Healthcare Ethics Ireland
Privacy · Ireland · GDPR and the Data Protection Commission
What we do with your data
Privacy Policy
for this website and our online and face-to-face remediation courses for healthcare professionals in Ireland
In short
The short version
We collect your name, your email address and a record of which courses you bought and completed. We use it to sell you a course, give you access, issue your certificate and meet our tax obligations. Stripe handles payments and we never see your card number.
The part that matters more than anything else to the people who read this page: we never tell your regulator, a Preliminary Proceedings Committee or an inquiry committee that you are a customer. If you bought the course yourself, nobody else is told either. You have rights under the GDPR, and you can complain to the Data Protection Commission.
The short version is not the policy. Where it and the full text differ, the full text is what applies.
Privacy policy
Who we are
This policy explains what we do with personal data about you when you use this website, ask us a question, or buy and take one of our courses. It is written to the General Data Protection Regulation (GDPR), and the supervisory authority in Ireland is the Data Protection Commission.
Healthcare Ethics Ireland operates this website and the courses on it, and is the controller of the personal data described in this policy. We are based at 119 Marylebone Road, London NW1 5PU, United Kingdom. You can reach us at any time at [email protected].
We are based outside Ireland and we offer courses to healthcare professionals in Ireland, so we handle your personal data in line with the GDPR, and the rights it gives you are yours whether we are in Ireland or not. We do not hold health data about you.
People who use this site are responding to a complaint, an investigation or a fitness to practise inquiry, or adding to a CPD record. We have written this policy with the first situation in mind, and one section deals with it directly.
The data we collect
We collect only what we need:
- Your name and email address, when you buy a course, create an account or contact us.
- Your profession or registration type, where you tell us, so that we can point you to the right courses.
- Your course records: which courses you bought, when, whether you completed them and on what date.
- Anything you choose to write to us, including in an enquiry.
We do not ask you for details of your complaint or your case, and you do not need to give them to us in order to buy or take a course. If you write them to us anyway, we treat them as described below.
We do not collect your registration number, and we do not collect health data about you.
Why we use it, and on what legal basis
The GDPR allows personal data to be used only on one of six legal bases, which the Data Protection Commission lists on its page on lawful processing. We rely on four of them:
- Performance of a contract: to sell you a course, give you access to it and issue your certificate.
- Compliance with a legal obligation: to keep the records of sales that tax and accounting rules require of us.
- Our legitimate interests, which do not override your rights: to answer your questions, keep the site secure, and establish or defend a legal claim.
- Your consent: to send you marketing, only if you have asked for it. You can withdraw it at any time with the unsubscribe link in every message.
Feedback you give us may be used in anonymised form, as our Terms and Conditions describe; nothing that could identify you or your case is published without your express written consent.
We do not sell personal data, and we do not disclose it for another organisation’s marketing.
Payments
Payments are processed by Stripe. Your card details are given to Stripe and handled under Stripe’s own privacy policy. We never see or hold your full card number. We receive only confirmation that a payment succeeded, the amount, the last four digits of the card and the card type. Where you pay by bank transfer, we see what your bank shows on the transfer and nothing more.
Your regulatory situation stays with you
This matters more than anything else in this policy, so we will be plain about it.
We never report to any regulator, to a Preliminary Proceedings Committee or to an inquiry committee that you have bought or taken a course. We do not keep a register that any of them can search. No regulator has an account with us. That is true however you came to us.
Your certificate is yours. You decide whether to put it in front of anyone. If you never mention us to your regulator, it does not hear about us from us.
If you bought the course yourself
Then it is confidential. No employer, no indemnifier, no professional body and no organisation of any kind is told that you are a customer.
If your organisation gave you the seat
If an employer, indemnifier, university or professional body bought a seat and assigned it to you, that organisation can see which courses you completed and on what date, and the certificates issued. That is the whole of it. They do not see your answers, your time spent, how many attempts you made, or anything about a complaint or inquiry concerning you; we do not hold that information in the first place.
You are told before you start, not afterwards. Before you begin a course on an organisation seat you are shown a single statement saying your completion will be visible to the organisation that provided it, and you have to accept it. Nobody is enrolled on that basis without seeing it.
