Privacy Policy
Last updated: 14 October 2026
This policy explains what information Hippo Labs collects, how we use, share, store and secure it, and how you can access and control it.
In this policy, "Hippo Labs" or "we" means Hippo Labs Limited of 3 Kingfisher Square, London, England, SE8 5DA (Company Number 13268736; ICO Registration Number ZB284724). "Platform" means our website at hippolabs.co.uk, our onboarding portal, and our software: Hippo Recaller (including the Hippo Flex plan) and AskHattie.
"Personal information" means any information relating to an identifiable individual that you provide to us or that arises from your use of our products or services.
OUR TWO ROLES
Hippo Labs handles personal information in two different capacities, and your rights run to different organisations depending on which applies.
As a controller. For information about the people we deal with directly (visitors to our website, practice staff who use our Platform, people who contact or work with us), we decide how and why the information is used. This policy describes that processing.
As a processor. For patient data, we act only on the instructions of the GP practice or healthcare organisation you are registered with. The practice is the data controller; we process patient data on its behalf under a Data Processing Agreement, solely to deliver our services to it. How your practice uses your data is described in your practice's own privacy notice. Details of our role, our sub-processors and our security measures are published at our Trust Centre: https://trust.hippolabs.co.uk/public.
PATIENT DATA
When a GP practice uses Hippo Recaller, it shares relevant patient data from its clinical system (such as name, date of birth, NHS Number, contact details, details of medical conditions and upcoming appointments) so that we can identify patients eligible for care and send invitations on the practice's behalf. When a practice uses AskHattie, its authorised staff ask questions about patients registered with it; AskHattie queries the patient record held on the practice's clinical system and returns answers with citations. AskHattie is read-only and does not write to the patient record.
For all patient data:
• the practice is the controller and we process only on its documented instructions, under our Data Processing Agreement;
• all processing takes place in the United Kingdom;
• we do not use patient data or user queries to train AI models;
• we respect the National Data Opt-out in accordance with NHS guidance; more information is at https://www.nhs.uk/your-nhs-data-matters/;
• we retain patient data only as long as needed to provide our services to the practice, and on termination we delete or return it in line with the Data Processing Agreement; and
• our sub-processors, and what each receives, are listed at https://trust.hippolabs.co.uk/public/subprocessors.
If you are a patient and want to exercise your data protection rights (access, correction, erasure, objection), please contact your GP practice, which controls your data. If you contact us, we will pass your request to your practice where we can identify it, or help you direct it there.
WHAT INFORMATION WE COLLECT AS A CONTROLLER
• Account and profile information you provide when you register for the portal or our products, or sign up to hear about them: name, email address, job title and practice details. ("Account Data")
• Acceptance and acknowledgement records. When you accept our terms in the onboarding portal, add a service or plan, or accept the AskHattie Terms of Use in the product, we record who accepted, their role, the version accepted and the date and time. We keep these records as evidence of the agreements formed. ("Acceptance Data")
• Platform activity records. We keep logs of use of our Platform by named users, including AskHattie query logs, for security, audit, clinical safety and information governance purposes. Where a log contains patient data, that content is processed as patient data on the practice's behalf; the record of which user did what is kept by us for these purposes. ("Activity Data")
• Support information you provide when you report a problem or contact our support team, including contact details, documentation or screenshots. ("Support Data")
• Communication and marketing preferences you set, or responses to surveys you take part in. ("Preference Data")
• Device and connection information, such as IP address, log-in data, browser type and version, time-zone setting, operating system and platform, collected through cookies and similar technologies. ("Technical Data")
• Website usage information, such as pages viewed, response times and interaction information. ("Usage Data")
HOW WE USE INFORMATION
We only use your personal information where the law allows us to:
• to perform the contract we have entered into (or are about to enter into) with you or your organisation, including operating our products and services, keeping records of acceptance, providing support, and protecting the safety and security of our Platform;
• where it satisfies a legitimate interest not overridden by your rights, for example maintaining security, audit and clinical safety records, improving our products, and protecting our legal rights;
• with your consent for a specific purpose, for example sending you marketing or publishing your testimonial. You can withdraw consent at any time by contacting us, though this will not affect use that has already taken place; or
• to comply with a legal or regulatory obligation.
We do not share your personal information with any company outside our group for marketing purposes without your express consent. The Legal Bases Table at the end of this policy summarises these bases.
HOW WE SHARE INFORMATION
We share limited, relevant information with third-party service providers that help us operate, provide, support, improve and market our products and services, such as messaging, email and hosting providers. Our current sub-processors, what each receives and where it is held, are listed at https://trust.hippolabs.co.uk/public/subprocessors. Service providers may access personal information only to perform their services, must keep it confidential and secure, and must process it in a manner that provides at least the level of protection required by this policy and our agreements with them.
