Privacy Policy
Moran Health Consulting Ltd is committed to protecting personal information and using data lawfully, fairly and transparently.
This Privacy Policy explains how Moran Health collects, uses, stores, shares and protects personal information.
Our approach is to use information only where it is needed, to protect confidential information carefully, and to avoid identifiable data where aggregated, anonymised or pseudonymised information is sufficient.
This is our public Privacy Policy Statement. More detailed arrangements may apply for specific client projects, contracts, data processing agreements, information governance packs, data sharing agreements or project-specific privacy notices.
Who we are
Moran Health Consulting Ltd is responsible for personal information we collect and use for our own business purposes. Where Moran Health processes information on behalf of a client, our role may be defined by the relevant contract, data processing agreement, data sharing agreement or information governance documentation.
Contact details:
Moran Health Consulting Ltd
Tuchethill Cottage
Dollerie
Crieff
PH7 3NX
Email: admin@moranhealth.com
Data protection contact: Andrew Moran, Chief Executive Officer
Website: MoranHealth.com
Information we may collect
The information Moran Health collects depends on how you interact with us.
We may collect contact details, organisation details, role details, enquiry information, correspondence, meeting notes, proposal information, contract information, billing information, supplier or associate information, event or workshop information, professional biographies, due diligence records, conflict of interest declarations, feedback and other information needed to manage our relationship with you.
If you contact us through the website, by email, through a form, by telephone, through a meeting or through a professional network, we may collect the information you choose to provide.
If Moran Health is asked to support client work involving health, care, public sector, operational, analytical or service data, the personal information involved will depend on the project and the client’s instructions. Moran Health will seek to avoid identifiable data unless it is necessary, lawful and appropriately governed.
We may also receive information from clients, suppliers, associates, public bodies, professional contacts, event partners, procurement systems, public registers, public websites, professional profiles, payment systems, due diligence processes and website or analytics tools.
Where a client provides information to Moran Health for a project, the client may remain responsible for determining the purpose and lawful basis for that processing.
How we use information
Moran Health may use information to respond to enquiries, arrange meetings, prepare proposals, manage client relationships, deliver services, manage projects, administer subscriptions, manage suppliers and associates, issue invoices, run events or workshops, maintain records, protect security, meet legal obligations and improve our services.
Moran Health will not use personal information in ways that are materially incompatible with the purpose for which it was collected unless there is a lawful basis to do so.
Lawful basis for processing
Moran Health will only process personal information where there is a lawful basis.
Depending on the context, we may rely on consent, contract, legal obligation, legitimate interests, or another lawful basis identified through the relevant client, contractual or information governance arrangements.
Where Moran Health processes special category data or criminal offence data, we will only do so where an additional legal condition applies and suitable safeguards are in place.
Data minimisation and safe use
Moran Health aims to use the minimum personal information necessary for the purpose.
Where possible, Moran Health prefers aggregated analysis, anonymised outputs, pseudonymised information, derived data, small number suppression and other controls that reduce the need to use identifiable information.
Identifiable, sensitive or confidential information will only be used where it is necessary, proportionate, lawful and appropriately governed.
Analytics, automation and decision support
Moran Health works with data, evidence, analytics, dashboards, automation, tender intelligence, scoring tools and decision support methods.
Where these methods involve personal information, Moran Health will consider the purpose, lawful basis, data inputs, data quality, limitations, security controls, human oversight and intended use.
Moran Health’s default approach is to use UK-based or client-approved systems and processing arrangements where this is appropriate and proportionate. Moran Health is based in Scotland and may work with clients, suppliers and partners in the UK and internationally. Where work involves overseas clients, suppliers, systems or users, Moran Health will protect personal information in line with applicable contracts, relevant local data protection law, UK data protection requirements where they apply, and appropriate information governance and security controls.
Moran Health uses proportionate contractual, technical and organisational safeguards to protect information. These may include client-approved systems, secure cloud environments, access controls, multi-factor authentication, role-based access, encryption, secure transfer methods, VPN use where appropriate, supplier assurance, confidentiality obligations, audit records and restrictions on onward use.
Moran Health does not use analytics or automated outputs as a substitute for accountable human judgement. Outputs are decision support and should be interpreted with appropriate context, caveats and review.
Moran Health does not currently make decisions about individuals based solely on automated processing through this website.
