YHEC PRIVACY NOTICE – 17 MAY 2023
York Health Economics Consortium (YHEC) is committed to ensuring that your privacy is protected. We want you to know that you can trust us to respect your privacy and keep your personal information safe, in accordance with the UK General Data Protection Regulation (UK GDPR). This privacy notice explains how we use the information we collect about you. By submitting your information, you consent to the use of that information as set out in this notice.
For the purposes of this privacy notice, YHEC is the Data Controller as defined in the UK GDPR. We are registered with the Information Commissioner’s Office and our entry can be found at https://ico.org.uk/ESDWebPages/Entry/Z6136867. Our registration number is Z6136867. YHEC is a company wholly owned by the University of York and the University’s Data Protection Officer is Durham Burt.
This privacy notice is for any individual who provides personal data or special category data to YHEC.
Personal data may include name, date of birth, postal address, email address, telephone number, emergency contact details, education records (past and present).
Special category data includes information about disability, health, ethnicity and racial origin.
The legal basis for processing your data is that you have given us your consent or, in the case of special category data, your explicit consent.
As part of The University of York, YHEC takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data and special category data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability.
YHEC has implemented appropriate technical and organisational measures to protect your data. Access to information is restricted and is given on a need-to-know basis, and security arrangements are regularly reviewed to ensure their continued suitability. We undertake to fulfil our responsibilities as follows:
YHEC’s incident management procedures are available in full in the YHEC Information Governance Policy. This includes the notification process in the event of a data security incident.
We keep your personal information:
OR (if longer):
OR (if sooner):
We will regularly assess the personal data that we hold to determine its relevance and destroy your personal data if we no longer require it or no longer provide any services to you.
Retention timeframes will be determined in line with the YHEC Retention Schedule.
You have a number of rights in relation to your personal data. These include the right to:
Please see Section 11 for how to contact us.
When registering on YHEC’s mailing list, we ask you to provide your email address. We use this information to send you news and information about YHEC.
YHEC uses Campaign Monitor to manage the mailing list. Their privacy notice can be found at https://www.campaignmonitor.com/policies/#privacy-policy.
You will be given an opportunity to unsubscribe in every email we send.
Please note, if you contact YHEC through a social media platform, you should familiarise yourself with the privacy information of that platform.
Online training courses are delivered via Zoom. The Zoom privacy statement can be found at https://blog.zoom.us/updated-zoom-privacy-statement./
We use Google Forms to evaluate our training courses. Completing an evaluation is optional. Responses are collected anonymously but IP addresses may be logged; these are recorded in the Google Drive audit log which the University retains for 180 days and which is only accessible to the Cyber Security team and a limited number of Google Administrators in the University. The University’s policies on this are available at https://www.york.ac.uk/about/legal-statements/#tab-4 and https://www.york.ac.uk/it-services/google/policy/terms/.
Online meetings will take place via platforms including Zoom and Microsoft Teams. The Zoom privacy statement can be found at https://blog.zoom.us/updated-zoom-privacy-statement./; the Teams privacy statement can be found at https://learn.microsoft.com/en-us/microsoftteams/teams-privacy.
If you are unhappy with the way in which YHEC has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns.
If you would like to exercise any of your rights as outlined in this notice or have any questions about the way in which YHEC handles your personal data, please contact us in writing at email@example.com.
Our privacy notice is regularly reviewed. This notice was last updated on 17 May 2023.
A Job Applicant Privacy Notice is available at https://yhec.co.uk/careers/.