Privacy notice

Who we are

The Hormonal Health Equity Initiative CIC ("HHEI", "we", "us") is a Community Interest Company limited by guarantee, registered in England and Wales (company number 17166971). Our registered contact address is available on request via info@hhei.org.uk.

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), HHEI is the data controller for personal information you share through this website.

What information we collect

We only collect information you actively give us. Specifically:

• Newsletter signups: your email address, plus the page or context the signup originated from (so we know which content brought you in).
• Resource / briefing downloads: your email address, plus a tag identifying which briefing you requested.
• Contact form submissions: your name, email address, organisation (optional), the audience category you select, and your message.

We do not use third-party advertising trackers. We do not sell your data. We do not share it with marketing networks.

Why we collect it (lawful basis)

Under UK GDPR, we rely on the following lawful bases:

• Consent (Article 6(1)(a)): when you sign up to our newsletter or request a briefing, you give us consent to send you that material and occasional related updates. You can withdraw consent at any time using the unsubscribe link in any email we send, or by emailing us.
• Legitimate interests (Article 6(1)(f)): when you submit a contact form, we process the information to respond to your enquiry. The legitimate interest is HHEI's ability to engage with potential partners, funders, and community contacts, and yours is receiving the response you asked for.

How long we keep it

• Newsletter and briefing email addresses: until you unsubscribe or until we close the list. We review the list at least annually to remove inactive contacts.
• Contact form messages: kept for up to two years from submission to allow follow-up conversations. Deleted after two years unless an active relationship requires retention.

Where it is stored

Your information is stored on our secure backend hosted on Supabase, which provides UK-aligned data infrastructure. Email delivery is handled by an integrated email service. Both providers are contractually bound to UK GDPR data protection standards. We do not transfer your data outside the UK or EEA without an appropriate safeguard in place.

Data processors (sub-processors)

To deliver this website and its services, we use the following third-party data processors. Each is bound by a data processing agreement (DPA) and processes personal data only as instructed by HHEI.

• Supabase Inc. — database and backend infrastructure. Stores contact form submissions, community sign-up records, and resource download leads. Supabase infrastructure is hosted in the EU (AWS eu-west-1) and is covered by UK GDPR transfer mechanisms.
• Email delivery provider — transactional email delivery (confirmation and welcome emails). Receives the recipient email address and first name only. No marketing data is shared. Details available on request.
• Vercel Inc. — website hosting and content delivery. Processes your IP address and browser metadata in the course of serving the website. No personal data collected via our forms is stored by Vercel.

A full sub-processor list is available on request at info@hhei.org.uk.

Your rights

Under UK GDPR you have the right to:

• Access the personal information we hold about you
• Ask us to correct inaccurate information
• Ask us to delete your information ("right to erasure")
• Withdraw consent at any time, where consent is the lawful basis
• Object to processing based on legitimate interests
• Ask us to restrict processing while a query is resolved
• Receive a copy of your information in a portable format
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email us at info@hhei.org.uk. We will respond within one calendar month.

Cookies and tracking

This website does not use cookies for advertising, third-party analytics, or cross-site tracking. We do not use Google Analytics, Meta pixels, or any equivalent. The only data stored in your browser is what is strictly necessary for the site to function (for example, remembering your choice in interactive elements during a single page visit). We do not require a cookie consent banner because we do not place non-essential cookies.

Changes to this notice

We will update this notice when our practices change. Material changes will be reflected at the top of this page (version number and date). We encourage you to review it periodically.

Contact

For any privacy question, contact us at info@hhei.org.uk.