This privacy notice explains how Horizon Health Economics Ltd ("Horizon", "we", "us") uses personal data in connection with the Horizon Oncology Modelling Platform (the "Platform"). It covers three groups of people: those who ask for access through the request form on our website (Section 2), those who use the Platform under Trial Access (Section 3), and registered users of the Platform (Section 4). The rest of the notice applies to all three.
The Platform's terms of use (the "Terms") are a separate document, shown before you sign in and published at horizonhealtheconomics.co.uk/terms.html. Our website and its contact form are covered by our website privacy policy, at horizonhealtheconomics.co.uk/privacy-policy.html.
1. Who we are
Horizon Health Economics Ltd (company number 16565475), whose registered office is in Poole, Dorset, United Kingdom, is the controller of the personal data described in this notice. We are registered with the Information Commissioner's Office under registration number CSN4349361.
Questions about this notice or about your data: support@horizonhealthecon.co.uk.
2. If you request access
What we collect. The request form asks for your full name, your work email address, your organisation and the reason you want access, chosen from a list. It also records your answers to two tick boxes: one, which you must tick, confirming that you have read this notice and agree to us using your details to consider your request and, if we approve it, to set up and run your trial; and an optional one saying that we may contact you about further access after your trial.
How your request is handled. The form is a Microsoft Form in Horizon's Microsoft 365 tenant. An automated workflow (Azure Logic Apps, in Horizon's own Azure subscription) emails you to confirm that we have received your request, and passes it to a member of Horizon's staff. Our emails about your request and your trial come from our shared mailbox, access.platform@horizonhealthecon.co.uk, and replies go to support@horizonhealthecon.co.uk.
A person decides. A member of Horizon's staff reads every request and decides whether to approve it. We make no decision about you by automated means alone. If we decline your request, we email you to say so.
If we approve your request. We create a guest account for you in Horizon's Microsoft Entra directory, with your name and email address, and add it to the group of trial users. The first time you sign in, Microsoft asks you to set up multi-factor authentication with Horizon, unless we have agreed to accept the multi-factor authentication of your own organisation.
The approval record. We keep a record of each request and our decision: your name, email address and organisation, the reason you gave, when you asked, whether and when we approved or declined it, when your trial ends, whether we accepted your organisation's multi-factor authentication, whether you ticked the follow-up box, and the outcome. The automated workflow also keeps a technical history of each run, which shows the steps taken with your answers hidden.
Why we use it, and our lawful basis. We use these details to consider your request, to contact you about it and, if we approve it, to set up, run and end your trial. Our lawful basis is our legitimate interests in responding to requests for access and in offering evaluations of the Platform. The required tick box records that you have read this notice. We do not rely on it as your consent, so that your trial does not depend on a consent you could withdraw part-way through.
After your trial. When your trial ends we send you one email saying so, with a short feedback survey. If you answer it, we use your answers to improve the Platform, on the basis of our legitimate interests. We contact you about further access only if you ticked "You may contact me about further access after my trial". Our lawful basis for that is your consent, which you can withdraw at any time by replying STOP to any of our emails or by writing to support@horizonhealthecon.co.uk. Without that tick, the only emails we send you are about your request and your trial.
3. If you use Trial Access
Signing in. You sign in through Microsoft, with the guest account described in Section 2. Microsoft tells the Platform your email address and that you have Trial Access. The Platform uses your email address as your identity and never sees your password.
What the Platform records. When your trial is set up, or at your first sign-in, the Platform creates an account record holding your email address, the date the record was created and the date and time at which your Trial Access ends. It also records which version of the Terms you accepted, and when, and, if Horizon suspends your access, that it did so and when. A trial account belongs to no organisation and cannot save, share or keep any analysis.
Your work is not saved. Nothing you enter, upload or create under Trial Access is saved. Each session runs in its own container on our server, separate from every other user's, and any data you upload is held only in that session's memory. The session, and everything in it, is deleted when it ends: at most about 10 minutes after you close the tab, when you sign out, after at most 2 hours, or when your Trial Access ends, whichever comes first. Tables and charts you download are saved on your own device, and Horizon keeps no copy.
