Privacy Notice

This Privacy Notice explains how Parachute (Parachute Intelligence Ltd) collects, uses, stores, and protects personal data. Parachute is committed to safeguarding your privacy and handling your data transparently.

1. General

Parachute provides health analytics services, helping organisations understand and improve workforce health and productivity. We are committed to complying with all applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Acts 1988–2018, and the ePrivacy Regulations.

2. Data Controller

Parachute is the Data Controller for personal data collected through our website or health assessments. Where a client organisation engages Parachute to deliver health assessment services, both parties act as independent data controllers. In such cases, a Data Sharing Agreement (DSA) is put in place to govern the responsibilities and obligations of each party.

3. Collection and Use of Personal Data

Parachute collects limited personal data primarily for the purpose of producing anonymised health insights for client organisations. We may collect the following types of personal data:

• ●Name and email address
• ●Demographic data (e.g. age range, department)
• ●Assessment responses relating to health and health
• ●Data provided by your employer or client organisation
• ●Communication preferences
• ●IP address and browser information collected via cookies

4. Using Your Personal Data

We use your personal data for the following purposes:

• ●To send invitations to participate in health assessments
• ●To analyse and produce anonymised health insights for client organisations
• ●To respond to your enquiries and communications
• ●To signpost you to appropriate support resources
• ●To facilitate contact with relevant services, with your consent
• ●To improve our services and user experience

Parachute does not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

5. Lawful Bases for Processing

We process personal data under one or more of the following lawful bases:

Where we process special category data (including data relating to mental and physical health, cognitive health, lifestyle factors, presenteeism, and health supports), we do so only with your explicit consent.

6. Security

Parachute implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include access controls, encryption, and regular security reviews to ensure the ongoing confidentiality, integrity, and availability of your data.

7. Data Retention

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected. In general, data will be retained for up to 36 months after the conclusion of the relevant relationship or engagement, unless a longer retention period is required by law or regulation.

8. Transfer of Data Abroad

Where personal data is transferred outside the United Kingdom or European Economic Area, Parachute ensures that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or the UK Addendum, to ensure an equivalent level of data protection.

9. Children

Our services are not intended for individuals under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete that information promptly.

10. Your Rights

Under data protection legislation, you have the following rights:

• ●Right of Access — obtain a copy of your personal data
• ●Right to Rectification — request correction of inaccurate data
• ●Right to Erasure — request deletion of your personal data
• ●Right to Restrict Processing — limit how your data is used
• ●Right to Data Portability — receive your data in a structured, machine-readable format
• ●Right to Object — object to the processing of your personal data
• ●Right to Object to Automated Decisions — challenge decisions made solely by automated means

To exercise any of these rights, please contact our Data Protection Officer at [email protected].

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom, or the Data Protection Commission (DPC) in Ireland.

11. Cookies

Our website uses cookies to enhance your browsing experience. We obtain your consent before placing non-essential cookies on your device. For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

12. Third-Party Websites

Parachute uses trusted third-party data processors to support the delivery of our services. Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those external sites, and we encourage you to review their privacy policies before providing any personal data.

13. Jurisdiction

This Privacy Notice and any disputes arising from it are governed by the laws of England and Wales.

14. Changes to This Notice

This Privacy Notice is reviewed regularly and may be updated from time to time. We encourage you to check this page periodically for any changes. Continued use of our services following any updates constitutes acceptance of the revised notice.