1. Who we are
This Privacy Policy explains how i-HTScience V.o.G. processes personal data when you visit or use the evidence.academy, including the website available at https://evidence.academy, related course pages, user-account functions, learning services, contact forms and communications.
Data controller
i-HTScience V.o.G.
Scientific Institute of EuroScan / international HealthTechScan (EuroScan/i-HTS)
Hütte 79
B-4700 Eupen
Belgium
BCE / KBO No. 0798.299.013
Email: office(at)i-hts.science
Unless stated otherwise in a specific notice, i-HTScience V.o.G. is the controller responsible for the processing of personal data described in this Privacy Policy.
The evidence.academy is hosted and managed by i-HTScience V.o.G. It provides structured online education, learning resources, workshops and institutional training related to evidence-informed decision support across the Life Cycle of Health Technologies.
2. Scope of this policy
This Privacy Policy applies to personal data processed through:
- The evidence.academy website.
- User registration, login and account management.
- Online courses, course enrolment, learning progress and certificates.
- Contact, workshop and institutional-training enquiries.
- Purchases, subscriptions, licences or course registrations, where applicable.
- Email communications and support requests.
- Cookies and similar technologies used on the website.
- Any connected services that are identified in this Policy or in the Cookie Policy.
This Privacy Policy does not apply to third-party websites, platforms or services that may be linked from the evidence.academy. Their privacy practices are governed by their own privacy notices.
3. Categories of personal data
Depending on how you use the evidence.academy, we may process the following categories of personal data.
| Category | Examples |
|---|---|
| Identity and contact data | Name, title, professional role, organisation, country, email address, postal address and telephone number, where provided |
| Account data | Username, password in encrypted form, account preferences, account status and login information |
| Learning and course data | Courses viewed or enrolled in, lesson completion, quiz attempts and results, learning progress, time spent in learning activities, certificates issued and learning-pathway status |
| Professional data | Organisation, institutional affiliation, role, area of expertise, professional interests and training requirements, where provided |
| Transaction data | Course, licence or workshop selected; invoice-related information; payment status; billing address; VAT number or purchase-order details, where applicable |
| Communications | Messages submitted through contact forms, email correspondence, support enquiries, feedback and survey responses |
| Technical and usage data | IP address, device and browser type, operating system, pages accessed, referring URLs, approximate location derived from IP address, timestamps, log files and security-related information |
| Cookie and consent data | Cookie preferences, consent status, identifiers generated through cookies and similar technologies |
| Data from third-party sign-in services | Limited profile and authentication data received from a third-party provider when you choose to register or log in through that provider, where this function is enabled |
Please do not submit special categories of personal data — such as health information, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, biometric data or information about criminal convictions — unless we specifically request it and provide a clear legal basis for doing so.
4. Why we process personal data
We process personal data only where we have a valid legal basis under the General Data Protection Regulation (“GDPR”).
| Purpose | Personal data used | Legal basis |
|---|---|---|
| To operate the website and maintain its security | Technical, usage and log data | Legitimate interests in operating a secure, reliable and functional website; Article 6(1)(f) GDPR |
| To create and manage user accounts | Identity, contact and account data | Performance of a contract or steps requested before entering into a contract; Article 6(1)(b) GDPR |
| To deliver online courses and record learning progress | Account, learning and course data | Performance of a contract; Article 6(1)(b) GDPR |
| To issue certificates or completion records | Identity, course and learning-progress data | Performance of a contract; Article 6(1)(b) GDPR |
| To respond to enquiries and provide support | Identity, contact and communication data | Legitimate interests in responding to enquiries; Article 6(1)(f) GDPR; or steps prior to entering into a contract under Article 6(1)(b) GDPR |
| To process purchases, licences, bookings or invoices | Identity, contact and transaction data | Performance of a contract; legal obligations relating to accounting and taxation; Articles 6(1)(b) and 6(1)(c) GDPR |
| To administer institutional learning programmes | Account, learning, professional and transaction data | Performance of a contract with an organisation or legitimate interests in delivering and administering training; Articles 6(1)(b) and 6(1)(f) GDPR |
| To improve courses, website usability and service quality | Aggregated or pseudonymised usage, learning and feedback data | Legitimate interests in improving our educational services; Article 6(1)(f) GDPR |
| To send newsletters or marketing communications | Name, email address, preferences and consent records | Consent; Article 6(1)(a) GDPR; or, where legally permitted, legitimate interests |
| To use non-essential cookies, analytics or similar technologies | Cookie, device and usage data | Consent; Article 6(1)(a) GDPR |
| To comply with legal obligations and protect rights | Relevant identity, account, technical and transaction data | Legal obligation; Article 6(1)(c) GDPR; and legitimate interests in preventing fraud, misuse and legal claims; Article 6(1)(f) GDPR |
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
5. Account registration and learning records
When you create an evidence.academy account, we process the information needed to provide access to the learning environment. This may include your name, email address, username, organisation, professional role, account credentials and enrolment information.
