Privacy Policy

Who We Are — Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is:

If you have any questions about how we handle your personal data, please contact us at the email address above before raising a complaint with the ICO.

Data We Collect

We collect personal data through the following routes:

Contact & Enquiry Form

When you submit an enquiry via mirkovonhein.com/contact, we collect your name, organisation, email address, the type of enquiry, and any information you include in your project description. This data is processed by WPForms and sent to our email.

Session Bookings (TidyCal)

When you book a Discovery Call or Expert Advisory Session, TidyCal collects your name, email address, and calendar availability. Payment for paid sessions is processed by Stripe, which collects payment card information directly — we do not store or have access to your card details.

Newsletter (Pharma Radar via Beehiiv)

If you subscribe to the Pharma Radar newsletter, Beehiiv collects your email address and, where provided, your name. Beehiiv may also collect engagement data such as email open rates and click-through rates. You can unsubscribe at any time using the link in any newsletter email.

Course Waitlist & Enrolment (HEOR Fundamentals)

When you join the HEOR Fundamentals course waitlist, we collect your name, work email, role or function, and your answer to whether your employer might fund the course. If you tick the optional box, your email is also added to the Pharma Radar newsletter. When you enrol in (purchase) the course, payment is processed by Stripe, which collects your name, email, billing address and — for business customers — your VAT number; we do not store or have access to your card details. Waitlist and enrolment records are routed through Make.com (an automation service) and stored in Google Sheets, and a notification is sent to our business email (Microsoft 365).

Course Portal (courses.mirkovonhein.com)

When you enrol in HEOR Fundamentals we create an account for you on the course portal. The portal runs on WordPress on our own hosting. It collects the following data.

Your account. Your first name, last name and email address, and a password you set yourself through a one-time link we email you. WordPress stores the password in hashed form. We cannot read it.

Your profile. Your first and last name appear in the footer of your course slides and on your certificate, exactly as you type them. Everything else on the Account page is optional: a profile photo, your company and job title, your sector, your years of experience, your highest qualification and field of study, your country, and a link to your LinkedIn profile. You can add, change or remove any of these at any time.

Your postal address. Optional. If you give it, we use it once, to post you something when you finish the course. Nothing else is sent to it.

Your learning record. Which chapters you have watched and where you stopped in each video, which modules you have completed, your answers and scores on the module quizzes, the exercise answers you submit, the reflection notes you write after seeing a model answer, your two Roadmap self-assessments (the statements you ticked and the scores per module, in week one and week twelve), the badges you earn, and a log of which slide decks you downloaded. Exercise answers you submit are readable by Mirko von Hein, as the portal tells you before you submit. Reflection notes are readable by him only if you tick “Let Mirko read the notes I submit here” on the Account page.

Your choices. Five settings on the Account page: whether we may email you in six months to ask where you have got to; whether we may ask you for feedback on the course; whether we may quote that feedback publicly with your first name and job title; whether we may ask you about using your story publicly; and whether Mirko may read your reflection notes. The six-month follow-up is on by default and the rest are off. You can change any of them at any time.

Your certificate. When you complete all twelve modules we issue a certificate of completion carrying your name, the completion date and a credential ID. Anyone who enters that ID on our verification page sees your name, the course name and the completion date, and nothing else.

Video streaming (Bunny.net). Course videos are streamed by Bunny Stream. Each video link is signed for your session and expires after six hours. To deliver the video, Bunny processes your IP address, your browser and device details and playback requests, as any video host must. We have switched off Bunny’s own viewer analytics. Where you stopped in a video is stored in your portal account, not by Bunny.

Sign-in security. The portal records the IP address and time of failed sign-in attempts and locks an account for 20 minutes after four failures. Our hosting provider (Hostinger) and CDN (Cloudflare) process your IP address and request data as described under Website Hosting & CDN below.

Email from the portal. The portal sends you a welcome email with your set-password link, password reset emails when you ask for them, a confirmation if you ask us to delete your data, and, only if you opted in, the six-month follow-up and a request for feedback. These are sent from [email protected] through SMTP2GO, an email delivery service.