And you always have the alternative. If you would rather your organisation knew nothing about it, do not use the seat: buy the course yourself, in your own name, at the standard price. It is then covered by the paragraph above and your organisation is told nothing.
If you bought through a member discount code
You bought in your own name and it is your purchase. We do not tell the organisation that issued the code who used it, which courses they took, or whether they completed them.
The only exception
We would disclose that you are a customer only where the law requires it or a court orders it. If that happened and we were permitted to tell you, we would.
Who we share it with
We share personal data only with the service providers we need to run the business: our website and course platform host, our payment processor, our email provider, and our accountants. Each is given only what it needs to do its job, and each is bound by contract to use it only for that purpose.
Where an organisation has bought and assigned you a seat, that organisation sees the limited completion information described under Your regulatory situation stays with you, and nothing else.
We disclose personal data where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.
If our business were ever sold or transferred, customer records could move with it. You would be told before that happened, and the buyer would be bound by this policy.
Where your data is held
Your data is held outside the European Economic Area (EEA). We are based in the United Kingdom, so your name, your email address and your course records are handled there. Some of our service providers, such as our website and course platform host, our payment processor and our email provider, hold data in the United Kingdom, the European Union or the United States.
Under the GDPR a country outside the EEA is a third country. Where your personal data is transferred to a third country, it is protected either because the European Commission has made an adequacy decision for that country, or by standard data protection clauses adopted by the European Commission in our contract with the recipient. The Data Protection Commission explains both on its page on transfers to third countries.
If you would like to know where a particular part of your data is held, or which safeguard applies to it, ask us and we will tell you.
How long we keep it
We keep your account and course records while your account is open, and for seven years after your last purchase, to meet the tax and accounting record-keeping obligations that apply to us.
Enquiries that do not lead to a purchase are deleted within twelve months. Where you have agreed to receive marketing, we keep that consent until you withdraw it, and we keep a record of the withdrawal so that we do not contact you again. Anything you asked us to delete is deleted, except where we are required to keep it.
Cookies
This site sets only the cookies it needs in order to work. They keep you logged in, remember what is in your basket, and keep the site secure. The shop does not function without them, and they are not used to build a profile of you.
We do not use analytics cookies, advertising cookies or profiling cookies. We do not track you across other websites, we do not run advertising that follows you, and we do not share anything about your visit with an advertising network.
Your rights under the GDPR
The GDPR gives you these rights, which the Data Protection Commission describes on its page on your rights under the GDPR:
- To be informed about how your data is used, which is what this policy does.
- Of access: to ask for a copy of the personal data we hold about you.
- To rectification: to ask us to correct it if it is wrong or incomplete.
- To erasure: to ask us to delete it, which we will do unless we are required to keep it.
- To restriction: to ask us to limit how we use it.
- To data portability: to ask for it in a form you can take elsewhere.
- To object: to our use of it on the basis of our legitimate interests, and to marketing at any time.
- In relation to automated processing: we make no decisions about you by automated means alone.
Ask at [email protected]. We respond without undue delay and at the latest within one month; if a request is complex we may extend that by up to two further months, and we will tell you within the first month if we do. We do not charge a fee for a request. The Data Protection Commission’s guide to access requests sets out the timings. If we refuse a request we will tell you why in writing and how to complain to the Data Protection Commission.
How we protect it, and what happens if something goes wrong
The site runs over HTTPS. Access to customer records is limited to the people who need it. We do not hold card numbers. Email and the contact form are not fully secure channels, so please do not send us details of your complaint or case; we do not need them.
If a personal data breach occurred that may pose a risk to you, we would notify the Data Protection Commission without undue delay and not later than 72 hours after becoming aware of it, and if it was likely to result in a high risk to you, we would also tell you without undue delay, as the Data Protection Commission’s guide on reporting a breach sets out.
How to complain
If you think we have mishandled your personal data, tell us first at [email protected]. We will acknowledge your complaint within 5 working days and respond in full within one month.
You may also complain to the Data Protection Commission, the supervisory authority in Ireland, using its online contact form, by email to [email protected], or by post to Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963 (contact details). The Commission asks you to include copies of your correspondence with us; see its page on making a complaint.
Changes to this policy, and how it fits with our terms
We may update this policy. The date at the top of this page shows when it last changed. Where a change is material we will say so on this page rather than change it quietly.
