How Horizon uses personal data for the Oncology Modelling Platform: access requests, trials and registered users.
This privacy notice explains how Horizon Health Economics Ltd
("Horizon", "we", "us") uses personal data in connection with
the Horizon Oncology Modelling Platform (the "Platform"). It
covers three groups of people: those who ask for access through the request
form on our website (Section 2), those who use the Platform under Trial Access
(Section 3), and registered users of the Platform (Section 4). The rest of the
notice applies to all three.
The Platform's terms of use (the "Terms") are a separate
document, shown before you sign in and published at
horizonhealtheconomics.co.uk/terms.html.
Our website and its contact form are covered by our website privacy policy, at
horizonhealtheconomics.co.uk/privacy-policy.html.
1. Who we are
Horizon Health Economics Ltd (company number 16565475), whose registered
office is in Poole, Dorset, United Kingdom, is the controller of the personal
data described in this notice. We are registered with the Information
Commissioner's Office under registration number CSN4349361.
Questions about this notice or about your data:
support@horizonhealthecon.co.uk.
2. If you request access
What we collect. The request form asks for your full name,
your work email address, your organisation and the reason you want access,
chosen from a list. It also records your answers to two tick boxes: one, which
you must tick, confirming that you have read this notice and agree to us using
your details to consider your request and, if we approve it, to set up and run
your trial; and an optional one saying that we may contact you about further
access after your trial.
How your request is handled. The form is a Microsoft Form
in Horizon's Microsoft 365 tenant. An automated workflow (Azure Logic Apps, in
Horizon's own Azure subscription) emails you to confirm that we have received
your request, and passes it to a member of Horizon's staff. Our emails about
your request and your trial come from our shared mailbox,
access.platform@horizonhealthecon.co.uk, and replies go to
support@horizonhealthecon.co.uk.
A person decides. A member of Horizon's staff reads every
request and decides whether to approve it. We make no decision about you by
automated means alone. If we decline your request, we email you to say so.
If we approve your request. We create a guest account for
you in Horizon's Microsoft Entra directory, with your name and email address,
and add it to the group of trial users. The first time you sign in, Microsoft
asks you to set up multi-factor authentication with Horizon, unless we have
agreed to accept the multi-factor authentication of your own organisation.
The approval record. We keep a record of each request and
our decision: your name, email address and organisation, the reason you gave,
when you asked, whether and when we approved or declined it, when your trial
ends, whether we accepted your organisation's multi-factor authentication,
whether you ticked the follow-up box, and the outcome. The automated workflow
also keeps a technical history of each run, which shows the steps taken with
your answers hidden.
Why we use it, and our lawful basis. We use these details
to consider your request, to contact you about it and, if we approve it, to set
up, run and end your trial. Our lawful basis is our legitimate interests in
responding to requests for access and in offering evaluations of the Platform.
The required tick box records that you have read this notice. We do not rely on
it as your consent, so that your trial does not depend on a consent you could
withdraw part-way through.
After your trial. When your trial ends we send you one
email saying so, with a short feedback survey. If you answer it, we use your
answers to improve the Platform, on the basis of our legitimate interests. We
contact you about further access only if you ticked "You may contact me about
further access after my trial". Our lawful basis for that is your consent, which
you can withdraw at any time by replying STOP to any of our emails or by
writing to support@horizonhealthecon.co.uk. Without that tick, the only emails
we send you are about your request and your trial.
3. If you use Trial Access
Signing in. You sign in through Microsoft, with the guest
account described in Section 2. Microsoft tells the Platform your email address
and that you have Trial Access. The Platform uses your email address as your
identity and never sees your password.
What the Platform records. When your trial is set up, or at
your first sign-in, the Platform creates an account record holding your email
address, the date the record was created and the date and time at which your
Trial Access ends. It also records which version of the Terms you accepted, and
when, and, if Horizon suspends your access, that it did so and when. A trial
account belongs to no organisation and cannot save, share or keep any
analysis.
Your work is not saved. Nothing you enter, upload or create
under Trial Access is saved. Each session runs in its own container on our
server, separate from every other user's, and any data you upload is held only
in that session's memory. The session, and everything in it, is deleted when it
ends: at most about 10 minutes after you close the tab, when you sign out,
after at most 2 hours, or when your Trial Access ends, whichever comes first.
