Business Health Check Privacy and Data Protection Policy
Business Health Check Privacy and Data Protection Policy
Last updated September 2026
This Policy explains how The IncuHive Group Limited collects, uses, stores and shares personal information in connection with Business Health Check. It also explains the handling of commercially sensitive business information. It should be supplemented by a cookie notice and programme-specific privacy information where required.
1 Who we are
The IncuHive Group Limited is the organisation responsible for Business Health Check. Address: Hursley Park Road, Hursley, Hampshire SO21 2JN, United Kingdom. Company number: [insert]. Privacy contact:
Our role as controller, joint controller or processor may differ for a commissioned programme. The programme notice will identify the relevant council or other commissioning organisation and explain the arrangement.
2 Information we collect
We may collect names, contact details, job titles, account and authentication data, organisation details, ownership and management information, trading history, turnover, profitability, cash flow, debt, funding, staffing, sales, customers, suppliers, markets, strategy, objectives, operational risks, founder goals, questionnaire responses, scores, reports, recommendations, repeat-assessment history, communications and technical usage data such as IP address, browser, device and security logs.
Some information is commercially sensitive without being personal data. Where responses identify founders, directors, staff, customers or other individuals, UK data protection law may apply. Avoid unnecessary special-category or criminal-offence data; we will identify an Article 9 or Article 10 condition before intentionally collecting such data.
3 How information is collected
Information may be provided directly during registration, purchase, questionnaires, support or adviser contact; provided by an employer, colleague, council or programme partner; generated through scoring and analysis; or collected automatically through logs, security tools and cookies. The source and any mandatory fields should be identified at the relevant collection point.
4 Purposes
We use information to create and manage accounts; process payments; provide assessments, scores, reports and recommendations; deliver adviser support; track progress; administer funded programmes; verify eligibility; report participation, outputs and outcomes; communicate about service changes and renewal; prevent fraud and secure systems; troubleshoot and improve the service; meet legal, tax, audit and contractual obligations; handle complaints and rights requests; and produce aggregated or anonymised statistics.
We will not use identifiable information for a materially incompatible purpose without assessing the lawful basis and providing additional transparency where required.
5 Lawful bases
Contract may apply where processing is necessary to provide a requested paid or participant service. Legitimate interests may apply to service delivery and improvement, programme administration, security, fraud prevention, relationship management and effectiveness measurement, subject to a balancing assessment. Legal obligation applies to statutory duties. Consent applies where it is the appropriate basis, including certain electronic marketing.
Public authorities may rely on public task for their own programme processing. Their notice should state their basis. Consent will not be presented as freely given where access depends on processing that is actually necessary for the service or programme.
6 Funded and commissioned programmes
When access is funded or commissioned, information may be shared with the named council, combined authority, government department, university, public body or other organisation. Depending on the documented arrangement, the parties may be independent controllers, joint controllers, or controller and processor.
Possible disclosures include business and contact details, eligibility, participation, responses, assessment results, reports, recommendations, support activity, progress, outcomes and information required for monitoring, evaluation, audit or funding. The exact fields, purpose, lawful basis, retention and rights route must be stated in a programme-specific notice before collection.
7 Artificial intelligence
Information submitted through the platform may be transmitted to an external AI service provider, including OpenAI, to analyse responses, identify patterns, generate draft narrative, suggest actions and help advisers tailor support. Inputs may contain business information and personal data.
We will use an approved organisational or API service under suitable contractual and security terms, configure available data controls, limit inputs to what is necessary, restrict access, and document retention and international-transfer arrangements. Statements about training use or provider retention must match the contracted product and current configuration.
AI outputs may be wrong or incomplete. They are used as decision support and should receive proportionate human review, particularly where recommendations may materially affect a person or business.
8 Profiling and automated decisions
Scoring and assessment may constitute profiling. The purpose is diagnostic support, not a credit rating, lending decision, investment recommendation or guarantee. We do not intend to make solely automated decisions that produce legal or similarly significant effects on individuals.
