Privacy policy and cookies

We are Q (‘we’, ​‘our’, ​‘us’), a large and vibrant membership community for people working to improve health and care across the UK and Ireland. We are delivered by the Health Foundation and supported and co-funded by partners across the UK and Ireland.

The Health Foundation is an independent charitable organisation working to build a healthier UK.

The Health Foundation are a registered charity (charity number 286967), company number 1714937. Our registered address is: The Health Foundation, 8 Salisbury Square, London, EC4Y 8AP. 

Find out more about Q: q.health.org.uk

This notice explains how we collect, store, manage, and protect your personal data. It outlines the types of data that we hold and how we use it.

We take our responsibilities about collecting, using and destroying personal data of our various audiences and stakeholders very seriously. We are committed to openness and fairness in handling Personal Data. We aim to be clear when we collect information about you and not do anything you wouldn’t reasonably expect.

The Health Foundation is the Data Controller (as defined by the Data Protection Act 2018 and all applicable laws which replace or amend it) who will collect and process your personal data.

If you have any concerns about how we collect and use your personal data please contact:

The Health Foundation Data Protection Officer 
The Health Foundation
8 Salisbury Square London
EC4Y 8AP

Email: dpo@health.org.uk   
Telephone: 020 7257 8000

If you have wider concerns about how Q or the Health Foundation manages information or wish to make a complaint, please contact the Information Commissioners Office (ICO). 

• Contact the ICO
• Concerns can also be logged via the ICO website

You have a right to:

• know what data we hold about you and why.
• ask for a copy of the personal data we hold about you or ask us to send it to someone else.
• ask us to correct or remove inaccurate data. 
• ask us to delete your personal data from our systems. 
• ask us to temporarily limit how we use your data.
• say no to us using your data for communications and marketing, ​‘legitimate interests’, research, and statistical reasons. 
• withdraw any consent you have given at any time.
• complain to the regulator if your data has not been treated as the law requires. 

To do any of these, please contact us using the details above. 

We will respond to you within one month of receiving a request related to any of these rights. If your request is large and complex, or we have a high number of requests, we may extend this by another two months. We will let you know if we need the additional time and why.

If you disagree with our approach, you may raise your concerns with the Information Commissioner’s Office (ICO)

To assist us in responding to these requests, we may ask you to verify your identity to make sure we do not give your personal data to the wrong person, update your data with details you did not provide or take action you did not request.

If our information practices change in the future, we will update this notice. If significant changes are made to this notice, we will let you know with a clear announcement on our website, and emails. 

We regularly review our privacy notice. 

We collect and process personal data to support all the aims of Q, as outlined below.

We will collect and process your information to enable you to apply to become a member and participate in the Q community.

The information we collect, and process includes: 

• Name, job title, organisation name, postcode and contact details such as your email address. 
• Sensitive personal data, such as gender and ethnicity.

When we process your membership application, we need to share your responses and personal details with third parties. These include membership application assessors, Q partner organisations, Q’s website developer (William Joseph) and Q service providers. 

We will ensure that everyone we share your data with keeps your information secure and does not use it for any purposes other than those specified in this Privacy Notice. We only share your information with relevant third parties if we are required to do so by law. 

We will create a publicly available online profile for you on the Q website. This will include your name, job title, organisation, and social media details. You can edit this profile at any time by logging into your Q account, or you can ask us to amend your details on your behalf. A contact form will also be available for other Q members to contact you. 

We will always ask for your consent to collect this information and you may refuse to provide it. 

To provide awards and grant funding, and to commission services that support our work we may collect and process some or all the following information about applicants, grant and award holders:

• Name, title, gender, and date of birth.
• Contact details including postal address, personal email, work email, phone number and links to social media accounts.
• Race and ethnicity.
• Occupation, career history, professional qualifications, CV.
• Salary details.
• Your bank details.

To manage events, marketing and to promote Q and the Health Foundation’s work we may collect and process the following data:

• name, title.
• postal address.
• contact details; work email, phone number and links to social media accounts.
• personal photo and video of events.
• IP address and cookies.

You can choose whether you share information with us that falls in sensitive data categories, like gender and ethnicity. Sharing this information allows us to understand and monitor the experience of all members joining Q. It helps us work towards a more equitable, diverse and inclusive community. We don’t share sensitive data with membership application assessors. 

This information is captured when you apply to Q. It is then maintained as anonymised aggregated data. We will always ask for your consent to collect this information and you may refuse to provide the information. You may also withdraw your consent for us to process this information at any time although we may already have disposed of the information.

There are four main ways we collect the information we process about you:

• directly from you and the organisations you work for.
• from publicly available sources to keep your information up to date.
• through using cookies on our websites.
• through your use of social media, for example X, LinkedIn and BlueSky. This will depend on your settings or the privacy policies of these social media and messaging services. 
• To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.
  LinkedIn: linkedin.com/legal/privacy-policy
  X: https://x.com/en/privacy 
  Bluesky: https://bsky.social/about/support/privacy-policy 

Cookies are small text files that websites use to store information about things like user preferences. We use cookies on the Q website to:

• help make the website easier to use. 
• help people share our content via social media.
• help us understand how the site is being used so that we can identify areas that are working well and areas that need improvement.

You can refuse the use of cookies by selecting the appropriate settings on your browser. However, if you do this you may not be able to use all the functionality on our website.

For more information about cookies, visit allaboutcookies.org.