This policy sits alongside our Terms and Conditions. Where the two conflict on a question about personal data, this policy applies.
How to contact us
Email [email protected], with “Privacy” in the subject line. That address reaches us for anything in this policy: a copy of your data, a correction, a deletion, an objection, or a complaint.
Write to us at Healthcare Ethics Ireland, 119 Marylebone Road, London NW1 5PU, United Kingdom.
In one paragraph
We collect your name, your email address and a record of the courses you bought and completed. We use it to sell you a course, give you access to it and issue your certificate. Stripe handles payments and we never see your card number. We never tell your regulator, a Preliminary Proceedings Committee or an inquiry committee that you are a customer. If you bought the course yourself, nobody else is told either; if your organisation assigned you a seat, it sees your completions and dates and nothing more, and you are told that before you start. You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it, at [email protected], and you can complain to the Data Protection Commission.
Definitions
Key terms on this page
Plain definitions of the words this page uses. Each one restates a section above rather than adding to it.
- Personal data. Information about an identified or identifiable person. On this site that means your name, your email address and the record of which courses you bought and completed.
- Controller. The organisation that decides why and how personal data is used. For this website and its courses, that is Healthcare Ethics Ireland.
- GDPR. The General Data Protection Regulation, the European Union law on personal data that applies in Ireland. This policy is written to it.
- Data Protection Commission. The Irish supervisory authority for the GDPR. You can complain to it about how we handle your data; its contact details are at dataprotection.ie.
- Third country. Any country outside the European Economic Area. Transfers to a third country need an adequacy decision of the European Commission or another safeguard, such as standard data protection clauses.
- Personal data breach. A security incident that affects personal data. Where it may pose a risk to the people affected it is reported to the Data Protection Commission, and where the risk is high the people affected are told.
- Complaint (to a regulator). In Irish health regulation, a concern about a registered professional raised with their regulator: the Medical Council, the Nursing and Midwifery Board of Ireland, the Dental Council, the Pharmaceutical Society of Ireland or CORU. We never report to any of them that you have bought or taken a course.
- Course licence. Seats bought by an organisation in a block and assigned to named people. Where a seat was assigned to you, the administrator sees your assignment, completion and date, and nothing else.
Questions about your data
Frequently asked questions
Short answers to what people ask. Each one restates a section above rather than adding to it.
Do you tell my regulator that I bought a course?
No. We never report to any regulator, to a Preliminary Proceedings Committee or to an inquiry committee that you have bought or taken a course. We keep no register any of them can search, and no regulator has an account with us.
What data do you collect?
Your name and email address, your profession if you tell us, a record of which courses you bought and completed and on what dates, and anything you choose to write to us. That is all.
We do not ask for details of your complaint, we do not collect your registration number, and we do not collect health data about you.
Where is my data held?
Outside the European Economic Area. We are based in the United Kingdom, so your name, email address and course records are handled there. Some service providers hold data in the United Kingdom, the European Union or the United States. Transfers are protected by an adequacy decision or by standard data protection clauses.
Do you sell my data?
No. We do not sell personal data and we do not disclose it for another organisation’s marketing. Marketing from us only happens if you asked for it, and every message carries an unsubscribe link that works.
How long do you keep it?
Account and course records while your account is open, and for seven years after your last purchase, to meet the tax and accounting record-keeping obligations that apply to us. Enquiries that do not lead to a purchase are deleted within twelve months.
Can I get a copy of what you hold, or have it deleted?
Yes. Ask at [email protected]. We respond at the latest within one month, we do not charge a fee, and if we refuse a request we tell you why in writing.
Who can I complain to?
To us first, at the address above. You may also complain to the Data Protection Commission, the supervisory authority in Ireland, through its online form, by email to [email protected], or by post to 6 Pembroke Row, Dublin 2, D02 X963.
Elsewhere on this site
Related pages
The other documents that govern a purchase, and the courses this policy applies to.
Courses by regulator:
Who reviewed this page
Written and last reviewed by Dr Shehzad Iqbal, MBBS, MRCS, MRCGP, Postgraduate Certificate in Healthcare Law and Ethics, University of Dundee. Last reviewed . Questions about this page: [email protected].