Out-There HealthTech
Connect, Collaborate and Grow
Privacy Notice
1. Who we are
Out-There HealthTech is a trading name of Health On Cloud Productions Limited, a company registered in England and Wales under company number 15294054. Our registered office details are held on the public register at Companies House.
We are the data controller for the personal data described in this notice. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB691579.
We operate outtherehealthtech.com, a free-to-access professional community for the healthtech and life sciences sector, together with the Landing Pad programme, our Ecosystem Partner programme, Out-There Communities, and associated services.
Contact for data protection matters:
Simon Benson, CTO
Email: community.management@outtherehealthtech.com
2. Summary
This notice explains what personal data we collect, why we collect it, who we share it with, and what rights you have. In short:
- If you simply browse our website, we collect very little about you.
- If you join our community, we collect the profile information you choose to provide, so that other members can find and connect with you.
- If you apply to the Landing Pad programme, we collect information about you and your business so we can assess your application and support you.
- If you join or run an Out-There Community, some of your data is managed by that community’s leaders as well as by us.
- We only share your data with regional partner organisations if you have specifically agreed to it, and you can change your mind at any time.
- We do not sell your data, we do not share it with advertisers, and we do not use it to train artificial intelligence models.
3. What personal data we collect
3.1 Website visitors
When you visit our website without logging in, we may collect:
- Your IP address
- Browser type and version, operating system and device information
- Pages visited, time spent, and referring website
- Cookie identifiers (see section 9)
3.2 Out-There HealthTech members
When you register for a member account, we collect:
- Account information: your name, email address, password (stored in encrypted form), profile photo and background image, and your community handle
- Location: city and country (required), and further address detail if you choose to provide it
- Professional profile: your role, level of seniority, professional classification, home NHS region, operating regions, website URL, LinkedIn URL, and biography
- Sector information: whether you have a clinical background, whether you work within the NHS, your clinical domains of interest, and your technology verticals
- Community information: the goals you publish (“what I’m looking for”), what you offer the community, and your membership type
- Activity: posts, comments, messages sent through the platform, spaces joined, events registered for, and courses taken
- Communication preferences: your notification and email settings
Most profile fields are optional. Fields marked as required are needed to operate your account and make the member directory useful to the community. All profile content is written by you — we do not generate it for you.
3.3 Organisation records
If you create or edit an organisation profile, we collect the organisation’s name, description, logo, images, website, contact details, address, email domains, region, clinical domains and technology verticals, together with a record of which users are associated with that organisation and in what role.
Organisation information is usually not personal data. However, where an organisation is a sole trader or a partnership, or where its registered address or telephone number is that of an individual’s home, we treat that information as personal data.
3.4 Landing Pad applicants
If you apply to the Landing Pad programme, we collect the information above together with:
- About you: your name, job title, business email address and telephone number
- About your organisation: registered or trading name, UK company number, country of origin, size, head office address, and the regions in which you operate
- About your solution: a description of your technology, product or service, your self-declared Technology Readiness Level, clinical domains and technology verticals, and your regulatory status
- About your position: UK legal entity status, funding stage, SEIS/EIS status, grant history, funding requirements, and VAT number where provided
- About your needs: your target region, workspace and facilities requirements, anticipated recruitment, innovation support needs, academic and NHS engagement sought, and professional services required
- Your consents: a record of which optional consents you have given, the wording presented to you, and the date and time
3.5 Ecosystem Partners
If your business applies to join as an Ecosystem Partner, we collect your organisation’s details, the services you offer, your contact information, and information about your application and membership status.
3.6 Out-There Communities
Out-There Communities are independent communities hosted on our platform, each run by its own leaders, with their own branding, membership, events and content.
If you apply to join a community, we collect your application, the information you provide in support of it, and a record of the decision. If admitted, we hold your community profile, your role within that community, your posts and messages in that community’s spaces, your event RSVPs, and your activity within the community.
If you lead or manage a community, we additionally hold information about your administrative role, the settings and content you configure, the membership decisions you make, and a record of communications you send to your members through our tools.
Section 5.3 explains who is responsible for this data and how it is shared.
3.7 System and security logs
We maintain activity logs recording logins, data access, administrative changes and other significant events on our platform. These logs contain user identifiers, IP addresses and timestamps.
3.8 Information you send us
If you contact us by email, through a contact form, or through the platform, we keep a record of that correspondence.