Data you upload. The Terms do not allow you to upload data that identifies, or could be used to identify, any individual, and that includes pseudonymised patient-level data. Horizon uses what you upload only to produce the results you ask for during the session.
Technical logs. Microsoft records each sign-in to Horizon's tenant, including the time, your IP address and details of your device and browser. Our web server keeps an access log of the requests it receives: the time, the address requested, your IP address and the details your browser sends with each request, such as its user agent (the name and version your browser reports), but never your sign-in cookies. Our server also keeps short technical logs of sign-ins and sessions, which may include your email address and IP address. We use these logs only to keep the Platform secure and to diagnose faults. Section 7 says how long they are kept.
Security records. The Platform keeps a record of each session: when it started and ended, the email address and organisation of the account, your IP address, your browser's user agent, which downloads you made from the Platform (which file, not its contents), a short summary of the session (how many minutes it lasted and how many sections were opened), and whether another browser used the same session. The record also shows the account's access type (for example Trial Access) and whether the session was one of Horizon's own test sessions. If Horizon suspends an account, the record also notes when its open session was closed. These records never contain the content of your analyses or anything you enter or upload. We use them to keep the Platform secure and to check that it is used in line with the Terms, including the rule against operating it with automated tools or artificial-intelligence agents (Section 3 of the Terms). Section 7 says how long they are kept.
Why we use it, and our lawful basis. We use this data to provide your trial and end it on time, to keep the Platform secure, to check compliance with the Terms and to keep evidence of the Terms you accepted. Our lawful basis is our legitimate interests in providing the trial, in operating the Platform securely and in making sure it is used in line with the Terms.
4. If you are a registered user
Signing in. Registered users sign in through Microsoft in the same way, with a Horizon Microsoft 365 account or a guest account in Horizon's tenant. The Platform receives your email address from Microsoft and uses it as your identity. The technical logs and security records described in Section 3 apply to you too.
What the Platform records. Your account record holds your email address, the organisation Horizon has assigned you to, the date the record was created and when you last viewed the profiles shared with you, and, if Horizon suspends your access, that it did so and when. The Platform also records which version of the Terms you accepted, and when.
Analysis profiles. The analyses you save ("profiles") are kept in the Platform's database, with up to 10 earlier versions of each so that you can restore one, and a note of who saved each version. A profile contains whatever you entered or uploaded for that analysis, and its results. When you share a profile, the people you share it with can see the profile and your email address, and the Platform records who shared which profile with whom, and when. Profiles must not contain data that identifies any individual, including pseudonymised patient-level data (Section 4 of the Terms).
Why we use it, and our lawful basis. We use this data to provide the Platform to you and your organisation, to keep and share your work as you ask, to keep the Platform secure, to check compliance with the Terms and to keep evidence of the Terms you accepted. Our lawful basis is our legitimate interests in doing so.
5. Who processes your data, and where it is held
We use Microsoft as our processor, under Microsoft's standard data protection terms: Microsoft 365 for the request form (Microsoft Forms), email (Exchange Online) and sign-in and multi-factor authentication (Microsoft Entra ID); and Microsoft Azure for the Platform, its database and the automated workflows (Azure Logic Apps). Horizon's Microsoft 365 tenant holds its data in Microsoft data centres in the United Kingdom and the European Union. The Platform, its database and the automated workflows run in Microsoft's Azure UK West region, in the United Kingdom.
When we set up or change a Platform account, for example to start or end a trial or to suspend access, we do it through an automated workflow on GitHub (a Microsoft company), under GitHub's standard data protection terms. Your email address passes through that workflow. Once a week a separate GitHub workflow, under the same terms, produces for Horizon a security summary of the records described in Section 3. It identifies accounts by coded identifiers rather than email addresses, unless Horizon needs to look into a particular account.
We do not sell your data. We share it with no one else, except the people you choose to share a profile with, or where the law requires us to. We test the Platform with AI tools only on test accounts holding test data; your data is not shown to them.