Support channels. The portal links to Discord, WhatsApp, TidyCal and email for help. These are separate services under their own privacy policies, and you choose whether to use them. The portal records only that you pressed the button, which is how the related badge is awarded.

What the portal does not do. It does not run Google Analytics or any other analytics or advertising tool. It does not show your progress, scores or answers to other learners. It does not sell or share your data for marketing.

Analytics (Google Analytics 4)

This Site uses Google Analytics 4 (GA4) to understand how visitors use the site. GA4 collects data including pages visited, time on site, approximate geographic location, device type, and referral source. This data is anonymised and aggregated — we cannot use it to identify you personally. GA4 uses cookies (see Section 7).

Website Hosting & CDN (Hostinger / Cloudflare)

Our hosting provider (Hostinger) and CDN (Cloudflare) automatically process your IP address and basic request data as part of delivering the website. This is standard for all web hosting and is necessary for the technical operation of the Site.

Legal Basis for Processing

How We Use Your Data

We use personal data only for the purposes for which it was collected:

• To respond to enquiries and evaluate the suitability of potential engagements.
• To manage and fulfil session bookings.
• To manage course waitlist registrations and fulfil course enrolments.
• To run the course portal: sign you in, show you the modules released so far, and save your progress, answers and scores so you can pick up where you stopped.
• To put your name on your course slides and your certificate, and to let people you show the certificate to check that we issued it.
• To read the exercise answers you submit and, where you have allowed it, your reflection notes.
• To email you the follow-up and feedback requests you opted into, and nothing you did not.
• To post you something when you complete the course, if you gave us an address.
• To keep learner accounts and the portal secure.
• To send the Pharma Radar newsletter to subscribers who have opted in.
• To understand how the Site is used and improve its content and performance.
• To comply with our legal and regulatory obligations.

We do not use personal data for automated decision-making or profiling. We do not sell personal data to third parties. We do not use personal data for targeted advertising.

Retention Periods

Where data is held by third-party processors (Beehiiv, TidyCal, Stripe, Make.com, Google, Bunny.net, SMTP2GO), their own retention policies also apply. Links to relevant third-party privacy policies are provided in Section 6.

Data Sharing & Third-Party Processors

We share personal data only with the third-party service providers necessary to deliver our services. All processors are bound by appropriate data processing agreements and/or operate under their own compliant privacy frameworks.

Where your data is held. The course portal and its database run on a Hostinger server in the United Kingdom, with backups held in Germany. Bunny.net is an EU company. Its network serves each video from the point nearest to you, which may be outside the UK or the EU. The video content itself is not personal data. The request data Bunny processes to deliver it is covered by Bunny’s data processing agreement, which includes the standard contractual clauses for international transfers.

We do not share personal data with any other third parties, except where required to do so by law or legal process.

Cookies

This Site uses cookies — small text files stored on your device — to ensure the site functions correctly and to collect analytics data. Under UK PECR, we are required to obtain your consent before setting non-essential cookies.

You can withdraw your consent to analytics cookies at any time by adjusting your preferences via our cookie banner, or by using your browser’s cookie management settings. You can also opt out of Google Analytics across all websites using Google’s opt-out browser add-on.

Your Rights Under UK GDPR

As a UK data subject, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month. We will not charge a fee for standard requests.

Course portal learners. You can change or remove your profile details and your consent settings yourself on the Account page. The same page has a “Delete all my data” button. It asks you to confirm, sends you one email, and starts a seven-day window in which you can change your mind by replying to that email. After seven days we delete your account, your profile and photo, your learning record, your submissions and notes, your self-assessment scores and your address. Deleting your account ends your access to the course. Payment and invoice records are kept for six years under UK financial rules, as set out in section 05, and your certificate record is kept so the certificate can still be verified unless you ask us to delete that too. To receive a copy of your portal data, email us and we will send it to you in a readable, machine-readable format within one calendar month.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we have the opportunity to address your concern.

If you remain unsatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:

Contact

For any questions about this Privacy Policy or to exercise your data rights:

This Privacy Policy was last reviewed in September 2026, when the HEOR Fundamentals course portal opened. We will update it when our processing activities change, or when required by law.