Privacy policy and cookies
On this page
Who we are
We are Q (‘we’, ‘our’, ‘us’), a large and vibrant membership community for people working to improve health and care across the UK and Ireland. We are delivered by the Health Foundation and supported and co-funded by partners across the UK and Ireland.
The Health Foundation is an independent charitable organisation working to build a healthier UK.
The Health Foundation are a registered charity (charity number 286967), company number 1714937. Our registered address is: The Health Foundation, 8 Salisbury Square, London, EC4Y 8AP.
Find out more about Q: q.health.org.uk
About this notice
This notice explains how we collect, store, manage, and protect your personal data. It outlines the types of data that we hold and how we use it.
We take our responsibilities about collecting, using and destroying personal data of our various audiences and stakeholders very seriously. We are committed to openness and fairness in handling Personal Data. We aim to be clear when we collect information about you and not do anything you wouldn’t reasonably expect.
The Health Foundation is the Data Controller (as defined by the Data Protection Act 2018 and all applicable laws which replace or amend it) who will collect and process your personal data.
Getting in touch
Contacting the Health Foundation
If you have any concerns about how we collect and use your personal data please contact:
The Health Foundation Data Protection Officer
The Health Foundation
8 Salisbury Square London
EC4Y 8AP
Email: dpo@health.org.uk
Telephone: 020 7257 8000
Contacting the Information Commissioner’s Office
If you have wider concerns about how Q or the Health Foundation manages information or wish to make a complaint, please contact the Information Commissioners Office (ICO).
- Contact the ICO
- Concerns can also be logged via the ICO website
Your rights
You have a right to:
- know what data we hold about you and why.
- ask for a copy of the personal data we hold about you or ask us to send it to someone else.
- ask us to correct or remove inaccurate data.
- ask us to delete your personal data from our systems.
- ask us to temporarily limit how we use your data.
- say no to us using your data for communications and marketing, ‘legitimate interests’, research, and statistical reasons.
- withdraw any consent you have given at any time.
- complain to the regulator if your data has not been treated as the law requires.
To do any of these, please contact us using the details above.
We will respond to you within one month of receiving a request related to any of these rights. If your request is large and complex, or we have a high number of requests, we may extend this by another two months. We will let you know if we need the additional time and why.
If you disagree with our approach, you may raise your concerns with the Information Commissioner’s Office (ICO)
To assist us in responding to these requests, we may ask you to verify your identity to make sure we do not give your personal data to the wrong person, update your data with details you did not provide or take action you did not request.
Q and the Health Foundation have published this Privacy Notice along with additional notices when we collect personal data from you to explain what personal data we collect and process. We aim to be as open and transparent as possible about how we use your personal data.
You have the right to request a copy of the personal information that we hold about you. If you would like a copy of some or all of your personal data, please email us at dpo@health.org.uk or write to Data Protection Officer, The Health Foundation, 8 Salisbury Square, London, EC4Y 8AP.
It is important to us that the information we hold about you is accurate and up to date. If you believe that the information, we hold is inaccurate or incomplete you have the right to ask us to rectify it. If we have passed your data to a third party for processing, then we will also contact them to rectify the data.
This is sometimes referred to as the “Right to be forgotten”. You can request that we delete your personal data from our systems if you:
- believe the data is no longer necessary for the purpose for which it was collected.
- withdraw your consent (subject to the requirement for us to retain data to process your request).
- believe we have processed your data unlawfully.
- believe we should delete your data to comply with other laws or regulation.
We may choose to refuse your request if we believe:
- we have a legal obligation to keep your data.
- it is required for the legitimate interests and purposes of the Health Foundation.
- it is required for the establishment, exercise, or defence of legal claims.
You have the right to ask Q and the Health Foundation to restrict how we process your data. This provides for a temporary halt to processing your data. You may make the request if you believe that:
- we should not process your data whilst we are in discussions with you regarding a disagreement over the accuracy of your personal data, or;
- we have processed your data in a manner you believe to be unlawful but rather than asking for the erasure of the data you would prefer another course of action to rectify your issue, or;
- we no longer require the data, but you do not wish us to dispose of it as you require it to establish or defend a legal claim.
If such as restriction is put in place, we shall limit the processing of your data to storage with the following exceptions:
- where the processing is for the establishment, exercise, or defence of legal claims.
- we must process it to protect the rights of another person.
You have the right to object to the processing of your personal data.
If your data is being used for direct marketing purposes, you have the right at any time to stop us from contacting you as outlined in this notice.
If we are processing your data for research or statistical purposes or processing your data based on our legitimate interests, you may seek to object to the processing of your personal data.
We may reject your request:
- where we are processing data for research and statistical purposes where there is a public interest in the continued processing of the data.
- where we believe we have compelling legitimate grounds for continuing to process your data which outweighs any harm or damage to you through the continued processing of the data.
- where the processing is for the establishment, exercise, or defence of legal claims.
