “Cookie settings” control.

2. Our policy

We aim to limit our interaction with your data wherever possible. We have a general policy relating to access to your data. We will generally seek only to access that data which is necessary in accordance with the privileges you have granted to the system. Automated processes may scan your data, but only for an explicit purpose to do with the provision of our service. When working with data that was originally collected by us, our processes may need to scan and manipulate the information in order to deliver our service to you.
If you actively accept optional cookies, we use Google Analytics to understand aggregated site usage and improve SimpleMed, and Google Ads cookies to measure how well our adverts work, as described in Google’s privacy information. Before you choose, or if you choose “Only essential”, Google’s tag still loads, but in a restricted cookieless mode: it sets no analytics or advertising cookies (such as the _ga cookie) and sends only cookieless measurement pings. Analytics and advertising cookies are set only after you select “Accept”. The privacy banner appears on your first eligible visit; use “Cookie settings” later to change your decision.

3. Ways in which we collect data

We may collect and process the following personal information or data (information that can be uniquely identified with you) about you: certain information required to use the Service, including your name and e-mail address; any correspondence between you and us; replies to any surveys or questionnaires that we may use for research purposes; details of your visits to the Service and the resources that you access; any information we may require from you when you report a problem or complaint.

If you choose to sign in to SimpleMed+ with Google or Apple, that provider confirms your identity to us and shares your email address and, where available, your name. We store the account identifier it gives us so that we can recognise you when you next sign in. Apple may give us a private relay email address instead of your own address. We never receive your Google or Apple password.

We only collect such information when you choose to supply it to us. You do not have to supply personal information, although features such as account sign-in cannot operate without the information they require. Optional analytics and advertising cookies can be allowed or declined in the privacy banner and changed later using “Cookie settings”.

Information may also be gathered through the Service without you actively providing it, through the use of various technologies and methods such as Internet Protocol (IP) addresses and cookies. If you select “Accept”, analytics and advertising cookies collect online identifiers and usage data, for example a cookie ID, your approximate location derived from your IP address, details of your device and browser, and the pages you visit. Before you make a choice, or if you choose “Only essential”, only cookieless measurement pings are sent and no analytics or advertising cookies are set.

An IP address is a number assigned to your computer by your Internet Service Provider (ISP), so you can access the Internet. An IP address can be personal data under UK data protection law, so we treat it as personal data.

We use your IP address to diagnose problems with our server, report aggregate information, and determine the fastest route for your computer to use in connecting to the Service, and to administer and improve the Service.

4. Use and disclosure

We may use this information to: ensure that the content of the Service is presented in the most effective manner for you and for your computer and customise the Service to your preferences; assist in making general improvements to the Service; carry out and administer any obligations arising from any agreements entered into between you and us; allow you to participate in features of the Service; contact you and notify you about changes to the Service (except where you have asked us not to do this); analyse how users are making use of the Service.

We do not disclose any information you provide via the Service to any third parties except: to Google, which receives analytics and advertising data if you select “Accept” (see sections 2 and 6); to the service providers that process data on our behalf to run the Service, namely DigitalOcean (hosting), Cloudflare (website delivery and security), Resend (email delivery) and Stripe (payments); if we are under a duty to disclose or share your personal data in order to comply with any legal obligation (for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime); in order to enforce any terms of use that apply to the Service, or to enforce any other terms and conditions or agreements for our services that may apply; to protect the rights, property, or safety of SimpleMed, our Service’s users, or any other third parties. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

Other than as set out above, we shall not disclose any of your personal information unless you give us permission to do so. We will not hand over any user information in the case of a company sale or closure.

Some features also share personal data with other organisations: Google or Apple when you choose to sign in with them (see section 3); Google, through YouTube, when you play a video embedded in an article (see section 6); Google reCAPTCHA, which checks for spam when you use our contact form; Cloudflare Turnstile, which checks for automated sign-ups and password reset requests on SimpleMed+; and Apple and Google push services if you turn on push notifications (see “Push notifications in SimpleMed+” below).

Our lawful bases. UK data protection law requires us to have a lawful basis for each way we use personal data. We rely on:

• Contract: to create and run your account, provide the learning features you use and record your progress, take payment and manage your subscription, and send the service emails that go with them, such as account activation, password reset, subscription and account security messages.
• Legitimate interests: to keep the Service and your account secure, prevent fraud, spam and misuse, use essential cookies for security and sign-in, answer enquiries you send us, and use our server logs to fix problems and improve the Service. Our interest is in running a safe, reliable and useful service. We rely on it only where your rights and interests do not override it, and you can object (see section 8).
• Consent: for analytics and advertising cookies, marketing emails and push notifications. You can withdraw your consent at any time: for cookies, use “Cookie settings” at the foot of each page; for marketing emails, use the unsubscribe link in any marketing email or the email setting in your SimpleMed+ profile; for push notifications, use SimpleMed+ or your device settings.
• Legal obligation: to keep records of payments and invoices for tax purposes, and to comply with court orders and other legal requirements.