Tables and charts you download are saved on your own device, and Horizon keeps
no copy.
Data you upload. The Terms do not allow you to upload data
that identifies, or could be used to identify, any individual, and that includes
pseudonymised patient-level data. Horizon uses what you upload only to produce
the results you ask for during the session.
Technical logs. Microsoft records each sign-in to Horizon's
tenant, including the time, your IP address and details of your device and
browser. Our web server keeps an access log of the requests it receives: the
time, the address requested, your IP address and the details your browser
sends with each request, such as its user agent (the name and version your
browser reports), but never your sign-in cookies. Our server also keeps short
technical logs of sign-ins and sessions, which may include your email address
and IP address. We use these logs only to keep the Platform secure and to
diagnose faults. Section 7 says how long they are kept.
Security records. The Platform keeps a record of each
session: when it started and ended, the email address and organisation of the
account, your IP address, your browser's user agent, which downloads you made
from the Platform (which file, not its contents), a short summary of the
session (how many minutes it lasted and how many sections were opened), and
whether another browser used the same session. The record also shows the
account's access type (for example Trial Access) and whether the session was
one of Horizon's own test sessions. If Horizon suspends an account, the
record also notes when its open session was closed. These records never
contain the content of your analyses or anything you enter or upload. We use
them to keep the Platform secure and to check that it is used in line with the
Terms, including the rule against operating it with automated tools or
artificial-intelligence agents (Section 3 of the Terms). Section 7 says how
long they are kept.
Why we use it, and our lawful basis. We use this data to
provide your trial and end it on time, to keep the Platform secure, to check
compliance with the Terms and to keep evidence of the Terms you accepted. Our
lawful basis is our legitimate interests in providing the trial, in operating
the Platform securely and in making sure it is used in line with the
Terms.
4. If you are a registered user
Signing in. Registered users sign in through Microsoft in
the same way, with a Horizon Microsoft 365 account or a guest account in
Horizon's tenant. The Platform receives your email address from Microsoft and
uses it as your identity. The technical logs and security records described in
Section 3 apply to you too.
What the Platform records. Your account record holds your
email address, the organisation Horizon has assigned you to, the date the
record was created and when you last viewed the profiles shared with you, and,
if Horizon suspends your access, that it did so and when. The Platform also
records which version of the Terms you accepted, and when.
Analysis profiles. The analyses you save
("profiles") are kept in the Platform's database, with up to
10 earlier versions of each so that you can restore one, and a note of who
saved each version. A profile contains whatever you entered or uploaded for
that analysis, and its results. When you share a profile, the people you share
it with can see the profile and your email address, and the Platform records
who shared which profile with whom, and when. Profiles must not contain data
that identifies any individual, including pseudonymised patient-level data
(Section 4 of the Terms).
Why we use it, and our lawful basis. We use this data to
provide the Platform to you and your organisation, to keep and share your work
as you ask, to keep the Platform secure, to check compliance with the Terms and
to keep evidence of the Terms you accepted. Our lawful basis is our legitimate
interests in doing so.
5. Who processes your data, and where it is held
We use Microsoft as our processor, under Microsoft's standard data
protection terms: Microsoft 365 for the request form (Microsoft Forms), email
(Exchange Online) and sign-in and multi-factor authentication (Microsoft Entra
ID); and Microsoft Azure for the Platform, its database and the automated
workflows (Azure Logic Apps). Horizon's Microsoft 365 tenant holds its data in
Microsoft data centres in the United Kingdom and the European Union. The
Platform, its database and the automated workflows run in Microsoft's Azure UK
West region, in the United Kingdom.
When we set up or change a Platform account, for example to start or end a
trial or to suspend access, we do it through an automated workflow on GitHub (a
Microsoft company), under GitHub's standard data protection terms. Your email
address passes through that workflow. Once a week a separate GitHub workflow,
under the same terms, produces for Horizon a security summary of the records
described in Section 3. It identifies accounts by coded identifiers rather than
email addresses, unless Horizon needs to look into a particular account.
We do not sell your data. We share it with no one else, except the people
you choose to share a profile with, or where the law requires us to. We test
the Platform with AI tools only on test accounts holding test data; your data
is not shown to them.