When you participate in a course, we may record information necessary to provide the learning service, including course enrolment, lesson completion, quiz attempts, quiz results, progress status, certificates and dates of completion.
This information allows us to:
- Provide access to purchased, assigned or enrolled courses.
- Save and display your learning progress.
- Issue certificates of completion where applicable.
- Provide technical support.
- Administer institutional, cohort or licence-based training programmes.
- Maintain the integrity and security of the learning environment.
If your access is provided through an employer, public organisation, university or other institutional customer, that organisation may receive limited learning-administration information where this is necessary to manage the relevant programme. The exact scope will depend on the contractual arrangement and should be communicated by the relevant organisation.
6. Contact forms and enquiries
If you contact us through a form, by email or through another communication channel, we process the information you provide in order to respond to your request, assess your training needs, arrange a meeting, prepare a proposal or provide support.
We ask that you provide only information necessary for your enquiry. Please do not send sensitive personal data unless it is necessary and we have specifically requested it.
7. Payments, purchases and invoices
Where the evidence.academy offers paid courses, licences, workshops or other services, we process data required to conclude and perform the relevant agreement, including billing details, selected products or services, purchase history, invoices and payment status.
Payments are processed through PayPal, WooCommerce Payments or bank transfer. We do not normally receive or store full payment-card numbers. Payment providers process payment data under their own privacy notices and contractual terms.
We may retain invoice and payment records where required by Belgian tax, accounting or other applicable legal obligations.
8. SCORM courses and learning technologies
The evidence.academy may provide SCORM-based learning content through WordPress, MasterStudy LMS or a connected learning-management environment.
Where SCORM content is used, learning interactions may be recorded in order to provide the course, including completion status, scores, interactions, time spent, bookmarking/progress data and other data generated by the SCORM package.
The exact categories of learning data can vary depending on the individual SCORM course. Course pages or course-specific notices may provide additional information where a course uses a third-party authoring tool, external learning-content provider or connected learning platform.
9. Cookies and similar technologies
The evidence.academy uses cookies and similar technologies to operate the website, remember settings, secure user accounts, maintain login sessions and, where enabled, understand use of the website or improve services.
Cookies may be:
- Strictly necessary cookies, required for essential functions such as login, security, account sessions, shopping-cart functions or consent-preference storage.
- Functional cookies, used to remember choices or preferences.
- Analytics cookies, used to understand website and course usage.
- Marketing cookies, used only if marketing or advertising technologies are enabled.
Non-essential cookies, including analytics or marketing cookies, are used only where required consent has been obtained.
Please consult our Cookie Policy for a current overview of cookies, providers, purposes, retention periods and available consent choices.
10. Google login and third-party authentication
If you choose to register or sign in using Google or another third-party authentication provider, we may receive limited information from that provider, such as your name, email address, profile identifier and authentication token or confirmation.
We use this information solely to authenticate your account, link it to your evidence.academy profile and provide access to the learning platform.
The third-party provider processes your personal data under its own privacy policy. You can manage the permissions you grant through the relevant provider’s account settings.
11. Who receives personal data
We may share personal data with the following categories of recipients, only where necessary and subject to appropriate safeguards:
- i-HTScience V.o.G. personnel and authorised contributors who require access to perform their responsibilities.
- EuroScan / i-HTS members or contributing experts, where they are involved in the delivery, administration, review or improvement of a specific course or programme and access is necessary.
- Website-hosting, cloud-infrastructure, email, security, backup and technical-support providers.
