Legal
Privacy notice
What this website collects, why, how long it is kept, and what you can ask us to do about it.
The short version
- This site sets no advertising or profiling cookies, and never sells or shares your data for advertising.
- We count page views without cookies, for every visitor. Google Analytics is offered separately and stays off unless you accept it; you can change your mind at any time below.
- We only hold personal data you deliberately give us: a newsletter sign-up, an Open Pilot expression of interest, or an event registration.
- We never ask for, and never want, patient or clinical data through this website.
- You can ask us to delete your data at any time and we will.
Who is responsible
This website is operated by the HEALTH-ER consortium, coordinated by OBRELA Security Industries, under Grant Agreement No. 101299528 of the Digital Europe Programme. The granting authority is the European Cybersecurity Industrial, Technology and Research Competence Centre.
For any question about your personal data, or to exercise the rights described below, contact info@health-er.eu.
What we collect, and why
Newsletter subscription
- What
- Email address, and optionally your name, organisation and country.
- Why
- To send you the project newsletter, roughly four issues over the project.
- Legal basis
- Your consent (GDPR Article 6(1)(a)), given when you tick the box on the sign-up form. We record the wording you agreed to and when, and send you a confirmation email at once, with a link to unsubscribe in case someone else entered your address.
- How long
- Until you unsubscribe, or twelve months after the project ends, whichever comes first.
Open Pilot expression of interest
- What
- Organisation name and type, country, your name, job title and work email, your areas of interest, and anything you write in the free-text box.
- Why
- So the Open Pilot team can contact you and understand what would be useful. Aggregated, anonymised counts (how many organisations, from how many countries) are reported as project indicators.
- Legal basis
- Your consent (GDPR Article 6(1)(a)).
- How long
- For the duration of the project plus the retention period required by the Grant Agreement for audit purposes.
Event registration
- What
- Your name, email, and optionally organisation, job title, country, role and any accessibility or dietary requirements.
- Why
- To manage your participation in the event and to report attendance figures as project indicators.
- Legal basis
- Your consent (GDPR Article 6(1)(a)).
- How long
- Twelve months after the event, unless you also subscribed to the newsletter.
Page-view counting (always on)
- What
- The path of the page and the time it was viewed. Nothing else: no IP address, no browser or device details, no cookie, no identifier of any kind. Two visits by the same person cannot be told apart.
- Why
- To report the visitor numbers required as a project indicator in deliverables D6.2 and D6.4, and to see which pages are useful.
- Legal basis
- No personal data is processed, so the GDPR does not apply to it, and nothing is stored on or read from your device, so no consent is required under Article 5(3) of the ePrivacy Directive.
- How long
- For the life of the project and its reporting period.
Google Analytics (only if you accept)
- What
- Google sets cookies on your device and receives your IP address, pages viewed, approximate location, and browser and device information. Google acts as our processor, and may transfer data outside the EU under the EU-US Data Privacy Framework and standard contractual clauses.
- Why
- To understand how visitors find and move through the site in more detail than the anonymous count allows.
- Legal basis
- Your consent (GDPR Article 6(1)(a)) and Article 5(3) of the ePrivacy Directive. Nothing is loaded and no request reaches Google until you accept. You can withdraw at any time, as easily as you gave it.
- How long
- Up to 14 months in Google Analytics.
Who sees your data
Personal data collected through this website is accessible to the partners in the HEALTH-ER consortium who need it for the purpose you gave it for — for example, the Open Pilot team at HOPE and EYD for expressions of interest.
It is not sold, rented or shared for marketing. Technical service providers (hosting, database, email delivery) process data on our instructions under written agreements, with processing located in the European Union.
The granting authority may access project records for audit purposes, as provided for in the Grant Agreement.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or transfer it elsewhere. Where processing is based on consent, you can withdraw that consent at any time — this does not affect anything done before you withdrew it.
Every newsletter contains an unsubscribe link. For anything else, email us and we will act within one month.
If you believe we have handled your data improperly, you have the right to lodge a complaint with your national data protection authority.
Clinical and patient data
No patient data, clinical data or special-category health data is ever collected through this website, and none should ever be sent to us through it.
Where the project processes data inside hospital environments during the pilots, that is governed separately by written agreements with the hospital concerned and by the project’s Data Management Plan, under the responsibility of the Privacy & Ethics Manager.
See also the legal notice and our accessibility statement.