This privacy notice explains how EMIS Group Limited trading as Enlivio Health (“we”, “us”, “our”) collects, uses, shares and protects personal data when you use our website, contact us, subscribe to updates, use our products or services, or otherwise interact with us. Please note that certain of our sites (such as Patient Access) and products will have their own specific privacy notices or policies which will apply in place of this notice. 

EMIS Group Limited includes:

•  Egton Medical Information Systems Limited (™ Enlivio Health). Egton Medical Information Systems Limited is a company registered in England and Wales. Registered number: 02117205. Registered office: Fulford Grange, Micklefield Lane, Rawdon, Leeds LS19 6BA; and
• EMIS Health India Private Limited (company number (India) U72900TN2015FTC101749). 

1. Who we are

For the purposes of data protection law, the controller of personal data covered by this privacy notice is:

Egton Medical Information Systems Limited
Address: Fulford Grange, Micklefield Lane, Rawdon, Leeds LS19 6BA
Email: privacy@enliviohealth.com
Data Protection Officer / Privacy contact: privacy@enliviohealth.com

If different Enlivio group companies collect or use personal data for different purposes, we will identify the relevant controller at the point the data is collected or otherwise explain this in a supplementary notice.

2. What this notice covers

This notice explains:

• what personal data we collect;
• how we collect it;
• how we use it;
• the legal bases we rely on;
• who we share it with;
• whether we transfer it internationally;
• how long we keep it;
• your rights; and
• how you can contact us or make a complaint.

This notice applies to personal data collected through our website and through related communications, products, apps, services and business interactions, unless a more specific privacy notice applies.

3. The personal data we collect

We may collect and use the following categories of personal data, depending on how you interact with us:

A. Information you provide directly

• your name;
• job title;
• organisation name;
• business email address;
• phone number;
• account or login details;
• enquiry details and the content of messages you send to us;
• preferences you give us, including marketing preferences;
• information you provide when completing forms, registering for events, downloading content, requesting demonstrations, or subscribing to newsletters.

B. Information we collect automatically

When you use our website, we may automatically collect certain technical and usage information, such as:

• IP address;
• browser type and version;
• device identifiers;
• operating system;
• referral source;
• pages visited;
• dates and times of visits;
• content viewed or downloaded;
• clicks and navigation behaviour;
• cookie identifiers and similar online identifiers.

Some of this information is collected through cookies and similar technologies. Please see our Cookie Policy for more information.

C. Information we receive from other sources

We may also receive personal data from:

• your organisation;
• business partners, resellers and integration partners;
• service providers acting on our behalf;
• event organisers;
• publicly available sources such as company websites or professional networking platforms; and
• marketing, analytics or customer relationship management systems we use in connection with our business activities.

4. How we use personal data

We may use personal data for the following purposes:

• to assist you with your use of our websites and services and to respond to any comments or queries which you may have raised;
• to allow you to participate in interactive features of our websites or services, when you choose to do so;
• to notify you about changes to, or any issues with, our services
• to respond to enquiries, requests and communications;
• to provide information, demonstrations, products and services you request;
• to manage our relationship with you and your organisation;
• to create and administer accounts;
• to provide support and customer service;
• to improve our website, services and user experience;
• to monitor the performance, security and reliability of our systems;
• to personalise website content or communications where appropriate;
• to send marketing communications where permitted by law;
• to organise and administer events, webinars and newsletters;
• to conduct business administration, reporting and record-keeping;
• to prevent fraud, misuse and security incidents;
• to establish, exercise or defend legal claims; and
• to comply with legal, regulatory and contractual obligations.

5. Our legal bases for processing

We process personal data only where we have a valid legal basis to do so. We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. 

Depending on the circumstances, we rely on one or more of the following legal bases:

A. Consent

We rely on consent where required by law, including for certain direct marketing activities and for non-essential cookies and similar technologies used on our website.

Where we rely on consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

B. Contract

We process personal data where necessary to enter into a contract with you or your organisation, or to perform our obligations under that contract.

C. Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations.

D. Legitimate interests

We may process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your interests or fundamental rights and freedoms.

Our legitimate interests may include:

• operating and improving our business, website, products and services;
• responding to business enquiries;
• managing customer and supplier relationships;
• ensuring network and information security;
• preventing fraud and misuse;
• understanding how our website and services are used;
• promoting our products and services in a business-to-business context where permitted by law; and
• administering our internal business operations.

6. Examples of how we use personal data and the legal bases we rely on

• Responding to enquiries and requests
  We use identity, contact and enquiry information to respond to messages, provide information and manage follow-up.
  Legal basis: legitimate interests and, where relevant, steps taken at your request before entering into a contract.
• Administering accounts, products and services
  We use account, contact and service-related data to provide access, support and ongoing administration.
  Legal basis: contract and legitimate interests.
• Sending marketing communications
  We use contact details, organisation information, sector information and engagement data to send newsletters and other updates.
  Legal basis: consent where required by law and, where permitted, legitimate interests.
• Website analytics and improvement
  We use technical and usage data to understand website performance, usage trends and user journeys.
  Legal basis: consent for non-essential cookies and similar technologies, and legitimate interests for strictly necessary operational analytics where applicable.
• Security and fraud prevention
  We use technical and activity data to maintain website and system security, detect suspicious activity and protect our services.
  Legal basis: legitimate interests and legal obligation where applicable.
• Compliance, claims and record-keeping
  We use relevant records to meet legal obligations and manage disputes or claims.
  Legal basis: legal obligation and legitimate interests.

7. Marketing and tailored communications

Where you have asked to receive marketing from us, or where we are otherwise permitted by law to contact you, we may send you information about our products, services, events, insights and updates.

To help make our communications more relevant, we may use information such as:

• your organisation type or sector;
• your product or service interests;
• the content you download;
• events you register for or attend;
• your interactions with our emails;
• and your interactions with our website, where this is permitted by law and based on your cookie choices.

This helps us better understand what topics may be of interest and tailor communications accordingly.

We do not use this activity to make solely automated decisions that produce legal effects or similarly significant effects on you.

You can object to direct marketing at any time. Where marketing relies on consent, you can also withdraw that consent at any time.

8. Cookies and similar technologies

We use cookies and similar technologies to support the operation of our website and, where you choose to allow them, to analyse usage, improve functionality, remember preferences, support embedded content and help us measure the effectiveness of communications and campaigns.

Non-essential cookies and similar technologies are used only where required by law and where you have given your consent.

You can manage your cookie preferences at any time through our cookie settings tool. Rejecting non-essential cookies will not prevent you from using the core functions of the website, although some optional features or embedded third-party content may not work as intended.

Please see our Cookie Policy for full details of the cookies and similar technologies used on the website, including their purposes, durations and providers.

9. Who we share personal data with

We may share personal data where necessary with:

• companies within our group;
• service providers who support our business operations, such as website hosting, analytics, CRM, IT, support, security, communications, event management and marketing providers;
• professional advisers, including legal, audit and insurance advisers;
• payment, technology and support providers where relevant;
• regulators, law enforcement authorities, courts or public bodies where we are required or permitted to do so;
• business partners, resellers or implementation partners where relevant to the services requested or provided; and
• potential buyers, investors or transaction advisers in connection with a corporate transaction, subject to appropriate safeguards.

Where third parties process personal data on our behalf, we require them to do so only on our instructions and under appropriate contractual, confidentiality and security obligations.

A current list of our main processors and sub-processors is available here: Terms & Conditions

10. International transfers

We are primarily a UK based business, but some of our service providers or group companies may process personal data outside the UK.

Where we transfer personal data outside of the UK, we take steps to ensure it is protected by appropriate safeguards, such as:

• an adequacy regulation;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under applicable data protection law.

You can contact us if you would like more information about the safeguards used for a particular international transfer.