- WordPress, MasterStudy LMS and relevant plugin or integration providers, where their services are used to operate the learning environment.
- Payment providers, invoicing providers, accounting advisers and banks, where applicable.
- Newsletter, customer-relationship-management, analytics or consent-management providers, where enabled.
- Institutional customers, only where a training programme is purchased, administered or assigned by that organisation and the sharing is necessary for programme administration.
- Public authorities, professional advisers, courts, regulators or other recipients where required by law or necessary to establish, exercise or defend legal claims.
- A successor organisation, where relevant, in the event of a restructuring, merger, transfer of activities or similar transaction, subject to applicable law.
We do not sell personal data.
12. International transfers
Some service providers may process personal data outside the European Economic Area (“EEA”). Where personal data are transferred to a country that is not covered by an adequacy decision of the European Commission, we use appropriate safeguards required by GDPR, such as the European Commission’s Standard Contractual Clauses and, where appropriate, supplementary technical and organisational measures.
You may contact us using the details in Section 1 if you would like further information about relevant international-transfer safeguards.
13. How long we retain data
We retain personal data only for as long as necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.
The applicable period depends on the type of data and the service involved. In general:
| Type of data | Typical retention approach |
|---|---|
| Website server and security logs | Retained for a limited period necessary for security, troubleshooting and abuse prevention, normally no longer than [insert period, e.g. 30–90 days], unless needed for an incident investigation |
| Contact enquiries | Retained until the enquiry is resolved and for up to [insert period, e.g. 24 months] afterwards where needed for follow-up or record-keeping |
| Account and learning records | Retained while the account is active and for [insert period] after closure, unless longer retention is needed for certificates, contractual records or legal claims |
| Certificates and completion records | Retained for [insert period, e.g. 6 years] or the period communicated for the relevant certification or institutional programme |
| Transaction, accounting and tax records | Retained for the period required by Belgian tax, accounting and other applicable laws |
| Newsletter data | Retained until you unsubscribe or withdraw consent, subject to limited retention of suppression-list information to respect your choice |
| Cookie-consent records | Retained for the period necessary to demonstrate consent and manage your preferences, normally [insert period] |
We may retain data for longer where necessary to resolve disputes, enforce agreements, prevent misuse or comply with legal obligations.
14. Your rights
Subject to the conditions and limitations set out in GDPR, you have the right to:
- Request access to your personal data.
- Request correction of inaccurate or incomplete personal data.
- Request deletion of your personal data in certain circumstances.
- Request restriction of processing in certain circumstances.
- Object to processing based on our legitimate interests.
- Receive personal data you provided to us in a structured, commonly used and machine-readable format, and request transmission to another controller where technically feasible.
- Withdraw consent at any time where processing is based on consent.
- Object at any time to direct marketing.
- Not be subject to a decision based solely on automated processing, including profiling, where that decision produces legal or similarly significant effects, unless a lawful exception applies.
To exercise your rights, contact us at office(at)i-HTS.science. We may ask for information necessary to verify your identity before responding to a request.
You also have the right to lodge a complaint with the Belgian Data Protection Authority:
Belgian Data Protection Authority
Rue de la Presse 35
1000 Brussels
Belgium
Telephone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Website: www.dataprotectionauthority.be
You may also contact the data-protection authority in the EEA country where you live, work or believe an infringement has occurred. The Belgian Data Protection Authority identifies rights including access, correction, objection, restriction, erasure and withdrawal of consent in its own privacy information.
15. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access controls, role-based permissions, encrypted transmission through HTTPS, secure-password practices, software updates, backups, logging, malware protection and contractual safeguards with service providers.
No internet-based service can guarantee absolute security. You should keep your account credentials confidential and notify us promptly if you believe your account has been accessed without authorisation.
16. Children
The evidence.academy is intended for professional, academic and organisational learning. It is not directed to children.
We do not knowingly collect personal data from persons under 16 years of age without appropriate authorisation. If you believe that a child has provided us with personal data without appropriate consent, please contact us so that we can take appropriate action.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, data-processing activities, legal obligations or technical environment.
The current version will always be available on evidence.academy. Where a change is material, we will take appropriate steps to notify users, for example through the website, within the learning platform or by email where appropriate.
Last updated: 17 September 2026
Google