Q and the Health Foundation must allow you to obtain and reuse your personal data for your own purposes. This applies to personal data you have provided to us and is processed in our computer systems. You can request that we provide you with a copy of this data in a format that can be read by another person’s or organisation’s computer system.
You have the right to transfer that copy of your data to another organisation or request that we do it for you where it is technically feasible for us to do so.
This right of transfer can be refused where we feel it may adversely affect the rights of another person.
Where we rely on your consent for the processing of your data you have the right to change your mind and withdraw your consent at any time. If you withdraw your consent, we must stop processing your data.
You have a right to complain to the Information Commissioner’s Office (ICO) if:
- we do not act on your request within one month of receipt and do not provide you with reasons why.
- you believe that the way we are processing your data is not in keeping with the requirements of the law.
- you believe your rights have been infringed because of the way we have processed your data.
Changes to this notice
If our information practices change in the future, we will update this notice. If significant changes are made to this notice, we will let you know with a clear announcement on our website, and emails.
We regularly review our privacy notice.
The information we collect about you and how we collect it
We collect and process personal data to support all the aims of Q, as outlined below.
When you apply for Q membership
We will collect and process your information to enable you to apply to become a member and participate in the Q community.
The information we collect, and process includes:
- Name, job title, organisation name, postcode and contact details such as your email address.
- Sensitive personal data, such as gender and ethnicity.
When we process your membership application, we need to share your responses and personal details with third parties. These include membership application assessors, Q partner organisations, Q’s website developer (William Joseph) and Q service providers.
We will ensure that everyone we share your data with keeps your information secure and does not use it for any purposes other than those specified in this Privacy Notice. We only share your information with relevant third parties if we are required to do so by law.
We will create a publicly available online profile for you on the Q website. This will include your name, job title, organisation, and social media details. You can edit this profile at any time by logging into your Q account, or you can ask us to amend your details on your behalf. A contact form will also be available for other Q members to contact you.
We will always ask for your consent to collect this information and you may refuse to provide it.
Funding and Awards
To provide awards and grant funding, and to commission services that support our work we may collect and process some or all the following information about applicants, grant and award holders:
- Name, title, gender, and date of birth.
- Contact details including postal address, personal email, work email, phone number and links to social media accounts.
- Race and ethnicity.
- Occupation, career history, professional qualifications, CV.
- Salary details.
- Your bank details.
Events and Marketing
To manage events, marketing and to promote Q and the Health Foundation’s work we may collect and process the following data:
- name, title.
- postal address.
- contact details; work email, phone number and links to social media accounts.
- personal photo and video of events.
- IP address and cookies.
Sensitive personal data
You can choose whether you share information with us that falls in sensitive data categories, like gender and ethnicity. Sharing this information allows us to understand and monitor the experience of all members joining Q. It helps us work towards a more equitable, diverse and inclusive community. We don’t share sensitive data with membership application assessors.
This information is captured when you apply to Q. It is then maintained as anonymised aggregated data. We will always ask for your consent to collect this information and you may refuse to provide the information. You may also withdraw your consent for us to process this information at any time although we may already have disposed of the information.
How we collect data
There are four main ways we collect the information we process about you:
- directly from you and the organisations you work for.
- from publicly available sources to keep your information up to date.
- through using cookies on our websites.
- through your use of social media, for example X, LinkedIn and BlueSky. This will depend on your settings or the privacy policies of these social media and messaging services.
- To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.
LinkedIn: linkedin.com/legal/privacy-policy
X: https://x.com/en/privacy
Bluesky: https://bsky.social/about/support/privacy-policy
Cookies
Cookies are small text files that websites use to store information about things like user preferences. We use cookies on the Q website to:
- help make the website easier to use.
- help people share our content via social media.
- help us understand how the site is being used so that we can identify areas that are working well and areas that need improvement.
You can refuse the use of cookies by selecting the appropriate settings on your browser. However, if you do this you may not be able to use all the functionality on our website.
For more information about cookies, visit allaboutcookies.org.
How we use your information
We use the information you give us to:
- enable you to join and participate in the Q community.
- create a publicly available online profile for you on the Q website.
- send you newsletters and updates about the Q community.
- administer any user accounts we set up for you.
- provide you with the services and the information about our activities and events that you have requested.
- conduct surveys and process your response to any survey you participate in for research, evaluation, and statistical purposes.
- analyse engagement in the activities and content offered on the Q website to provide you with the most user-friendly navigation experience. We may also use and disclose information in aggregate (so that no individuals are identified) for marketing and strategic development purposes.
- otherwise communicate with you about our aims and activities.
- ensure we do not send unwanted information to people who have informed us they do not wish to be contacted.
- keep your data up to date.
- implement any instructions you give us about withdrawing consent to send marketing information.
- use IP addresses to identify the location of users, to block disruptive use, to establish the number of visits to our website from different countries, and to present you with adverts with content about Q on other websites or platforms.
- promote relevant content and opportunities from Q based on actions you have taken online.
- keep a record of your relationship with us for internal use.
