privacy notice

Last reviewed: October 2026

who we are

CoreTech is a service operated by Northumbria Healthcare NHS Foundation Trust ("the Trust"), which acts as the Data Controller for personal information collected through the CoreTech website and associated enquiry channels.

CoreTech provides shared platforms, regional partnerships and commercial digital services that deliver efficient, cost-effective, high-quality support.

what information we collect

The CoreTech website does not collect personal information directly from visitors browsing the site.

We only collect information that you choose to provide to us.

why we use your information

We use your information to:

• Respond to your enquiry;
• Contact you regarding your request;
• Provide information about CoreTech products or services that you have asked about.
• Arrange meetings, demonstrations or consultations
• Manage ongoing business relationships
• Administer contracts and service agreements
• Improve our website and services
• Maintain the security of our systems
• Comply with legal and regulatory requirements
• Manage complaints, feedback and enquiries

We will only use your information for purposes that are compatible with the reason it was originally collected.

our lawful basis for processing

Depending on the circumstances, we may process personal information under one or more of the following lawful bases:

Article 6(1)(f) UK GDPR – Legitimate Interests

Our legitimate interests include:

• Responding to enquiries
• Developing and promoting CoreTech services
• Managing business relationships
• Improving our services and website
• Ensuring information security

We ensure that these interests are balanced against your rights and freedoms.

Article 6(1)(b) UK GDPR – Contract

Where processing is necessary to take steps prior to entering into a contract or to fulfil contractual obligations.

Article 6(1)(c) UK GDPR – Legal Obligation

Where we are required to process information to comply with applicable laws and regulatory requirements.

Article 6(1)(a) UK GDPR – Consent

Where we specifically ask for your consent, such as for certain marketing activities or optional cookies. You may withdraw your consent at any time where consent is the lawful basis relied upon.

who we share your information with

Your information may be shared with:

• Authorised CoreTech staff
• Authorised employees of Northumbria Healthcare NHS Foundation Trust
• Approved suppliers supporting the operation of CoreTech
• Professional advisers, auditors or regulators where necessary
• Law enforcement agencies or other public authorities where required by law

We will only share the minimum information necessary and will ensure appropriate contractual and security safeguards are in place. We do not sell personal information to third parties.

how long we keep your information

We retain personal information only for as long as necessary for the purpose for which it was collected. Retention periods will depend upon the nature of the information and our legal, regulatory and operational requirements.

Information will be managed in accordance with:

• Trust Records Management Policies
• The NHS Records Management Code of Practice
• Applicable statutory retention requirements

Further information can be requested by contacting us.

is providing your information mandatory?

No. Providing your personal information is generally voluntary. However, if you do not provide sufficient contact details, we may be unable to respond to your enquiry, provide requested information, arrange services or demonstrations or enter into contractual arrangements.

marketing and business development communications

CoreTech may use your contact information to send you information about products, services, events, updates, case studies, training opportunities, and other business-related communications that may be of interest to you or your organisation.

We will only send marketing communications where we are permitted to do so under applicable data protection and electronic communications legislation.

How we use your information for marketing

We may use:

• Your name
• Job title
• Organisation name
• Business email address
• Business telephone number
• Information about previous interactions with CoreTech

to:

• Provide information about CoreTech services and solutions;
• Invite you to events, webinars, demonstrations, and networking opportunities;
• Share relevant news, updates, and service developments;
• Promote products and services that may be relevant to your organisation.

Lawful basis

Where marketing communications are sent to business contacts, the Trust will generally rely upon Article 6(1)(f) UK GDPR (Legitimate Interests).

Our legitimate interest is promoting CoreTech's services, developing commercial relationships, and providing information that may be relevant to organisations with an interest in our products and services.

Where consent is required by law, we will obtain your consent before sending marketing communications and you may withdraw that consent at any time.

Opting out

You have the right to object to direct marketing at any time.

You can opt out by:

• Clicking the unsubscribe link included in marketing emails (where available);
• Contacting us using the details provided in this privacy notice;

If you opt out of marketing communications, we may still contact you regarding existing enquiries, contracts, service-related matters, or other communications that are necessary to manage our relationship with you.

Marketing preferences

We will maintain records of your marketing preferences to ensure that your choices are respected and that we do not send communications you have chosen not to receive.

automated decision-making

We do not use your information for automated decision-making or profiling.

your rights

Under UK GDPR, you have the right to:

• Be informed about how your information is used;
• Request access to your personal information;
• Request correction of inaccurate information;
• Request deletion of information in certain circumstances;
• Request restriction of processing in certain circumstances;
• Object to processing in certain circumstances;
• Request data portability where applicable.

complaints

If you have concerns about how the Trust has collected, used, shared or protected your personal information, we encourage you to raise these with us in the first instance so that we can investigate and respond.

Complaints relating to the processing of personal data should be submitted to the Trust's Data Protection Officer using the contact details below. Please provide as much information as possible about your concern, including any relevant dates, departments involved and the nature of the issue.

Upon receipt of your complaint, the Trust will acknowledge your concern and undertake an appropriate investigation. We will aim to provide a response as soon as reasonably practicable, and we aim to respond within one month. We will keep you informed where additional time is required to complete our enquiries.

If, after receiving our response, you remain dissatisfied with how your concern has been handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority responsible for overseeing information rights and data protection legislation.

external links

The CoreTech website may contain links to third-party websites. This privacy notice does not apply to those websites and we encourage you to read their privacy notices before providing any personal information.

changes to our policy

If our privacy policy changes in any way, we will place an updated version on this page. Regularly reviewing the page ensures you are always aware of what information we collect, how we use it and under what circumstances, if any, we will share it with other parties.

contact information