4. Why we process your data, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Create and manage your account | To give you access to the community and its features | Contract |
| Display your profile in the member directory | So other members can find and connect with you | Contract, and consent for optional fields |
| Enable member-to-member messaging, posts and comments | To operate the community | Contract |
| Process Landing Pad applications | To assess your application and provide the programme | Contract, and legitimate interests in assessing applications |
| Provide and host Out-There Communities | To operate community spaces on behalf of their leaders and enable you to take part | Contract |
| Process your application to join a community | So the community’s leaders can decide whether to admit you | Contract, and legitimate interests of the community in managing its membership |
| Share your details with regional partner agencies | To connect you with relevant regional support | Consent |
| Send you newsletters, updates and event invitations | To keep you informed about the ecosystem | Consent |
| Send you service messages about your account | To operate your membership | Contract |
| Maintain security and activity logs | To protect the platform and the data we hold | Legitimate interests in security |
| Moderate the community | To keep the community safe and useful | Legitimate interests in running a safe community |
| Analyse how the platform is used | To improve our services | Consent, through our cookie banner |
| Meet legal and regulatory obligations | Accounting, tax, and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms, and have concluded that they are not. You can ask us for details of that assessment, and you have the right to object (see section 8).
Where we rely on consent, you can withdraw it at any time without affecting your membership or the lawfulness of processing before you withdrew.
5. Who we share your data with
5.1 Other Out-There HealthTech members
Your profile is visible to other logged-in members of the main ecosystem. This includes the fields you have completed: your name, photo, role, seniority, classification, regions, biography, clinical domains, technology verticals, goals, what you offer, and any website or LinkedIn links you provide. Your email address and telephone number are not displayed to other members.
Anything you post publicly within the community — posts, comments, and contributions to spaces — is visible to other members of those spaces.
5.2 Regional partner agencies
If you are a Landing Pad applicant and have given specific consent, we share relevant information from your application with regional partner organisations so they can offer you inward investment support, premises guidance, recruitment support, introductions and other regional services.
The current list of partner agencies is maintained at outtherehealthtech.com/landingpad/gm/gmpartners, together with links to each partner’s own privacy notice.
We share only the minimum information relevant to each introduction. Once a partner receives your details they act as an independent data controller and are responsible for their own use of your data under their own privacy notice. If you withdraw consent, we stop sharing immediately and notify the partner, but we cannot compel them to erase information they already hold where they have their own legal reason to keep it.
We put written data sharing agreements in place with partner organisations before sharing any personal data with them.
5.3 Out-There Communities and their leaders
Each Out-There Community is run by its own leaders, who decide who joins, what is published, and what is sent to members. We provide and maintain the platform they use.
What community leaders can see. The leaders and managers of a community you have applied to or joined can see your application, your community profile, your role, your activity within that community, and your contact details for the purpose of communicating with you about the community. They can also send you messages and event notifications using tools we provide.
What other community members can see. Your profile appears in that community’s member directory if the directory is enabled, and other members can contact you through it. Anything you post in the community’s spaces is visible to other members of that community.
Public visibility. Community leaders can choose whether certain pages — such as the community’s directory or events — are visible to members only or to the public. Check the community’s own pages to see how it is configured.
Who is responsible. We and the community’s leaders each have responsibilities for your data. Broadly, we are responsible for the security of the platform, for the technical measures protecting your data, and for our own use of your data as an Out-There HealthTech member. The community’s leaders are responsible for decisions about membership, for the content they publish, and for the communications they send you. We have a written agreement with each community setting this out, and you can ask us for a summary of it.
Exercising your rights. You can contact either us or the community’s leaders about your data. Whichever you contact will work with the other to make sure you get a complete response. If you are unsure who to approach, email us and we will handle it.
If a community leaves the platform. If a community stops using Out-There Communities, we will tell affected members and confirm what happens to their data. We do not transfer community member data to a leader’s own systems without informing members first.
5.4 Service providers
We use a small number of third-party providers who process data on our behalf under written contracts:
| Provider | What they do | Where data is held |
|---|---|---|
| IONOS | Website and database hosting, and email delivery | United Kingdom / EU |
| Google Workspace (Drive) | Encrypted off-site backups of our website and database | Stored at rest in Europe; see section 6 |
| Google Analytics | Website analytics, only where you have consented to analytics cookies | United States |
| Notion Labs, Inc. | Internal business system holding organisation records used to maintain our ecosystem directory | United States |
| PayPal | Payment processing for paid memberships | United Kingdom / EU |
These providers act on our instructions and may not use your data for their own purposes.
A note on Notion. We use Notion as an internal business system. It holds the information that appears in our public ecosystem directory — the organisation’s name, description, location, website, and its clinical and technology focus areas. Most of this is not personal data, but it may be where an organisation is a sole trader or a partnership, or where its listed address or telephone number belongs to an individual’s home.
5.5 Other disclosures
We may disclose personal data where we are required to do so by law, regulation or court order, or where necessary to establish, exercise or defend legal claims. If our business is transferred or restructured, personal data may be transferred as part of that process; we would notify you beforehand.
We do not sell your personal data, and we do not share it with advertisers.
6. International transfers
Our website, database and email are hosted in the United Kingdom and the EU. Most personal data never leaves that footprint.