We use the information you give us to:

• enable you to join and participate in the Q community.
• create a publicly available online profile for you on the Q website.
• send you newsletters and updates about the Q community. 
• administer any user accounts we set up for you.
• provide you with the services and the information about our activities and events that you have requested.
• conduct surveys and process your response to any survey you participate in for research, evaluation, and statistical purposes.
• analyse engagement in the activities and content offered on the Q website to provide you with the most user-friendly navigation experience. We may also use and disclose information in aggregate (so that no individuals are identified) for marketing and strategic development purposes.
• otherwise communicate with you about our aims and activities.
• ensure we do not send unwanted information to people who have informed us they do not wish to be contacted.
• keep your data up to date.
• implement any instructions you give us about withdrawing consent to send marketing information. 
• use IP addresses to identify the location of users, to block disruptive use, to establish the number of visits to our website from different countries, and to present you with adverts with content about Q on other websites or platforms.
• promote relevant content and opportunities from Q based on actions you have taken online.
• keep a record of your relationship with us for internal use.
• fulfil contracts, you have entered with Q and the Health Foundation.

Q will only contact you for marketing purposes where we have your consent. For example to keep you up to date on our work. We will also contact you if we are otherwise allowed to do so.

We will make it easy for you to tell us if you would like to receive communications from us and hear more about Q, and how you would like to receive this information. 

We will not send you marketing material or communications if you tell us that you do not wish to receive them. There are a variety of ways you can do this, and these are explained in the section ​‘Updating your details’. 

You can update or withdraw your consent for marketing information at any time. We review our retention periods for personal information on a regular basis.  And we frequently encourage you to update your preferences, so you only receive news and opportunities you would like to hear about. 

If we have an existing relationship with you, you may receive information from Q or the Health Foundation where we have identified that there is a legitimate interest. This is referred to as a ​‘soft opt in’. You can always opt out at the time of the initial communication. For example we may contact you if you previously applied for funding or joined an event, and we are offering a similar opportunity.

Q will only use the information within the organisation for the purposes we gathered it for. We will not, under any circumstances, share or sell your data with any third party for their own purposes. You will not receive marketing from any other companies, charities, or organisations because you gave your details to us.

We may share your information with:

• third parties who supply services to us or process information on our behalf such as our website developer, event organisers, research partners, and publishers.
• assessors, auditors, and regulators as required by legal obligation or internal governance.
• Health Foundation partners and associated organisations.

These ​“data processors” will only act under our instruction and are subject to contractual obligations containing strict data protection clauses. We do not allow these organisations to use your data for their own purposes or disclose it to other third parties without our consent and we will take all reasonable care to ensure that they keep your data secure.

We will share your information if we are required to by law (for example to law enforcement agencies for the prevention or detection of crime, providing these organisations make a relevant request in writing).

Q and the Health Foundation maintains all your data within the United Kingdom (UK) or the European Economic Area (EEA).

Data is only processed by third parties outside of the UK or EEA to provide services like:

• managing events outside of the UK or EEA.
• technical service support.
• order fulfilment, for example sending promotional material from our mailing house, outside of the UK or EEA.

Where data is processed outside of the UK or EEA the Health Foundation has verified that appropriate safeguards are in place including:

• complying with all data protection principles.
• where possible trying to ensure data is processed in a country that is on the list of countries approved as adequate by the UK government.

Any transfers of information originating from within the UK or EEA to countries outside the UK or EEA will normally be made based on the standard contractual clauses (SCCs)

We will hold your personal data in our systems for as long as necessary for the relevant activity. We may keep some of your data indefinitely. This is explained in the section ​“How we use your information”. 

We will keep any data provided to apply for one of our funding programmes, awards, or grants, for at least seven years after the completion of the programme or engagement.

Financial records will be retained in line with financial law and regulation for at least seven years.

We will keep records of Q community members for as long as is necessary to maintain the history of Q and to understand the long-term effectiveness and impact of these interactions on Q’s goals. This may include your name, organisation name, job title and email address. Any sensitive personal data that we collect from Q members will only be kept and maintained as anonymised aggregated data.

If you request that we stop sending you marketing materials, we will keep a record of your contact details to enable us to comply with your request not to be contacted.

We ensure that there are appropriate technical and operational measures in place to protect your personal data. We have an internal body (Information Management Information Group) who are responsible for information governance across the Health Foundation.

The following technical controls are in place to protect your personal data:

• our network is protected behind firewalls.
• we have Anti-virus and Malware software installed.
• all our systems are password protected.
• our network is monitored by security specialists.
• our network protection is formally tested.
• mobile and removable devices are encrypted.

The following operational measures are in place to protect your personal data:

• We regularly review who has access to information that we hold so that your information is only accessible by appropriately trained staff and contractors.
• We do comprehensive checks before working with any external companies we use to collect or process personal data on our behalf. We put a contract in place that sets out our expectations and requirements, especially about how they manage the personal data they collect for us or have access to.
• We have a robust audit framework in place to ensure internal and external measures and obligations are in place and being maintained.

The accuracy of your information is important to us. We want to communicate with you in ways that you are happy with, and to provide you with information that is interesting to you.

To change how we communicate with you, or update the information we hold, then please:

• amend your preferences on our website:  q.health.org.uk
• Contact the Q team to amend your details: q@health.org.uk 
• email us about your rights:  dpo@health.org.uk
• write to us: Data Protection Officer, The Health Foundation, 8 Salisbury Square, London, EC4Y 8AP.
• Telephone: 020 757 8000
• You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email from Q. 

We try to make updates to your marketing preferences:

• within 24 hours from updates to your preferences on our website or via the link in our email.
• within 120 hours from receipt of email, phone call or letter.