ORCHA Data Protection Principles
ORCHA respects the privacy of all who engage with the ORCHA App Review platform, or organisations who engage in partnership or project work with ORCHA.
ORCHA strives to ensure that all data that is shared with us as a consequence of those relationships is treated with respect for personal, and client, privacy and protected in line with all of our legal responsibilities and recognised best practice standards and processes.
ORCHA will only collect the minimum levels of personal data necessary to support our operational processes and will never share, or sell, personally identifiable data collected in the course of maintaining ORCHA business without clearly gaining informed consent from any ORCHA users, or clients, who may be affected by that action.
Why we publish this policy?
ORCHA also publishes this policy to ensure all ORCHA data capture, data management and data utilisation processes are transparent to our end users; and to clearly explain what data we collect and how ORCHA uses any personal information that you supply to us.
How we collect information
ORCHA collects personal information about you when you:
- register with us to become a member of ORCHA
- undertake actions on the ORCHA site such as:
- Register to become an ORCHA member
- Recommend an App to another user
- visit webpages on an ORCHA site
- complete specific actions on an ORCHA webpage – e.g. Download an App
- complete an ORCHA survey
- take part in an ORCHA event or competition
- make a donation or give us personal information in any other way
All of these actions are required to enable ORCHA to deliver its services and only the minimum level of data is captured at each point.
The data that is captured through your interactions with ORCHA are stored securely in protected data warehouses and are only accessible to accredited administrative users with specific access permissions. Data in transit between webpages and the data store are encrypted in transit to minimise the risk of interception.
What information we collect?
The types of personal information ORCHA collects may include:
- Your name (All)
- Your email address (All) or mobile telephone number (end users only)
- Work Postcode (Pro Users only)
- Job Title (Pro Users only)
- The pages you view on ORCHA websites (All)
- The Apps you recommend to others (Pro Users or Digital Healthy Schools Users only)
- The Apps you download via the ORCHA sites (All)
- Credit Card/Billing Information if applicable (Developers only)
Any information we collect about you is stored securely and treated in accordance with current International Data Protection principles and legislation.
How we use your information?
ORCHA uses the information that you give to us:
- to send you information, products or services that you have consented to receive
- to improve the information, products and services ORCHA offers to its users. (This includes improving our capability to match Health Apps specific to your health need/age/preferences and general improvement of ORCHA website and review functionality and presentation)
- to contact you about events, fundraising, campaigning and our other work, where you have consented to receiving marketing information
- to develop aggregated reports and analysis, using anonymised data, to support research into the broader ongoing development of the Health App market and the utilisation of Health Apps within a defined Health Economy
ORCHA may link data captured from different ORCHA services, at a personal level, in order to improve our understanding of service utilisation and to support analyses on site utilisation and activity, but ORCHA will never publish, share or sell personally identifiable data without explicit and informed consent being received from all parties whose data is being used for those purposes.
ORCHA will not pass your personal details to other people or organisations without first obtaining your consent.
ORCHA reserves the right to share your information with other companies that we own or other companies that help us provide any of our services.
However, there may be rare occasions where information gathered through the day to day collection of ORCHA data identifies a clear need to safeguard the welfare of the individual and/or his/her family and, on those occasions, it may be necessary to contact relevant authorities to address this. ORCHA will only undertake these actions in line with appropriate legal guidelines and using formal, recognised and auditable processes.
Cookies are small text markers stored on your computer that enable us to understand how people use our website.
No personally identifiable information is stored in cookies. In common with many similar websites, ORCHA uses them to help remember preferences and for anonymous statistical measurements - for example so we know how many "hits" a page has had.
- remember certain information about users so they don’t have to repeatedly give the same information
- recognise if users are already logged in to certain areas of the website
- measure how people use our website so we can continually improve how information is provided.
You can control and delete cookies
You can do this through your chosen internet browser (Internet Explorer, Google Chrome, Mozilla Firefox etc.). Use the help function within the specific browser to find out how.
However, if you restrict cookies for the ORCHA website then there is a risk you will not be able to access the full functionality of the ORCHA website and your user experience may be undermined as a result.
What cookies are used on ORCHA sites?