Two of the services we use are provided by companies based in the United States:
- Google. We have configured Google Workspace to store our data at rest in Europe. However, Google may process data in other locations, and Google support personnel may access it from outside Europe. These transfers are covered by Google’s Cloud Data Processing Addendum, which incorporates the Standard Contractual Clauses and the UK International Data Transfer Addendum, and by Google’s certification under the UK Extension to the EU–US Data Privacy Framework.
- Notion. Organisation records held in Notion are stored in the United States. This transfer is covered by Notion’s Data Processing Addendum, which incorporates the Standard Contractual Clauses and the UK International Data Transfer Addendum.
If you would like details of the safeguards applying to a particular transfer, please contact us.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Member accounts and profiles | For as long as your account is active, and for 12 months after you close it or after 24 months of inactivity |
| Posts, comments and community contributions | Retained after account closure to preserve the integrity of community discussions, but anonymised on request |
| Landing Pad applications (successful) | Duration of membership, plus 24 months |
| Landing Pad applications (unsuccessful) | 12 months from decision |
| Community membership and profiles | For as long as you are a member of that community, and for 12 months afterwards |
| Community applications (unsuccessful) | 6 months from decision |
| Organisation records | For as long as the organisation is listed in our directory, and for 12 months afterwards |
| Consent records | 3 years from withdrawal or expiry, as evidence of compliance |
| Activity and security logs | 12 months |
| Marketing preferences and suppression lists | Indefinitely, so we do not contact you after you have opted out |
| Correspondence | 24 months from last contact |
| Backups | Overwritten on a rolling 30 day cycle |
| Financial and accounting records | 6 years, as required by law |
We review these periods as part of our annual data protection review.
8. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data — which is what this notice is for
- Access the personal data we hold about you
- Rectification — have inaccurate data corrected. You can edit most of your own data directly through your account
- Erasure — ask us to delete your data, where we have no overriding reason to keep it
- Restrict processing in certain circumstances
- Data portability — receive your data in a machine-readable format
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent at any time, where we rely on consent
To exercise any of these rights, email community.management@outtherehealthtech.com. We will respond within one month. We will not charge you, unless a request is manifestly unfounded or excessive.
You can manage most of your data yourself through your account settings, including editing your profile, changing your notification preferences, and withdrawing consent for partner sharing.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
9. Cookies
We use cookies and similar technologies. Some are essential to operate the site; others we use only with your consent.
Essential cookies
- Session and login cookies – keep you logged in and maintain your session. Login cookies last two days, or two weeks if you select “Remember Me”. They are removed when you log out.
- Screen preference cookies – remember your display choices. These last one year.
- Security cookies – protect against cross-site request forgery and other attacks.
- Cookie consent cookie – records your cookie preferences so we do not ask you on every visit.
Analytics cookies (consent required)
We use Google Analytics to understand how the site is used so we can improve it. These cookies collect information about the pages you visit, how long you spend, and how you arrived. They are set only if you accept analytics cookies through our cookie banner, and you can change your choice at any time.
Google Analytics is provided by Google LLC. Information about how Google uses this data is available at policies.google.com/technologies/partner-sites.
You can also control cookies through your browser settings. Blocking essential cookies will prevent you from logging in.
10. Embedded content
Pages on this site may include embedded content such as videos or documents from other websites. Embedded content behaves as though you had visited that website directly, and those websites may collect data about you, set cookies, and monitor your interaction with the embedded content. We recommend reviewing the privacy notice of any third-party site whose content appears here.
11. Security
We take appropriate technical and organisational measures to protect personal data, including:
- Encryption of data in transit and at rest
- Named individual user accounts with enforced password complexity
- Access controls limiting who can see what
- Logging and monitoring of access to sensitive data
- Regular backups, held securely and encrypted
- Documented procedures for identifying and reporting personal data breaches
No system is completely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.
12. Images and uploads
If you upload images to the platform, please avoid uploading images containing embedded location data (EXIF GPS), as other users may be able to extract that information.
13. Children
Out-There HealthTech is a professional community intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Automated processing and artificial intelligence
We do not use artificial intelligence to generate, enrich or analyse your profile or your application. Everything in your profile is written by you. We do not send your personal data to any AI service, and we never use it to train an AI model.
We do use simple automated processes to organise information – for example, matching an application to an existing organisation record, categorising applications by region or sector, and suggesting members who may share your interests. These are search and filtering functions. They do not make decisions about you.
No decision that produces legal effects concerning you, or similarly significantly affects you, is made by automated means. All decisions about Landing Pad applications, Ecosystem Partner memberships and community memberships are made by a person.
15. Changes to this notice
We review this notice at least annually and update it when our processing changes. Where changes are significant, we will notify members directly. The version number and date at the top of this page tell you which version you are reading.
16. Contact us
For any questions about this notice or how we handle your data, please email community.management@outtherehealthtech.com or use our Contact Us form.
If you need a postal address, our registered office is recorded at Companies House under company number 15294054.