11. How long we keep personal data

We retain personal data only for as long as necessary for the purposes for which it was collected and used, including for the purposes of satisfying legal, regulatory, tax, accounting and reporting obligations, and for establishing, exercising or defending legal claims.

Retention periods vary depending on the type of data and the context in which it was collected. For example:

• enquiry records may be retained for a limited period after the enquiry has been resolved;
• marketing subscription records may be retained until you unsubscribe or object;
• suppression records may be retained after you opt out so that we can respect your preferences;
• support, contract and service records may be retained for the duration of the relationship and for a reasonable period afterwards; and
• certain technical logs and security records may be retained for shorter or longer periods depending on operational and security needs.

Where possible, we may anonymise information so that it can no longer be linked to you, in which case we may use that information without further notice.

12. How we protect personal data

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These measures include, where appropriate, access controls, authentication measures, monitoring, encryption, contractual safeguards, staff training and policies designed to support secure and lawful processing.

No method of transmission over the internet or method of electronic storage is completely secure, but we take reasonable steps to protect personal data in accordance with applicable law.

13. Your rights

Depending on the circumstances and subject to applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data;
• request restriction of processing;
• object to processing, including direct marketing;
• request transfer of certain personal data to you or another provider;
• withdraw your consent at any time where we rely on consent; and
• lodge a complaint with the Information Commissioner’s Office.

If you would like to exercise any of these rights, please contact us using the details below.

Please note that if you have a query regarding any medical record or similar which we process on behalf of a GP practice, hospital etc, we act as a processor on behalf of that relevant GP practice, hospital etc. Therefore, you will need to reach out (or for any queries we receive we will pass these on) to the relevant third party, as they are responsible for that information (i.e. they are the ‘data controller’) and will need to determine how to respond to your query. 

Direct marketing right

You have an absolute right to object to the use of your personal data for direct marketing. If you do so, we will stop using your personal data for that purpose.

14. Children

Our website is not intended for use by children, and we do not knowingly collect personal data from children through the website.

If you believe that a child has provided personal data to us through the website, please contact us so that we can take appropriate steps.

15. Third-party links and services

Our website may contain links to third-party websites, services, plug-ins or content. If you follow those links or interact with third-party services, your personal data will be processed in accordance with the relevant third party’s privacy information.

We are not responsible for the privacy practices of third-party websites or services and encourage you to read their privacy notices.

16. Specific privacy notices

If you are a user of patient access, a specific privacy notice applies and can be found here Patient Access policies - Privacy notice

17. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes in our services, technologies, service providers, legal requirements, or the way we process personal data.

When we make changes, we will update the “Last updated” date above and, where appropriate, take additional steps to inform you.

18. Contact us

If you have any questions about this privacy notice, the way we use personal data, or if you would like to exercise your rights, please contact us:

DPO/Privacy team email: privacy@enliviohealth.com

If you would like to make a complaint 

If you have any concerns about how we have collected, used or otherwise processed your personal data, including in relation to the security or accuracy of your personal data, you have the right to make a complaint directly to us. Please email us at the above address and we will acknowledge receipt of your complaint within 30 days, take appropriate steps to investigate and respond to your concerns without undue delay

If you are not satisfied with our response, you retain your right to escalate your complaint to the Information Commissioner’s Office at www.ico.org.uk.

In addition to the above, the following additional terms may apply (as appropriate) depending on the services which are being used.

NHS Care Identity Authentication (CIA)

Please note that if you access our service using your NHS Care Identity credentials, the identity access and management services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get a national digital identity and authenticate your claim to that identity, and uses that personal information solely for that single purpose. For any personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS England’s Privacy Notice and Terms and Conditions, view the NHS Care Identity Service 2 page. This restriction does not apply to the personal information you provide to us separately which is managed in accordance with our Privacy Policy.

GP Connect

The 'End user organisation privacy notice statement' is available on the GP Connect privacy notice page.

Clinical Dataset

If you have consented for your data to be part of the Enlivio Clinical Dataset, your data is processed in accordance with the Clinical Dataset Privacy policy, which can be viewed here.