- fulfil contracts, you have entered with Q and the Health Foundation.
When and what we communicate
Q will only contact you for marketing purposes where we have your consent. For example to keep you up to date on our work. We will also contact you if we are otherwise allowed to do so.
We will make it easy for you to tell us if you would like to receive communications from us and hear more about Q, and how you would like to receive this information.
We will not send you marketing material or communications if you tell us that you do not wish to receive them. There are a variety of ways you can do this, and these are explained in the section ‘Updating your details’.
You can update or withdraw your consent for marketing information at any time. We review our retention periods for personal information on a regular basis. And we frequently encourage you to update your preferences, so you only receive news and opportunities you would like to hear about.
Communications from the Health Foundation
If we have an existing relationship with you, you may receive information from Q or the Health Foundation where we have identified that there is a legitimate interest. This is referred to as a ‘soft opt in’. You can always opt out at the time of the initial communication. For example we may contact you if you previously applied for funding or joined an event, and we are offering a similar opportunity.
Who we share your information with
Q will only use the information within the organisation for the purposes we gathered it for. We will not, under any circumstances, share or sell your data with any third party for their own purposes. You will not receive marketing from any other companies, charities, or organisations because you gave your details to us.
We may share your information with:
- third parties who supply services to us or process information on our behalf such as our website developer, event organisers, research partners, and publishers.
- assessors, auditors, and regulators as required by legal obligation or internal governance.
- Health Foundation partners and associated organisations.
These “data processors” will only act under our instruction and are subject to contractual obligations containing strict data protection clauses. We do not allow these organisations to use your data for their own purposes or disclose it to other third parties without our consent and we will take all reasonable care to ensure that they keep your data secure.
We will share your information if we are required to by law (for example to law enforcement agencies for the prevention or detection of crime, providing these organisations make a relevant request in writing).
Storing your information
Where we keep your data
Q and the Health Foundation maintains all your data within the United Kingdom (UK) or the European Economic Area (EEA).
Data is only processed by third parties outside of the UK or EEA to provide services like:
- managing events outside of the UK or EEA.
- technical service support.
- order fulfilment, for example sending promotional material from our mailing house, outside of the UK or EEA.
Where data is processed outside of the UK or EEA the Health Foundation has verified that appropriate safeguards are in place including:
- complying with all data protection principles.
- where possible trying to ensure data is processed in a country that is on the list of countries approved as adequate by the UK government.
Any transfers of information originating from within the UK or EEA to countries outside the UK or EEA will normally be made based on the standard contractual clauses (SCCs)
How long we keep your data
We will hold your personal data in our systems for as long as necessary for the relevant activity. We may keep some of your data indefinitely. This is explained in the section “How we use your information”.
We will keep any data provided to apply for one of our funding programmes, awards, or grants, for at least seven years after the completion of the programme or engagement.
Financial records will be retained in line with financial law and regulation for at least seven years.
We will keep records of Q community members for as long as is necessary to maintain the history of Q and to understand the long-term effectiveness and impact of these interactions on Q’s goals. This may include your name, organisation name, job title and email address. Any sensitive personal data that we collect from Q members will only be kept and maintained as anonymised aggregated data.
If you request that we stop sending you marketing materials, we will keep a record of your contact details to enable us to comply with your request not to be contacted.
How we protect your data
We ensure that there are appropriate technical and operational measures in place to protect your personal data. We have an internal body (Information Management Information Group) who are responsible for information governance across the Health Foundation.
The following technical controls are in place to protect your personal data:
- our network is protected behind firewalls.
- we have Anti-virus and Malware software installed.
- all our systems are password protected.
- our network is monitored by security specialists.
- our network protection is formally tested.
- mobile and removable devices are encrypted.
The following operational measures are in place to protect your personal data:
- We regularly review who has access to information that we hold so that your information is only accessible by appropriately trained staff and contractors.
- We do comprehensive checks before working with any external companies we use to collect or process personal data on our behalf. We put a contract in place that sets out our expectations and requirements, especially about how they manage the personal data they collect for us or have access to.
- We have a robust audit framework in place to ensure internal and external measures and obligations are in place and being maintained.
Updating your details
The accuracy of your information is important to us. We want to communicate with you in ways that you are happy with, and to provide you with information that is interesting to you.
To change how we communicate with you, or update the information we hold, then please:
- amend your preferences on our website: q.health.org.uk
- Contact the Q team to amend your details: q@health.org.uk
- email us about your rights: dpo@health.org.uk
- write to us: Data Protection Officer, The Health Foundation, 8 Salisbury Square, London, EC4Y 8AP.
- Telephone: 020 757 8000
- You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email from Q.
How long it takes to make these changes
We try to make updates to your marketing preferences:
- within 24 hours from updates to your preferences on our website or via the link in our email.
- within 120 hours from receipt of email, phone call or letter.
Discover more
-
Toolkits, guides, case studies and other quality improvement resources shared by Q members and the Q team.
-
Terms and conditions
3 minute read