Privacy notice

How Leaflet Desk uses information about NHS staff who use the studio, and about patients who are sent an e-leaflet.

Last reviewed: November 2026

Who we are

Leaflet Desk is an online studio that helps NHS teams ("centres") write, approve, print and send patient information leaflets. It is run by Golden Shutter Ltd, a company registered in England and Wales (company number 12649340), whose registered office is at Flat 104 Chenla Building, Conington Road, London, England, SE13 7FE ("we", "us").

Who is responsible for your information

Golden Shutter Ltd is the data controller for its own account data: staff accounts, sign-in and security records, and the service emails we send.
Each centre (usually an NHS trust) is the data controller for its content: its leaflets, its pictures, its print orders and the decision to send an e-leaflet to a patient. For that content, Golden Shutter Ltd acts as a data processor: we only use it to provide the service, acting on the centre's instructions, under a written agreement with each centre.

What we store about staff

Your name, work email address and a securely hashed password (we never see or store the password itself).
Which centres you belong to and your role in each (admin, editor or approver), whether you have been nominated as an approval officer, and invitations sent to you.
Sign-in sessions, including the device's IP address and browser type, so you stay signed in and we can spot misuse.
A history of changes (who created, edited, approved, ordered or sent what, and when), so centres have a clear audit trail. Team changes such as role changes, removals and approval officer nominations are recorded too. The name of whoever approved a leaflet can be printed on it.
Short-lived counters of sign-in and password reset attempts, keyed on IP address or email address, to slow down password guessing.
Print order details you enter, such as a delivery name, address, phone number and email.

We use this to run the service, keep it secure, send you service emails (invitations, password resets, review reminders and print order updates) and help if something goes wrong. Our lawful basis is our legitimate interest in running a secure service for the centres that use it, and, for centres, their public task.

Patients and e-leaflets

Leaflets should not contain information about individual patients. Leaflet Desk is not a patient record.

When a centre sends an e-leaflet to a patient:

The patient's email address and (optional) first name are used once to send the email and are not stored. The history keeps only a masked address, such as m***@example.com.
The link contains a long random code. We store only a scrambled (hashed) copy of it, so a copy of our database cannot open anyone's leaflet.
If the team adds a procedure date, it is kept with the link only to show the timeline, and goes when the link expires (after 90 days, or sooner if the team withdraws it).
We do not track whether an individual patient opens their leaflet. We only count the total number of views of each leaflet per day.
If a patient answers "Was this helpful?" or leaves a comment, it is kept without anything that identifies them: answers are added to counts for the leaflet, and comments are kept with the day only.
Ticks and notes a patient makes on their questions screen stay on their own phone (in the browser's storage). They are never sent to us or to the centre.
The email never names a condition or procedure. Its subject is "Information from" and the centre's name.

A printed leaflet may carry a QR code that opens the latest approved version. That link holds no information about the person who opens it.

Cookies and similar technology

We use only strictly necessary cookies: secure, HTTP-only cookies that keep signed-in staff signed in. They are not used for advertising or tracking, so we do not ask for consent to use them.

The browser's own storage is used for things you choose: the demo studio (which stays in your browser), guide and display preferences, a patient's saved questions, and a note that a leaflet has already been counted as viewed in this browser session. Nothing in it is sent to us.

Some typefaces are loaded from a third-party font service, which receives your device's IP address when the page loads.

We do not use analytics or advertising cookies.

Who we share information with

We use a small number of suppliers to run the service: a hosting provider, a database provider and an email delivery provider (which sends from its EU region). They act on our instructions and may not use the information for their own purposes. If a supplier handles information outside the UK, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement. A current list of suppliers is available on request.

Print orders are handled by us and passed to our print partner, who uses the delivery details only to print and deliver the order. We never sell information or share it for marketing.

How long we keep information

Staff accounts: until the account is closed. Removing someone from a centre ends their access straight away.
Leaflets, their versions and print orders: for as long as the centre uses Leaflet Desk, or until it deletes them.
The history of changes: for as long as the centre uses Leaflet Desk, so it can always show who approved each version. When a centre stops using Leaflet Desk, we give it a copy on request and then delete its leaflets and history.
E-leaflet links: they stop working after 90 days. The procedure date goes with them.
Sign-in attempt counters: minutes, not days.

Your rights

You can ask to see the information we hold about you, to correct it, or to have it deleted or restricted. You can also object to how we use it. If the information belongs to a centre's records, we will pass your request to that centre and help it respond. Contact rodnieoro@gmail.com.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Security

Connections are encrypted. Passwords are hashed. Sign-in, sign-up and password reset are rate limited. Each centre can only see its own work, and every request is checked on the server. A password reset signs the account out on every device.

Changes to this notice

We will update this page when the way we use information changes, and show the date it was last reviewed.

Hi.