Privacy policy

Who operates the application

GP Operations Assistant is operated by Dr. Shafi and Partners as part of Project Hermes. Nova is its management assistant for authorised, non-clinical business administration.

For privacy questions, access requests, corrections or deletion requests, contact gp.operations.assistant@gmail.com.

Google information we access and use

Depending on the permissions granted by the account holder, the application can access Gmail messages, attachments, labels and message metadata; authorised Google Drive files and activity; calendar entries; and task lists. It stores authorisation credentials to maintain the connection.

This information is used to retrieve business information, summarise documents and communications, prepare correspondence, organise work, and manage schedules and actions. Where authorised, the application can send or modify email and update calendars and tasks. Actual actions depend on the granted permissions and configured workflow.

The application is intended for non-clinical administration. Users must not submit patient records or use it for clinical decisions or emergency support.

AI processing through OpenRouter

Nova accesses DeepSeek models through OpenRouter. Content included in an AI request, such as relevant email or document text and conversation context, is sent to OpenRouter and then to an inference provider that runs the selected model. Generated responses return through OpenRouter to the application.

The inference provider may vary according to routing and availability. Using a DeepSeek model does not necessarily mean the request is sent to DeepSeek’s own API. OpenRouter publishes information about provider data practices and its own privacy policy.

The account-level settings reviewed on 4 September 2026 disable routing to paid or free endpoints that train on request data, disable free endpoints that publish prompts, and disable the option to share inputs and outputs for a discount. These describe the account configuration reviewed, rather than an independent audit of every request.

Zero Data Retention filtering is not enabled. Providers may retain requests or responses under their applicable terms even where model training is excluded. This application does not promise zero retention by external providers. Processing locations depend on the selected provider and may be outside the United Kingdom; no UK-only or EU-only processing guarantee is made.

Storage and access

Credentials, conversation history, working files, generated outputs and operational logs may be stored on the project server. Administrative knowledge, exports and backups may also contain information derived from Google services. Access depends on the project’s configured accounts and permissions.

Authorised users and administrators may access information needed for the relevant workflow, support or maintenance. Publishing this information website does not grant visitors access to the assistant, its credentials or its connected Google accounts.

Retention and deletion

Dr. Shafi and Partners has not yet established a formal retention schedule for application records. No fixed automatic deletion period is currently specified for conversations, working files, logs, exports or backups. Stored copies may remain until manually removed or removed under the applicable backup configuration.

You can contact the operator to request a review or deletion of information held by the application. A request may need to cover working copies, derived records, exports and backups separately. No immediate deletion from every backup or external provider is promised. Provider-held copies are subject to the relevant provider’s retention and deletion arrangements.

Control of your Google connection

You can review or revoke access in your Google Account connections. Revocation prevents further access using that authorisation and may stop dependent workflows. It does not delete messages or documents in Google, or automatically erase copies already stored by the application.

Permitted use of Google API data

Use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements. Google-derived information must be used for the disclosed administrative features and must not be sold, used for advertising, or used to develop or train general-purpose AI models.

This information website

The website is hosted through OpenAI Sites using Cloudflare infrastructure. Its pages do not contain a Google sign-in form, file upload or application database. The site code adds no advertising or analytics trackers. Hosting providers may process technical information, such as IP addresses and request details, to deliver and secure the website under their applicable policies.

Changes and questions

This policy should be updated when the application’s data handling changes, including changes to its AI services or retention arrangements. Contact the operator using the email address above for information about the current configuration or a particular record.