1. Who we are and what we do

Lightning Health is a market access consultancy providing market research services to the life sciences sector.

Our Head Office is 8 Devonshire Square, London, EC2M 4PL

Our registered office is 12 Tentercroft Street, Lincolnshire, LN5 7DB

Our UK Companies House Company Registration number is: 11063972

Our ICO Registration Number is: ZA373665

Our website is: https://www.lightning.health

Our email address is: enquiries@lightning.health

Our contact number is: +44(0) 203 488 9438

This privacy notice is set out to ensure that we meet our transparency obligations under General Data Protection Regulation (GDPR) across the EEA, the UK GDPR and US Privacy law in the states of California (Californian Privacy Rights Act), Colorado (The Colorado Privacy Act), Virginia (Consumer Data Protection Act), Connecticut (Act Concerning Personal Data Privacy and Online Marketing), Utah (Consumer Privacy Act) and Iowa (Act Relating to Consumer Data Protection).

Lightning Health is committed to protecting the privacy and security of your personal information. This privacy notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with Data Protection Legislation.

This privacy notice applies to our clients, our prospective clients and website visitors.

2. Types of personal information we collect and our Lawful Basis for processing

Our clients

When you are a client of Lightning Health we will collect your name, job role, email address, business address and occasionally personal address, contact telephone number, we need this information so we can manage our contract with you. Lawful Basis Contract.

We may also send you marketing materials from time to time to inform you of new or improved services or share news about our industry or business. Lawful Basis Legitimate Interest.

 

Our Prospective Clients

We collect information from a variety of sources on the internet, these are known as open data sources. We use the following open data sources: LinkedIn, Life sciences trade and membership organisation and websites, Research Journals, National and State Regulatory Authority Websites.  We collect data such as your name, email address, job role and business address and telephone number from such sources. We do this so we can grow our business. Lawful Basis Legitimate Interest.

We also buy data from subscriptions like LinkedIn Sales Navigator and Seamless AI. We buy data such as your name, email address, job role, business address and telephone number. We do this so we can grow our business. Lawful Basis Legitimate Interest.

If we interact with you at a conference or an event, we may collect your data from the event organiser or directly from you. At such events we collect your name, email address, job role, business address and telephone number and we do this to grow our business. Lawful Basis Legitimate Interest.

We may also send you marketing materials from time to time to inform you of new or improved services or share news about our industry or business. Lawful Basis Legitimate Interest.

 

Website visitors

When you visit our website, we use strictly necessary cookies for the security purposes and for the operation of our website. Lawful Basis Legitimate Interest.

We also use analytic cookies on our website to understand how visitors use our website and interact with it. Lawful Basis Consent.

For more information on the cookies we use please see section 8 of this privacy policy.

 

If you have applied for a role with us

This notice describes how we collect and use personal information about you during and after your working relationship with us, in accordance with Data Protection Legislation.

This privacy notice applies to the information we collect when you apply for a role at Lightning Health.

It is important that you read this notice, so that you are aware of how and why we are using such information. We will use the personal information we collect about you to:

  • Consider your application in respect of a role for which you have applied
  • Consider your application in respect of other roles
  • Assess your skills, qualifications, and suitability compared to other candidates
  • Carry out background and reference checks, where applicable
  • Communicate with you about the recruitment process
  • Find appropriate candidates to fill our job openings
  • Keep records related to our recruitment processes
  • Comply with legal or regulatory requirements such as Right to Work checks

When you apply for a role at Lightning Health we will collect and process personal information about you so we can make recruitment decisions. In connection with your application, we will collect, use and store the following personal information:

  • Your resume or curriculum vitae, application form, work history, education, degrees, academic records, languages and qualifications, references and any professional licenses, memberships, or certifications. Lawful Basis: Contract/ information required prior to entering into a contract
  • Your basic contact information, including your name, address, telephone numbers (home, mobile, work), email address, Lawful Basis: Contract/ information required prior to entering into a contract
  • Your nationality, visa and immigration status, passport, and other nations identification numbers Lawful basis: Legal Obligation

 

If you are a research participant

For information about how we handle your data, please visit our research participant privacy notice

3. Your rights

EEA and UK Rights

You have the following rights over your data:

  • Request access to your personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request rectification of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.  You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
  • Object to processing of your personal information where we are relying on a legitimate interest and there is something about your situation which makes you want to object to processing on this ground.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you.
  • You can withdraw your consent for processing your data at any time. Where the processing of your personal data relies on the consent lawful basis you can withdraw your consent.