Sharing information
Moran Health may share personal information where it is necessary, lawful and proportionate.
This may include sharing information with clients, suppliers, associates, subcontractors, professional advisers, accountants, insurers, legal advisers, IT providers, website providers, cloud providers, payment providers, event partners, regulators, public authorities or other parties where required for service delivery, governance, security, legal compliance or business administration.
Where suppliers, associates, subcontractors or partners process information on behalf of Moran Health, they are expected to handle it securely and only for the agreed purpose.
Moran Health does not sell personal information.
Website, cookies and analytics
Moran Health’s website may use cookies and similar technologies to operate the site, support security, understand website performance, remember preferences and improve user experience.
Some cookies may be essential for the website to function.
Further information should be available through Moran Health’s cookie notice or website cookie settings where available.
Storage, security and access
Moran Health stores information securely using appropriate technical and organisational controls.
The controls used will depend on the nature of the information, the purpose of processing, the systems involved, the client or supplier arrangements, and the legal or contractual requirements that apply.
Access to information is restricted to people who need it for the relevant purpose.
No system can be guaranteed to be completely secure, but Moran Health takes proportionate steps to protect personal information against unauthorised access, misuse, loss, alteration, disclosure or destruction.
Retention
Moran Health keeps information only for as long as necessary for the purpose for which it was collected, or where we need to retain it for legal, contractual, audit, insurance, regulatory, tax, accounting, dispute resolution, safeguarding, information governance or legitimate business reasons.
For general website enquiries, we retain contact details and enquiry information for up to 24 months after the last meaningful contact, unless a longer period is needed because the enquiry becomes part of a client, supplier, associate, contractual, complaints, legal or assurance record.
For client, supplier, associate, subcontractor, contract, proposal, invoice, assurance, project, due diligence and governance records, retention periods may be longer and will depend on the nature of the relationship, the contract, the sensitivity of the information and any legal or regulatory requirements.
Where Moran Health processes information on behalf of a client, retention and deletion may be governed by the relevant client contract, data processing agreement, data sharing agreement, information governance documentation or project-specific instructions.
At the end of the relevant retention period, Moran Health will delete, return, archive or securely dispose of personal information as appropriate. Where records are retained for assurance, legal, contractual or governance reasons, Moran Health will limit access and retain only what is necessary.
Your rights
Under data protection law, you may have rights in relation to your personal information.
These rights may include the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to object, the right to data portability where it applies, and rights relating to automated decision making where they apply.
These rights are not absolute and may depend on the lawful basis, the nature of the information, Moran Health’s role, legal obligations and the context of processing.
You are not required to pay a charge for exercising your rights. Moran Health will usually respond within one month. If a request is complex or involves a large amount of information, the response period may be extended where permitted by law.
To make a request, contact admin@moranhealth.com.
Accuracy and correction
Moran Health aims to keep personal information accurate and up to date where necessary for the purpose for which it is used.
Please contact us if you believe information we hold about you is inaccurate, incomplete or out of date.
Where Moran Health is processing information on behalf of a client, we may need to refer correction requests to the relevant client.
Children and young people
Moran Health’s public website and general consultancy services are not aimed at children.
Where Moran Health supports client work involving children or young people, this will be handled through the relevant client, contractual and information governance arrangements.
Marketing and communications
Moran Health may contact clients, potential clients, partners, suppliers, associates or professional contacts with relevant updates, invitations, publications or information about Moran Health services where there is a lawful basis to do so.
You can ask Moran Health to stop sending non-essential communications at any time by contacting admin@moranhealth.com.
Moran Health does not sell personal information for marketing.
Complaints and concerns
If you have any concerns about Moran Health’s use of your personal information, please contact us first so we can review the matter.
Email: admin@moranhealth.com
Postal address: Moran Health Consulting Ltd, Tuchethill Cottage, Dollerie, Crieff, PH7 3NX
You may also complain to the Information Commissioner’s Office if you are unhappy with how your personal information has been used.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
ICO helpline: 0303 123 1113
ICO website: ico.org.uk
Changes to this Privacy Policy
Moran Health may update this Privacy Policy from time to time to reflect changes in our services, website, legal obligations, data protection guidance, suppliers, assurance arrangements or business operations.
The latest version will be published on this page.