Privacy Notice

Parachute provides health analytics services, helping organisations understand and improve workforce health and productivity. We comply with all applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Acts 1988–2018 and the ePrivacy Regulations.

Parachute is the data controller for personal data collected through our website and our health assessments. Where a client organisation, such as your employer, engages Parachute to deliver a health assessment, both parties act as independent data controllers. A Data Sharing Agreement is put in place to govern the responsibilities of each party.

Parachute collects limited personal data, mainly to produce anonymised health insights for client organisations. We may collect:

• ●Name and email address
• ●Demographic and role-related data: gender, year of birth, ethnicity, marital status, caregiver status, income range and job role or department
• ●Assessment responses relating to health and wellbeing
• ●Data provided by your employer or client organisation
• ●Communication preferences
• ●IP address and browser information collected through cookies

We use your personal data to:

• ●Send invitations to take part in health assessments
• ●Analyse responses and produce anonymised, combined health insights for client organisations
• ●Produce anonymised, combined results for regional programmes your employer takes part in, such as Living Better at Work (see section 6)
• ●Respond to your enquiries and communications
• ●Signpost you to appropriate support resources
• ●Put you in contact with relevant services, only with your consent
• ●Improve our services and user experience
• ●Use anonymised, combined data to research, develop and improve our services, including artificial intelligence (AI) models (see section 7)

Parachute does not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

We process personal data on one or more of the following lawful bases:

Special category data

Where we process special category data (including data relating to mental and physical health, cognitive health, lifestyle factors, presenteeism and health supports, and ethnicity), we do so only with your explicit consent, including to anonymise and combine your responses as described in section 7. You can withdraw your consent at any time (see section 12).

If your employer takes part in Living Better at Work, a Yorkshire and the Humber workforce health initiative run by The Living Better Network C.I.C., Parachute delivers the survey and is the data controller for your responses. Your employer shares your work email address with us only so we can send you a personal link to the survey.

Your employer receives only anonymised, combined results, shown only for groups large enough that no one can be identified. Your employer is not told whether you have taken part, and no information about you or your responses is passed to your employer.

After all personal and organisational details have been permanently removed, combined results are shared with The Living Better Network C.I.C. for its regional data trust, which is used for published reports and approved public-interest research. The Living Better Network C.I.C. never receives your answers or any information that could identify you.

We anonymise survey responses by permanently removing all information that could identify you, directly or indirectly, and combining them into group-level results. Only anonymised, combined data is used to research, develop and improve our services, including artificial intelligence (AI) models. Individual responses are never used for this purpose.

Anonymised, combined data cannot be linked back to you and is not personal data. It is never used to make decisions about you.

Parachute implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration. These include access controls, encryption and regular security reviews to protect the confidentiality, integrity and availability of your data.

We share personal data only where necessary:

• ●With trusted service providers that support delivery of our services, such as hosting, email and IT support, which act only on our instructions under contract
• ●Where we are required to do so by law

Client organisations, including your employer, and The Living Better Network C.I.C. receive only anonymised, combined results, never your individual responses. We never sell your personal data.

Personal data is kept only for as long as necessary for the purposes for which it was collected. In general, it is kept for up to 36 months after the end of the relevant relationship or engagement, unless a longer period is required by law, and is then securely deleted or irreversibly anonymised. Anonymised, combined results are not personal data and may be kept.

Where personal data is transferred outside the United Kingdom or European Economic Area, Parachute ensures appropriate safeguards are in place, such as Standard Contractual Clauses or the UK Addendum, to provide an equivalent level of protection.

Where we rely on your consent, you can withdraw it at any time by contacting [email protected]. This does not affect processing carried out before you withdrew. Once your responses have been anonymised and combined into results, they can no longer be identified or removed.

Under data protection law, you have the right to:

• ●Access – obtain a copy of your personal data
• ●Rectification – have inaccurate data corrected
• ●Erasure – ask for your personal data to be deleted
• ●Restriction – limit how your data is used
• ●Data portability – receive your data in a structured, machine-readable format
• ●Object – object to processing based on our legitimate interests
• ●Withdraw consent – at any time, where we rely on consent
• ●Not be subject to automated decisions – challenge decisions made solely by automated means

To exercise any of these rights, contact our Data Protection Officer at [email protected]. If you are not satisfied with how we handle your request, you can complain to the Information Commissioner’s Office (ICO) in the United Kingdom, or the Data Protection Commission (DPC) in Ireland.

Our services are not intended for anyone under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have, we will delete it promptly.

Our website uses cookies to improve your browsing experience. We ask for your consent before placing non-essential cookies on your device. For details of the cookies we use and how to manage your preferences, see our Cookie Policy.

Our website may contain links to other websites. We are not responsible for their privacy practices, and we encourage you to read their privacy notices before providing any personal data.

This Privacy Notice and any disputes arising from it are governed by the laws of England and Wales.

We review this Privacy Notice regularly and may update it from time to time. Any changes will be posted on this page with a new “last updated” date. Where changes are significant, we will tell you where we are able to.