6. International transfers
By design, your data is held in the United Kingdom and the European Union, which UK law recognises as protecting personal data adequately. There are two limited exceptions. Microsoft may process some data elsewhere, for example to provide support or to keep its services secure; and the GitHub workflows described in Section 5 may process your email address, and the weekly security summary, in the United States. In both cases Microsoft's and GitHub's standard data protection terms provide the safeguards that UK data protection law requires for such transfers.
7. How long we keep your data
Your request. The form response, the emails about your request and your trial, and the approval record are kept for 12 months after your trial ends, or after we decline your request, and are then deleted. If you become a registered user, we keep them for as long as your account is open.
Your guest account. Your guest account is disabled when your trial ends and deleted 30 days later. Microsoft keeps a deleted account for a further 30 days, during which it can be restored, and then removes it permanently. The multi-factor authentication method you registered with us goes with the account. If you do not sign in within 14 days of approval, the invitation lapses and the guest account is deleted.
Your work during a trial. Only while your session runs (Section 3).
Your Platform account record and terms acceptance records. Under Trial Access, 12 months after your trial ends, then deleted. For registered users, for as long as your account is open and for 12 months after it is closed, then deleted.
Analysis profiles. Until you delete them, or until your account is closed, when we delete them within 30 days. Deleting a profile also deletes its earlier versions and its shares. A copy that someone else saved of a profile you shared with them is their profile, not yours.
Logs. Microsoft keeps its sign-in records for 30 days. Our web server's access log is limited in size (the file being written and at most ten earlier files of 10 MiB each), so older entries are deleted automatically as new ones are written. Our server's other technical logs are limited in size, so older entries are overwritten automatically, and the technical log of each session is deleted when the session ends. The run history of the automated request workflow is kept for 90 days, and the logs of the GitHub workflows, including the weekly security summary, for 14 days.
Security records. 12 months from the session they record, then deleted. They are kept for that period even if your account is closed sooner, so that a security incident can still be looked into.
Feedback. Your answers to the feedback survey are kept for 12 months, then deleted.
Backups. The Platform's database is backed up automatically, and backups are kept for 35 days, so data deleted from the Platform remains in the backups for up to 35 days.
If you ask us not to contact you. We keep your email address on a list of people not to contact, for as long as we need it to respect your request.
Deletion by hand. The Platform cannot yet delete an account record automatically. When a period above ends, or when you ask us to delete your data, Horizon deletes it by hand within 30 days.
8. Cookies
The Platform uses only cookies that are strictly necessary for it to work, so we do not ask for your consent to them.
Terms acceptance. When you accept the Terms at the sign-in gate, the Platform sets one cookie recording that you accepted the current version. It holds nothing about who you are and expires after 30 days. When the Terms change, you are asked to accept them again.
Signing in. After you sign in, the Platform's sign-in service sets a session cookie that keeps you signed in while you use the Platform. Microsoft sets its own cookies on its sign-in pages, under Microsoft's privacy statement.
The Platform uses no analytics or advertising cookies. Apart from the technical logs and security records described in Section 3, it does no other tracking.
9. Security
The Platform is reached only over encrypted connections, and signing in requires multi-factor authentication. Each user's session runs separately from every other user's. The Platform's database is encrypted, is not reachable from the internet and holds no passwords.
10. Your rights
Under UK data protection law you have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, to restrict how we use it and to object to our use of it. Where we rely on your consent, you may withdraw it at any time. In some cases you may also ask for your data in a portable form.
To use any of these rights, write to support@horizonhealthecon.co.uk. We will reply within one month. The Platform cannot yet delete an account record automatically, so if you ask us to delete yours, Horizon will do so by hand within 30 days.
If you are unhappy with how we have used your data, please tell us first. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk.
The Platform is intended for professional users, not for anyone under 18.
11. Changes to this notice
We may update this notice. The version number and date at the top show which version you are reading, and the current version is always published at horizonhealtheconomics.co.uk/privacy.html. If a change affects how we use data we already hold about you, we will tell you before it takes effect.