YHEC PRIVACY NOTICE – 04 September 2025

York Health Economics Consortium (YHEC) understands that your privacy is important to you and that you care about how your personal data is used. We are committed to ensuring that your privacy is protected and your personal information is kept safe, in accordance with the UK General Data Protection Regulation (UK GDPR). By using this website, you consent to the use of your data as set out in this notice.

Information about us

This website belongs to YHEC Limited, which is registered in England under company number 04144762. While YHEC is wholly owned by the University of York, YHEC is the Data Controller, for the purposes of this privacy notice.

Registered office: Enterprise House, York Science Park Innovation Way, Heslington, York, YO10 5NQ

Telephone number: +44 (0) 1904 323620

VAT number: GB 647 2055 41

Information Commissioner’s Office Registration Number: Z6136867

Data Protection Officer: Durham Burt (University of York)

What does this policy cover?

This privacy policy only applies to your use of YHEC’s website. This website may contain links to other websites, and we have no control over how your data is collected, stored or used by these other websites. We advise you to check the privacy policies of any such websites before providing data to them. 

Who is this notice for?

This privacy notice is for any individual who provides personal data or special category data to YHEC. Personal data may include name, date of birth, postal address, email address, telephone number, emergency contact details, education records (past and present). Special category data includes information about disability, health, ethnicity and racial origin.

The legal basis for processing your data is that you have given us your consent or, in the case of special category data, your explicit consent.

A separate Job Applicant Privacy Policy is available for anyone applying for employment at YHEC.

What are my rights?

You have a number of rights in relation to your personal data. These include the right to:

• Find out how we process your personal data.
• Request that your personal data be corrected if you believe it is inaccurate.
• Withdraw your consent to our processing of your personal data.
• Obtain a copy of the personal information that we hold about you. We will take steps to verify your identity before responding to your request. After confirming your identity, we will respond as soon as possible and, in any event, within one month. 

For more information about our use of your data, please contact us.

How do we use and store your information?

YHEC has implemented appropriate technical and organisational measures to protect your data. Access to information is restricted and is given on a need-to-know basis, and security arrangements are regularly reviewed to ensure their continued suitability. Our data protection processes are as follows:

• We only collect and retain relevant and essential data.
• We store your information safely and securely, protecting it from loss, misuse, unauthorised access and disclosure.
• We ensure that appropriate measures are in place to protect personal data.
• We destroy your information securely, when required.
• We work hard to keep your personal data up to date.
• We do not share the information that is provided to us, except:
  • With specific third-party service providers, as detailed on this webpage.
  • If we have a legal obligation to disclose your information
• We comply fully with our obligations under the UK General Data Protection Regulation.

YHEC’s incident management procedures are detailed in the YHEC Information Governance Policy, which is available upon request. This includes the notification process in the event of a data security incident.

How long do we keep your personal information?

We keep your personal information:

• For as long as we need to for the purposes for which it was collected.

OR (if longer):

• For any period for which we are required to keep personal information to comply with our legal and regulatory requirements.

OR (if sooner):

• Until you ask us to delete your personal data, in accordance with your rights.

We will regularly assess the personal data that we hold to determine its relevance and destroy your personal data if we no longer require it or no longer provide any services to you.

YHEC’s mailing list

When registering on YHEC’s mailing list, we ask you to provide your email address. We use this information to send you news and information about YHEC. YHEC uses Campaign Monitor to manage the mailing list, which processes data in accordance with their privacy notice. You will be given an opportunity to unsubscribe in every email.

YHEC’s social media

If you interact with or contact YHEC through a social media platform, you should familiarise yourself with the privacy notice of that platform. 

YHEC’s training courses

Users will be required to create an account to book training courses. We will store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

The information is held by YHEC in accordance with the provisions of the UK GDPR. YHEC’s website is hosted by Castlegate IT, who has access to the information provided but does not process this data. You can find Castlegate IT’s privacy policy on their website.

The following websites or services are also used to help deliver our training courses. You can view all privacy policies through the links provided:

• Occasionally, training courses may be promoted and ticketed through Eventbrite.
• Upon booking, you will receive an invitation to the training course via Google Calendar, which process data in line with Google’s privacy policy.
• Payment for training courses is processed by Stripe.
• Online training courses are delivered via Zoom.
• Google Forms are used to evaluate our training courses. Completing an evaluation is optional. Responses are collected anonymously but IP addresses may be logged; these are recorded in the Google Drive audit log, which the University of York retains for 180 days and is only accessible to the Cyber Security team and a limited number of Google Administrators at the University. The University processes this data in line with its legal statement and Google policy.

YHEC’s client relationship management

We use a third-party client relationship management (CRM) system, Salesforce, to manage our client data. The purpose of this system is to help us efficiently and effectively manage our business operations, including client communication, sales and marketing, and customer service.

The personal data we may store in Salesforce includes information that you provide to us directly (e.g. through web forms, email or phone calls). While we maintain ultimate control over your data, it is important to be aware that your information may be processed and stored on Salesforce’s servers. For more information, please refer to Salesforce’s privacy policy.

Videoconferencing

Online meetings will take place via platforms including Zoom and Microsoft Teams. Zoom and Microsoft Teams process any data in accordance with their respective privacy policies. In the case of other platforms being used, please familiarise yourself with their privacy policy.

Content embedded from other websites

This site includes some embedded content (e.g. videos from YouTube). Embedded content behaves in the same way as if you visit that website directly. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that content.

Videos embedded from YouTube are bound by YouTube’s terms and service, which is also subject to Google’s privacy policy.

Job applicant privacy notice 

Please refer to our dedicated Job Applicant Privacy Policy.

Your right to complain

If you are unhappy with the way in which YHEC has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern, visit the Information Commissioner’s Office website.  

Contact us

If you would like to exercise any of your rights as outlined in this notice or have any questions about the way in which YHEC handles your personal data, please contact us in writing at [email protected].

Updates and changes to our privacy notice 

Our privacy notice is regularly reviewed. This notice was last updated on 04 September 2025.