6. International transfers
By design, your data is held in the United Kingdom and the European Union,
which UK law recognises as protecting personal data adequately. There are two
limited exceptions. Microsoft may process some data elsewhere, for example to
provide support or to keep its services secure; and the GitHub workflows
described in Section 5 may process your email address, and the weekly security
summary, in the United States. In
both cases Microsoft's and GitHub's standard data protection terms provide the
safeguards that UK data protection law requires for such transfers.
7. How long we keep your data
Your request. The form response, the emails about your
request and your trial, and the approval record are kept for 12 months after
your trial ends, or after we decline your request, and are then deleted. If you
become a registered user, we keep them for as long as your account is open.
Your guest account. Your guest account is disabled when
your trial ends and deleted 30 days later. Microsoft keeps a deleted account
for a further 30 days, during which it can be restored, and then removes it
permanently. The multi-factor authentication method you registered with us
goes with the account. If you do not sign in within 14 days of approval, the
invitation lapses and the guest account is deleted.
Your work during a trial. Only while your session runs
(Section 3).
Your Platform account record and terms acceptance records.
Under Trial Access, 12 months after your trial ends, then deleted. For
registered users, for as long as your account is open and for 12 months after
it is closed, then deleted.
Analysis profiles. Until you delete them, or until your
account is closed, when we delete them within 30 days. Deleting a profile also
deletes its earlier versions and its shares. A copy that someone else saved of
a profile you shared with them is their profile, not yours.
Logs. Microsoft keeps its sign-in records for 30 days. Our
web server's access log is limited in size (the file being written and at most
ten earlier files of 10 MiB each), so older entries are deleted automatically
as new ones are written. Our server's other technical logs are limited in
size, so older entries are overwritten automatically, and the technical log of
each session is deleted when the session ends. The run history of the
automated request workflow is kept for 90 days, and the logs of the GitHub
workflows, including the weekly security summary, for 14 days.
Security records. 12 months from the session they record,
then deleted. They are kept for that period even if your account is closed
sooner, so that a security incident can still be looked into.
Feedback. Your answers to the feedback survey are kept for
12 months, then deleted.
Backups. The Platform's database is backed up
automatically, and backups are kept for 35 days, so data deleted from the
Platform remains in the backups for up to 35 days.
If you ask us not to contact you. We keep your email
address on a list of people not to contact, for as long as we need it to
respect your request.
Deletion by hand. The Platform cannot yet delete an account
record automatically. When a period above ends, or when you ask us to delete
your data, Horizon deletes it by hand within 30 days.
8. Cookies
The Platform uses only cookies that are strictly necessary for it to work,
so we do not ask for your consent to them.
Terms acceptance. When you accept the Terms at the sign-in
gate, the Platform sets one cookie recording that you accepted the current
version. It holds nothing about who you are and expires after 30 days. When the
Terms change, you are asked to accept them again.
Signing in. After you sign in, the Platform's sign-in
service sets a session cookie that keeps you signed in while you use the
Platform. Microsoft sets its own cookies on its sign-in pages, under
Microsoft's privacy statement.
The Platform uses no analytics or advertising cookies. Apart from the
technical logs and security records described in Section 3, it does no other
tracking.
9. Security
The Platform is reached only over encrypted connections, and signing in
requires multi-factor authentication. Each user's session runs separately from
every other user's. The Platform's database is encrypted, is not reachable from
the internet and holds no passwords.
10. Your rights
Under UK data protection law you have the right to ask for a copy of your
personal data, to have it corrected, to have it deleted, to restrict how we use
it and to object to our use of it. Where we rely on your consent, you may
withdraw it at any time. In some cases you may also ask for your data in a
portable form.
To use any of these rights, write to
support@horizonhealthecon.co.uk.
We will reply within one month. The Platform cannot yet delete an account
record automatically, so if you ask us to delete yours, Horizon will do so by
hand within 30 days.
If you are unhappy with how we have used your data, please tell us first.
You also have the right to complain to the Information Commissioner's Office,
the UK's data protection regulator, at
ico.org.uk.
The Platform is intended for professional users, not for anyone under
18.
11. Changes to this notice
We may update this notice. The version number and date at the top show
which version you are reading, and the current version is always published at
horizonhealtheconomics.co.uk/privacy.html.
If a change affects how we use data we already hold about you, we will tell you
before it takes effect.