If you would like to exercise any of these rights and are a UK or EEA based resident, please contact;


US Privacy Rights

If you live in California, Colorado, Connecticut, Iowa, Utah or Virginia you have the following rights over your consumer data (please note the definition of consumer data varies from state to state. If you are resident in California, your data could be considered consumer data (other states will be considered on a case-by-case basis).

  • Right to Know/ Access. You have the right to request information on, the personal information we collected about you in the last 12 months, including the categories of personal information, the categories of sources from which your personal information was collected from, the business or commercial purpose for collecting, selling, or sharing your personal information, the categories of third parties to whom we disclosed your personal information to, and the specific pieces of personal information we have collected about you
  • Right to Delete. (Excluding) Utah) You have the right to request that we delete Personal Data that we have collected from you, subject to certain exceptions
  • Right to Correct. (Excluding Iowa and Utah) You have a right to request that we correct inaccurate Personal Data that we maintain on you
  • Right to Opt Out. (Excluding Iowa) You have the right to opt out of the sale of your Personal Data. However please note that we do not sell your Personal Data
  • Right to No Discrimination. You have the right not to receive discriminatory treatment by us for the exercise of your privacy rights. This includes employee, applicant, or independent contractor rights to not to be retaliated against for the exercise of your privacy rights. We will not discriminate against you, in any manner prohibited by applicable law, for exercising these rights

If you would like to exercise any of these rights, please contact our Data Protection Officer by email: dpo@lightning.health, or by writing to us at Lightning Health, 8 Devonshire Square, London, EC2M 4PL or by calling +44(0) 203 488 9438.

4. Who we share your personal information with

Lightning Health relies on third-party service providers and vendors that provide products and services. These include IT providers and cloud services (such as Microsoft Azure, Browser, Qualtrics, and Amazon Web Services), financial and accounting services (such as Wise, NatWest, and Xero), legal and professional service providers, and other specialist partners such as Scoro.

Our third-party service providers may have access to your personal information to perform certain functions or may host your personal information as part of a ‘cloud based’ solution used by employees. Lightning Health only uses third-party service providers that ensure sufficient guarantees for the protection of your Personal Data. All suppliers are to undergo a supplier risk assessment. Lightning Health requires third-party service providers by contract to implement appropriate data security and confidentiality obligations, in accordance with applicable law.

Our third-party providers may change over time, but we will notify you in the event of any change. If you would like further details, or to object to us sharing your data for these purposes, please notify us at dpo@lightning.health and we will provide you with detailed information and respond to your request.

In the event of the sale, merger, reorganisation, dissolution, or disposal of our business. We will inform you of any such transfer or disclosure as required by law.

We do not sell our client’s, potential client, website visitor’s or candidate’s data.

5. Transferring Information outside the UK & EEA

Data Protection Laws in the EU and UK prohibits the transfer of Personal Data belonging to European Union (EU) and UK residents outside of the European Economic Area (EEA), unless there are appropriate safeguards in place to guarantee the security of that data.

Where we use third-party service providers outside of the EEA or Switzerland, we will ensure that these organisations provide sufficient guarantees to implement appropriate technical and organisational measures for the protection of Personal Data. Where necessary, we require that any such third-party service providers execute the relevant Standard Contractual Clauses or adhere to any certification procedures issued by the Commissioner for transfer of personal data to a third country and undertake a transfer impact assessment to identify any supplementary measures required to safeguard your personal data.

If you require further information about these protective measures, you can request it from our Data Protection Officer at dpo@lightning.health.

6. Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

For most recruitment data, the standard retention period is six months, for unsuccessful candidates, if you become an employee the retention period set out in our employee privacy notice will apply.

Details of retention periods for different aspects of your personal information are available from our Data Protection Officer at dpo@lightning.health.

7. Complaints or queries

Lightning Health always tries to meet the highest standards when collecting and using personal information and we welcome feedback about this privacy policy or any other data protection issues or concerns. Please in the first instance contact dpo@lightning.health with any feedback, comments, concerns, or complaints.

UK Residents:

If you want to make a complaint about the way we have processed your personal information, you can contact the Information Commissioner’s Office in their capacity as the statutory body which oversees data protection law in the UK– www.ico.org.uk/concerns.

EEA Residents:

If you want to make a complaint about the way we have processed your personal information, you can contact the Irish Data Protection Commission Homepage | Data Protection Commission.

8. Cookies


Version 3.0. February 2026