Privacy notice

How SimplyWayfinding handles information

SimplyWayfinding is a digital wayfinding service that helps people find their way around hospital sites using QR codes, searchable start points and destinations, and route guidance.

SimplyWayfinding is currently operated by Allen Gibson. For personal information processed directly through SimplyWayfinding as described in this notice, Allen Gibson is the data controller. The privacy contact is info@simplywayfinding.com.

Where information is separately shared with a participating NHS organisation, that organisation may have its own responsibilities for how it handles that information.

Last updated: 15 August 2026

Privacy at a glance

SimplyWayfinding has been designed to minimise the personal information needed to provide wayfinding.

When using the normal wayfinding service:

  • you do not need to create an account or sign in;
  • SimplyWayfinding does not access NHS patient records or clinical systems;
  • SimplyWayfinding does not ask for your NHS number, appointment details or medical information;
  • SimplyWayfinding does not use GPS or continuously track your physical location;
  • route calculation takes place within your browser;
  • selecting a destination does not intentionally create a central record of the journey you planned;
  • fixed-location QR codes identify a wayfinding starting point and do not contain a personal user identifier;
  • feedback is optional and can be submitted anonymously.

Additional information is processed only where needed for website hosting, security, aggregate Web Analytics and optional feedback, as explained below.

Route planning and QR codes

SimplyWayfinding calculates routes within your browser.

Once the application has loaded, selecting or changing a normal start point, destination or route does not intentionally send that selection to a SimplyWayfinding database.

The application may temporarily save the active journey in your own browser so that it can recover after a reload. This local information is described further under Cookies, storage and offline caching below.

Fixed-location QR codes

QR codes installed at a hospital may contain a SimplyWayfinding starting location. This allows the application to know where the QR code is physically positioned without using GPS or live location tracking.

The QR code does not identify the person scanning it.

Testing of the current Netlify Web Analytics configuration has not shown these fixed QR start-location values in the analytics information available to SimplyWayfinding. The analytics view records use of the relevant site or page rather than presenting the QR starting location as location-level analytics.

Netlify still handles the web request needed to deliver the application and may process request and technical information as part of its underlying hosting, security and service operation.

SimplyWayfinding does not use QR-code information to identify an individual or infer their health, medical condition, treatment or reason for visiting a hospital.

Shared and staff-generated journey links

A deliberately shared journey link or a journey QR code created by a member of staff may contain additional route information such as a start point, destination or stair-free preference so that the journey can be opened on another device.

These route parameters are used by the browser to initialise the requested journey.

SimplyWayfinding does not use information contained in these links to profile users or infer health information.

Once the journey has loaded, subsequent route calculations continue to take place within the browser unless the user deliberately submits feedback containing route context.

Feedback

Feedback is optional and is collected using Netlify Forms.

Feedback can be anonymous. Email address or telephone number is optional and is only required if you would like a response.

The feedback form may collect:

  • feedback type;
  • optional accessibility issue type;
  • comments;
  • optional email address or telephone number;
  • application and map versions;
  • current floor and basic technical information needed to investigate an issue.

For route, map, signage and accessibility reports, relevant route context may also be included, such as the start point, destination, route summary or stair-free setting. This helps identify and investigate the specific issue being reported.

General feedback does not intentionally include route context.

SimplyWayfinding does not ask you to provide medical information. Please do not include medical records, NHS numbers, appointment details or unnecessary confidential or health-related information in feedback.

A route destination or something written in free-text feedback could nevertheless reveal or suggest information relating to healthcare. If unnecessary health-related or confidential information is submitted, it will be redacted or deleted as soon as reasonably practicable.

Redacted or aggregated feedback may be shared with participating NHS organisations during testing and pilot evaluation.

Identifiable feedback or contact details are not routinely shared. They will only be shared with a participating NHS organisation where you have made a separate, optional, affirmative choice allowing this, or where disclosure is required by law.

Hosting and service providers

SimplyWayfinding is hosted using Netlify.

Netlify currently provides:

  • static website hosting;
  • content delivery;
  • Web Analytics; and
  • processing of SimplyWayfinding feedback forms.

As part of delivering, protecting and administering the website, Netlify processes technical information associated with web requests. This may include information such as IP address, browser or device information, requested page or request information, date and time, and server or security logs.

The public SimplyWayfinding application does not currently include an advertising tracker or third-party client-side analytics script.

Netlify Real User Monitoring (RUM) is not enabled.

Netlify states that personal information processed through its services may be processed internationally and that it uses appropriate legal mechanisms for relevant international transfers. Further information is available in Netlify's privacy information and Data Processing Agreement.

Feedback submitted using Netlify Forms includes the information submitted through the form. Netlify may also process IP address and other request metadata as part of providing and securing the Forms service.

Website analytics

SimplyWayfinding currently uses Netlify Web Analytics to understand general use of the service.

It is used to:

  • measure overall page views and approximate visitor numbers;
  • understand which SimplyWayfinding site pages are being used;
  • understand broad traffic patterns and referral sources;
  • identify possible technical or navigation issues;
  • establish a usage baseline during development and pilots; and
  • help evaluate and improve the service.

Netlify Web Analytics is generated on the server side from requests handled by Netlify. SimplyWayfinding does not add a client-side analytics tracking script for this purpose and Netlify Web Analytics does not require an analytics cookie.