We may share information on an aggregated or de-identified basis for research and analysis to improve our products and services, where it does not identify any individual or organisation.
If you use third-party software with our products, or follow links to third-party websites, their policies govern what they collect; we encourage you to review them.
We may share information with government and law enforcement officials to comply with applicable law, for example in response to legal process or national security requests.
If we are acquired or transfer our business as part of a merger, acquisition or asset sale, personal information may be disclosed or transferred as part of that transaction. We will notify you if such a transaction takes place and inform you of any choices you may have.
HOW WE STORE, SECURE AND RETAIN INFORMATION
We host data with Amazon Web Services in the eu-west-2 (London, UK) region. Our measures include:
• encryption in transit and at rest;
• password-protected accounts and access controls in line with AWS IAM requirements;
• access restricted to personnel and service providers on a strict need-to-know basis, under a duty of confidentiality and acting only on our instructions; and
• regular review of our collection, storage and processing practices.
A summary of our technical and organisational measures is published at https://trust.hippolabs.co.uk/public, and a full description is available from dataprotection@hippolabs.co.uk. We have procedures for suspected breaches and will notify you and any applicable regulator where legally required. No transmission over the Internet is completely secure, and we cannot guarantee absolute security.
Retention. We retain the personal information we control only as long as reasonably necessary for the purposes we collected it for, including legal, accounting and reporting requirements. Acceptance Data is kept for as long as needed to evidence the agreements formed, including after they end. Patient data is retained and deleted in accordance with our Data Processing Agreement with the controlling practice, not this policy.
YOUR RIGHTS
For the personal information we control, you have the right to:
• be informed of what we do with it;
• request a copy of what we hold about you;
• require us to correct inaccuracies;
• request erasure (we may need to keep some information for record-keeping, to complete transactions or to meet legal obligations, including Acceptance Data evidencing agreements);
• object to or restrict our processing, including for marketing;
• receive some of your information in a structured, commonly used, machine-readable format and have it transferred to another party; and
• withdraw consent at any time where processing relies on it.
Patients: your rights in your patient data are exercised against your GP practice, which controls it; see "Patient data" above.
You can opt out of marketing at any time by emailing dataprotection@hippolabs.co.uk; you will still receive communications necessary to the use of our products. We may ask for information to confirm your identity when you exercise your rights. Requests are normally free, though we may charge a reasonable fee for clearly unfounded, repetitive or excessive requests. We respond to legitimate requests within one month where we can, and will tell you if a complex request needs longer.
CHANGES TO THIS POLICY
We may amend this policy from time to time by posting the updated policy on our Platform. By continuing to use our Platform after changes take effect, you agree to the revised policy.
CONTACT US
Contact us at dataprotection@hippolabs.co.uk or in writing to Hippo Labs Limited, 3 Kingfisher Square, London, England, SE8 5DA. Data Protection Officer: Sachin Gupta.
Please contact us first with any questions or concerns. If your concerns are unresolved, you can complain to a supervisory authority; in the UK this is the Information Commissioner's Office (www.ico.org.uk).
COOKIES
Cookies are small text files placed on your device by a web server when you access our Platform. We use cookies to operate the Platform and to monitor usage and web traffic so we can improve our products and services.
We use both session cookies (lasting only for your visit) and persistent cookies (which stay in your browser and are read when you return).
We use the following types of cookies:
• Strictly necessary cookies: required for the operation of our site, for example cookies that enable you to log in to secure areas.
• Analytics cookies: used to understand how visitors use our site so we can improve it.
You can block cookies in your browser settings, but parts of our site may not work if you block strictly necessary cookies.
LEGAL BASES TABLE
Data
Our role
Legal basis
Account Data
Controller
Contract performance; legitimate interests
Acceptance Data
Controller
Contract performance; legitimate interests (evidencing agreements, legal claims)
Activity Data
Controller
Legitimate interests (security, audit, clinical safety, information governance)
Support Data
Controller
Contract performance
Preference Data
Controller
Consent; legitimate interests
Technical and Usage Data
Controller
Legitimate interests; consent where required for cookies
Marketing
Controller
Consent
Patient data
Processor on the practice's behalf
The practice's bases: Article 6(1)(e) UK GDPR and, for special category data, Article 9(2)(h) UK GDPR, as set out in the Data Processing Agreement
Contact dataprotection@hippolabs.co.uk for further detail on the basis for any particular processing activity.