5. Security and how long we keep your data

In order to safeguard the information we collect from you we will take all reasonable steps to ensure that: our servers are protected by security mechanisms and can only be administered via strictly controlled public/ private cryptographic keys; our data processing storage facilities are sited in secure locations to prevent unauthorised access.

We keep personal data only for as long as we need it:

• Your account: we keep your account and learning data while your account is open. You can delete your SimpleMed+ account at any time from your profile; this permanently deletes your account, your progress and the other data linked to it from our live systems. To ask us to delete any other information, please use our contact page.
• Server logs: rotated weekly and deleted after four weeks.
• Backups: our nightly database backups are kept for 14 days and then deleted.
• Payment records: payments are processed by Stripe: you enter your card details on Stripe’s payment page, and we never see or store your full card number. Records of your payments and invoices are kept for six years from the end of the financial year they relate to, as UK tax law requires. Stripe holds these records, so they are kept even if you delete your account, although deleting your account removes our own copy.
• Analytics and advertising data: if you accept optional cookies, Google keeps analytics data linked to cookies and other identifiers for up to 14 months.
• Push notification data: as set out in “Push notifications in SimpleMed+” below.

6. Cookies

A cookie is a piece of data stored locally on your computer and contains information about your activities on the Internet. The information in a cookie does not contain any personally identifiable information you submit to our site.

We use essential cookies for security, sign-in, account sessions and features you request. If you actively accept optional cookies, separate analytics cookies help us understand aggregated use of the Service and make improvements, and advertising cookies help us measure how well our adverts work. Declining optional cookies does not prevent access to site content or account features.

Cookies can be session cookies, which expire after a browser session, or persistent cookies, which remain for a stated period. You can also block or delete cookies in your browser settings, although blocking essential cookies may prevent sign-in or other requested features from working.

Optional analytics and advertising cookies remain off unless you actively select “Accept”. Continuing to use the website does not count as consent. Select “Only essential” or “Reject” to keep them off, and use “Cookie settings” to change your decision later.

Declining optional cookies does not affect access to SimpleMed. Separately blocking essential cookies in your browser may prevent sign-in, security protections or other requested online features from working.

Embedded videos. Some articles include videos from YouTube, a Google service. Nothing loads from YouTube until you press play: until then the video area is a placeholder served by SimpleMed. When you press play, the video loads from YouTube’s privacy-enhanced domain (youtube-nocookie.com) and YouTube receives your IP address and details of your device and browser. Once the video plays, Google may set or read cookies and similar technologies on your device. Google uses this information as described in its privacy policy. You can block third-party cookies in your browser settings.

7. Web statistics

Our web servers keep log files of requests to the Service. These include your IP address, the date and time, the page requested and details of your browser. We use them to keep the Service secure, diagnose problems and understand usage patterns so that we can improve the Service. The logs are deleted after four weeks (see section 5).

8. Your rights

We will take all reasonable steps in accordance with our legal obligations to update or correct personally identifiable information in our possession.

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete personal data corrected (rectification);
• have your personal data deleted (erasure);
• ask us to restrict how we use your personal data;
• object to our use of your personal data where we rely on legitimate interests, and object at any time to direct marketing;
• receive the personal data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation (data portability), where we use it on the basis of contract or consent;
• withdraw your consent at any time, for example through “Cookie settings” at the foot of each page. Withdrawing consent does not affect our use of your data before you withdrew it.

Some of these rights apply only in certain circumstances. To use any of them, please contact us through our contact page. We will respond within one month. If your request is complex, we may extend this by up to two further months and will tell you why. We do not normally charge a fee. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk, telephone 0303 123 1113. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.

9. Other Websites

The Service may contain links and references to other websites. Please be aware that this Privacy Policy does not apply to those websites.

We cannot be responsible for the privacy policies and practices of sites that are not operated by us, even if you access them via the Service that is operated by us. We recommend that you check the policy of each site you visit and contact its owner or operator if you have any concerns or questions.

In addition, if you came to our Service via a third party site, we cannot be responsible for the privacy policies and practices of the owners or operators of that third party site and recommend that you check the policy of that third party site and contact its owner or operator if you have any concerns or questions.

10. Transferring your information outside the UK

Our servers are in the UK: SimpleMed and SimpleMed+ are hosted by DigitalOcean in its London data centre region. Some of the service providers named in this policy process personal data outside the UK, including in the United States: Google (analytics, advertising, Google sign-in, YouTube, reCAPTCHA and Firebase Cloud Messaging), Apple (Sign in with Apple and push notifications), Stripe (payments), Cloudflare (website delivery and security) and Resend (email delivery). When personal data is transferred outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or on the ICO’s International Data Transfer Agreement or International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, so that your personal data stays protected to the standard UK law requires.

If you use the Service from outside the UK, your information is transferred to the UK so that we can provide the Service to you.

You can ask us for more information about these safeguards through our contact page.

11. Notification of changes to our Privacy Policy

We will post details of any changes to our Privacy Policy on our website to help ensure you are always aware of the information we collect, how we use it, and in what circumstances, if any, we share it with other parties.

12. Contact us

If at any time you would like to contact us with your views about our privacy practices, or with any enquiry relating to your personal information, you can do so by way of our contact page.