Netlify uses technical request information, including IP addresses, when producing some aggregate statistics such as approximate unique visitor numbers.

The analytics information available to SimplyWayfinding may include page views, approximate unique visitor counts, popular pages, referral sources and broad geographic or technical information.

Testing of the current SimplyWayfinding implementation has not shown the starting-location value contained in fixed-location QR codes within the Netlify Web Analytics information available to SimplyWayfinding.

SimplyWayfinding does not use Web Analytics to:

  • identify individual visitors;
  • advertise or market to individual visitors;
  • create user profiles;
  • make automated decisions about individuals;
  • infer an individual's health, diagnosis, treatment or reason for attending hospital;
  • determine whether an individual completed a route; or
  • deliberately combine analytics information with identifiable feedback.

If the analytics configuration changes so that route, QR-location or destination-level analysis becomes available or is proposed for use, the privacy implications will be reviewed before that functionality is used.

Cookies, browser storage and offline caching

Netlify Web Analytics does not use analytics cookies.

Netlify Real User Monitoring is not enabled.

SimplyWayfinding does not currently use non-essential cookies for advertising or behavioural tracking.

The application does use functional browser storage and caching to operate the wayfinding service.

Local storage

Local browser storage may keep:

  • the last SimplyWayfinding site used; and
  • a saved journey state so that a route can recover following a reload.

This information remains within that browser and is not itself an analytics record.

Using Reset journey, clearing the start or destination, or clearing SimplyWayfinding site data in the browser removes the saved journey information.

Session storage

Session storage keeps the active journey state and some temporary interface information during the current browser session.

Session information normally clears when the relevant browser session or tab is closed.

Offline caching

SimplyWayfinding uses a Progressive Web App service worker and browser Cache Storage to retain essential website, map and application files.

This improves performance and allows some parts of the service to continue working when connectivity is limited.

Cached website files do not by themselves tell SimplyWayfinding which route an individual planned.

Stored SimplyWayfinding information can also be removed by clearing the site's data through your browser settings.

Why information is used

SimplyWayfinding uses information only where it is needed to:

  • provide and maintain the website and route-planning service;
  • securely host and deliver the application;
  • receive and respond to feedback;
  • investigate route, map, signage, accessibility or technical problems;
  • understand broad use of the service;
  • evaluate the service during testing and pilots; and
  • maintain security and reliability.

Purposes and lawful bases

The legitimate interests supporting Web Analytics are understanding whether and how the service is being used, establishing a baseline during testing, evaluating usefulness and performance, identifying problems and maintaining and improving SimplyWayfinding.

Safeguards include:

  • server-side, cookie-free Web Analytics;
  • limited analytics retention;
  • no advertising;
  • no individual profiling;
  • no attempt to identify visitors;
  • no deliberate combination of analytics with identifiable feedback;
  • aggregate reporting;
  • no use of destinations or QR locations to infer health information;
  • no destination-level route analytics in the current implementation; and
  • Netlify Real User Monitoring remaining disabled.

These arrangements will be reviewed with participating organisations as SimplyWayfinding develops.

Retention

Identifiable feedback and associated contact details, including copies held through Netlify Forms and feedback-notification email, will be retained for no longer than 12 months from submission.

They will be deleted earlier where they are no longer required to respond to or investigate the feedback.

Feedback may be anonymised or aggregated for service evaluation and improvement. Properly anonymised findings may be retained for longer because they no longer identify the contributor.

Feedback records are reviewed and deleted manually.

Web Analytics information is currently available to SimplyWayfinding through Netlify for no longer than 30 days. The exact period may be shorter depending on the Netlify service in use.

Netlify may separately retain underlying hosting, security and technical-service information in accordance with its own data-processing arrangements.

Aggregate analytics summaries may be retained for longer where they do not identify individual visitors.

SimplyWayfinding does not deliberately export or retain individual route, destination or QR-location information for analytics purposes.

The retention arrangements will be reviewed before any change that would materially increase the amount or duration of personal information retained.

Your rights

UK data-protection law may give you rights, where applicable, to request:

  • access to personal information held about you;
  • correction of inaccurate information;
  • deletion of information;
  • restriction of processing; or
  • objection to processing based on legitimate interests.

Where processing genuinely relies on consent, you may withdraw that consent.

Because SimplyWayfinding does not require user accounts and its Web Analytics is intended to provide aggregate usage information rather than identify individuals, it may not be possible to associate an analytics statistic with a particular person.

Feedback containing contact details can be more readily identified where sufficient information is provided.

To make a privacy request, email info@simplywayfinding.com.

You may also complain to the UK Information Commissioner's Office.

Changes to this notice

This notice will be reviewed when SimplyWayfinding changes in a way that may affect privacy.

Examples include introducing:

  • user accounts;
  • GPS or live location tracking;
  • additional analytics providers;
  • client-side monitoring;
  • Real User Monitoring;
  • advertising or profiling;
  • databases containing user information;
  • longer retention periods;
  • destination-level analytics;
  • new data-sharing arrangements; or
  • a material change in NHS involvement or responsibility.

The page will always show the date it was last updated.

Where a change materially affects how personal information is collected, used or shared, the change will also be highlighted within the service or at the relevant point of interaction where reasonably practicable.