The cookies applied on ORCHA websites are:
Google Analytics - This is a service we use from Google that collects information about how people use our website. We use this to make sure we are providing the best service we can to our web visitors. This information cannot be used to identify you and is only available for ORCHA's internal use only. ORCHA does not allow Google to share it. Using cookies, Google Analytics captures information that allows ORCHA to understand:
- What pages were viewed
- How long those pages were viewed for
- How the user came to the site
- What website buttons and functions were clicked on
- What browser was used to access the site
- What country the computer is accessing the site from
- What search terms were used
Cookies that are set by other websites - If you are using the sharing facility already mentioned (i.e. Share content with Facebook, Twitter) then it is possible those websites (i.e. Facebook) may also set cookies when you log in to their service. ORCHA is not responsible for third party cookies of this nature and does not control these cookies.
Embedded third party services - Occasionally we embed things like video, audio and pictures from other websites such as such as YouTube, Vimeo, Flickr or Soundcloud. This means it looks like one of our web pages, but the video is being fed through from another site (i.e. YouTube). This means that every time one of our pages with this sort of embedded content is visited, those other sites may use their own cookies to record that you watched or viewed the content. ORCHA has no control over these cookies so you should check the relevant website for more information.
How we protect your personal information?
ORCHA implements a range of measures to ensure that any personal information that you provide us with is kept secure, accurate and up to date.
ORCHA’s protective measures cover everything from:
- Regular reviews of data capture processes to ensure only data that is necessary to support the delivery of ORCHA services is captured
- The implementation of transparent, informative Consent capture mechanisms to ensure that all ORCHA service users understand why ORCHA collects their data and how ORCHA manages that data. In addition, ORCHA consent processes allow users to monitor and amend their consent preferences should their preferences change
- The encryption of data in transit between the ORCHA sites/Apps to the secure data storage facilities
- The maintenance of secure data management environments through strong application of Data Warehousing standards and role-based access controls for authenticated and accredited users.
Access to the raw data collected through ORCHA interactions with end users of our services is limited to only those with the appropriate administrative permissions.
ORCHA only keeps personally identifiable data for as long as it is needed and only for the purposes for which our end users have agreed we can use it.
All of the personal data that ORCHA holds is held in its database in an identifiable form in its ‘raw’ state. However, internal ID codes are used when the data is being worked on or moved across the database for reporting or other purposes. All ORCHA data is encrypted in transit.
Access to our core databases is strictly controlled and role-based access controls are implemented on all reporting outputs to ensure that identifiable data is only presented to those with a legitimate reason and user consent to access it (e.g. Site Administrators, Professionals who have made recommendations to the individual etc.).
All other reporting outputs, in any format, will be designed to ensure personal privacy is maintained through the use of pseudonymisation, anonymisation and aggregation as appropriate.
Our data servers are stored on Amazon Web Services Cloud Servers in the UK/Ireland and maintained in line with the highest data security protocols and protections. A limited number of ORCHA employees have access to the raw data and their responsibilities in relation to maintaining privacy are well known, included in their employment contracts and their induction training processes.
Regular Information Governance and Data Security training updates are provided to maintain full ORCHA staff compliance with GDPR responsibilities and to ensure we remain aware of the latest priorities around Privacy and Confidentiality.
ORCHA are working towards full ISO 27001 compliance.
Under 18 year olds
For users who are 18 or under, a parent/guardian's permission is required before any personal information is captured relating to the individual.
By providing ORCHA with personal information, the end user is agreeing to ORCHA’s use of that information as stated in this Privacy Statement.
The capturing of your consent to utilise ORCHA member services is contained within the ORCHA registration process and will clearly inform the user at the point of registration why the data we are requesting is necessary and what that data will be used for by ORCHA.
The ORCHA consent process requires all end users to positively opt-in to a range ORCHA services, with information provided to explain each option prior to sign up. Consent preference can be changed through a User Profile at any time.
Right of Access
You have the right at any time to ask for a copy of the information that ORCHA holds about you, and ORCHA will supply that data to you in line with its legal requirements to do so. If any information that ORCHA holds about you is wrong, you have the right to ask ORCHA to make the necessary corrections.
If your personal details change, please help the ORCHA team to keep those details up to date by telling us about any changes.
If you want to see what information we have about you, or need to tell us about any changes to the information that you have given to us, please contact:
ORCHA Vanguard House,
We may change this Privacy Statement at any time. If you use this website after changes are made you will be agreeing to those changes.