If that position changes, we will assess Article 22 UK GDPR, provide required information about logic and consequences, and implement rights to human intervention, expression of views and challenge where applicable.
9 Recipients and processors
Recipients may include authorised IncuHive staff and advisers, commissioning organisations, hosting and cloud providers, database and software providers, payment processors, email and communications services, analytics and security providers, professional advisers, insurers, auditors, regulators and law-enforcement bodies where required.
Processors must be appointed under appropriate written terms, receive only necessary data and meet security and assistance obligations. The supplier register should identify the product, purpose, location, contract, subprocessors and deletion process.
10 International transfers
Some suppliers may process data outside the United Kingdom. Where required, we will use UK adequacy regulations, the International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another recognised safeguard, and complete a transfer risk assessment where appropriate. Details can be requested from the privacy contact, subject to lawful confidentiality restrictions.
11 Data retention
We retain personal data only for as long as needed for the stated purposes and legal, tax, contractual, funding, audit, insurance and dispute requirements. Different programmes may require different periods. At the end of the period, data will be securely deleted, anonymised or archived where continued retention is required.
Before publication, insert or link to a retention schedule covering accounts, assessments, raw responses, reports, payment records, support records, security logs, enquiries, complaints, consent evidence, backups and funded-programme records. Aggregated or genuinely anonymised statistics may be retained longer.
12 Security and confidentiality
We use measures appropriate to risk, which may include encryption in transit and at rest, role-based access, multi-factor authentication, environment separation, secure development, logging, monitoring, backups, vulnerability management, supplier due diligence, staff training and incident response. No online system can guarantee absolute security.
Access to commercially sensitive information is restricted to people and organisations with a legitimate need under this Policy and the programme arrangements. Users should not submit credentials, payment-card security data, private keys or information they are not authorised to disclose.
13 Data accuracy and minimisation
We design forms to collect information relevant to the assessment and programme. Users may update account information and should notify us of material errors. Free-text fields should warn against unnecessary personal or special-category information.
14 Your responsibilities for other people
If you provide information about directors, employees, shareholders, contractors or others, you must be entitled to provide it and, where required, ensure they receive appropriate privacy information. Do not provide personal data that is irrelevant to the Business Health Check.
15 Your rights
Subject to legal conditions and exemptions, individuals may have rights to be informed, access their data, rectify inaccuracies, erase data, restrict processing, object, receive portable data and receive safeguards relating to certain automated decisions. Where processing relies on consent, consent may be withdrawn without affecting earlier lawful processing.
Requests should be sent to
16 Marketing
We may send service messages necessary to operate an account or subscription. Marketing is separate. We will rely on consent or another lawful route permitted by the Privacy and Electronic Communications Regulations, provide an unsubscribe method and maintain suppression records. Marketing consent is optional and must not be bundled with acceptance of Terms or necessary processing.
17 Cookies and analytics
The website should provide a separate cookie notice and consent tool. Strictly necessary technologies may operate without consent where law permits. Non-essential analytics, advertising or similar technologies should not be set until valid consent is obtained. Users must be able to reject non-essential cookies as easily as accept them and later change their choice.
18 Children
The service is intended for adults acting in a business context and is not directed to children. If we learn that a child's personal data has been collected without an appropriate basis, we will investigate and delete or otherwise address it as required.
19 Data breaches
We maintain a process to detect, assess, contain and document personal-data breaches. Where required, we will notify the ICO without undue delay and, where feasible, within 72 hours after becoming aware. Affected individuals will be informed where the law requires.
20 Complaints
Contact
21 Changes to this Policy
We may update this Policy to reflect changes in the service, suppliers, programmes or law. The latest version and effective date will be published on businesshealthchecks.co.uk. We will give additional notice of material changes where appropriate.
22 Contact
The IncuHive Group Limited, Hursley Park Road, Hursley, Hampshire SO21 2JN, United Kingdom. Privacy email: