Legal

Privacy Policy

How NHI Mgmt Group collects, uses and protects your personal data.

Last updated: October 2026

Who We Are

NHI Mgmt Group (nhimg.org) is operated by NHIM Group Ltd, a company incorporated in England and Wales (Company No. 15755288), registered office 18 Spareleaze Hill, Loughton, Essex, IG10 1BT, UK. NHIM Group Ltd is the data controller for the personal data described in this policy.

Questions about this policy or your data: [email protected].

What We Collect

Newsletter: your email address (and your name if you give it).
Contact form: your name, email, company, the type of enquiry and your message.
Guide PDFs: PDF versions of our guides are for subscribers to our newsletter (every guide stays free to read on our website). When you ask for a PDF we collect your first name, last name, company and email address, which guide you asked for, the page and button you asked from, the wording you agreed to, when we sent the email, when you confirmed your subscription and when you downloaded the guide.
Maturity assessment: if you ask for your report, your name, work email, company, role, company size and industry, used to produce and email your report. We also keep the answers and levels of every assessment, including unfinished ones, without your name or contact details. If you ask for your report, that copy is linked to your request until the request is deleted (see How Long We Keep It); after that it is anonymous.
Unsubscribing: if you unsubscribe on our Unsubscribe page, we keep a record of the request and send a confirmation email to that address.
Forum: your username, email, profile details and anything you post.
NHI course: our course runs on Graphy, which holds your learner account (name, email, course progress and certificate). Payments are taken by Stripe; we do not see or store your full card details.
Device and usage data: IP address, browser, pages viewed and the site that referred you, collected through cookies and analytics (see Cookies below).
Activity on our own website: key steps such as asking for a guide, downloading it or moving through the assessment, recorded with a random identifier for that visit (not a cookie), a one-way hash of your IP address (we do not store the address itself), your browser type, the page and the website that referred you.
Links in our emails and guides: when you click a link to our website in an email we send you, or in one of our PDF guides, we record that the link was clicked, which email or guide it was in, and when. For emails we send in response to a request (for example a guide, report or contact enquiry), this is linked to that request so we can see which of our resources are useful.
Links to other websites: when you click a link to another website in our newsletter, our LinkedIn posts or on our website, we record which link was clicked, when, the campaign it came from, a one-way hash of your IP address and your browser type. We do not track what you do on the other website.
Course discount: if you open the personal link to your newsletter discount code, we record that it was opened and when.

Why We Use It

To send the newsletter you asked for, either on its own, when you subscribe to get a PDF guide, or by ticking the separate box when you ask for a report or contact us: consent, which you can withdraw at any time by unsubscribing. Unsubscribing does not affect PDFs you have already downloaded, and our guides stay free to read online.
To email the guide or report you ask for: steps taken at your request.
To keep a record of your guide, report or contact request in our email service (Brevo), so we know what you have asked for: legitimate interests. This record is not used to send you our newsletter, and we do not normally send emails to it. You can object at any time.
To reply to your enquiry and send the assessment report you request: steps taken at your request and our legitimate interests.
To follow up enquiries and assessments about our services: legitimate interests. You can object at any time.
To run the forum and website securely, prevent abuse and understand how the site is used: legitimate interests.
To understand which of our pages, guides, emails and links are useful, and to spot and prevent abuse: legitimate interests.
Anonymous assessment results are not personal data. We use them for research, such as reports on how organisations govern non-human identities and AI agents, and only publish figures for groups of 10 or more responses.
To meet legal and accounting obligations: legal obligation.

International Transfers

Some of these providers may process data outside the UK. Where they do, we rely on appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

How Long We Keep It

Newsletter: until you unsubscribe.
Guide, report and contact requests, and assessment answers linked to a request: 24 months, then deleted automatically (the linked answers become anonymous), unless you become a client.
Activity on our own website, including clicks on links in our emails and guides: 13 months, then deleted automatically.
Clicks on links to other websites: kept while we need them for our reporting, and reviewed regularly.
Anonymous assessment results: kept, as they cannot identify you.
Forum: while your account is active. Posts may remain after the account is closed unless you ask us to remove them.
Analytics: up to 14 months.
Course accounts and payments: as long as Graphy and Stripe need to provide the service, and payment records for as long as UK tax law requires.

Your Rights

You have the right to access, correct or delete your personal data, to restrict or object to how we use it, to data portability, and to withdraw consent at any time. To use any of these rights, email [email protected].

You can unsubscribe from our emails at any time using the link in every email or our Unsubscribe page.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to put things right first.

Cookies

Strictly necessary cookies run and protect the site, including a Cloudflare security cookie. They do not need your consent.

Analytics cookies: we use Google Analytics 4 (cookies such as _ga) only to produce aggregate statistics that help us improve this website, such as which pages are read most. We do not use Google Signals, advertising features or user-level IDs, we do not use analytics to identify you, and the data is not used for advertising. Under the UK exemption for statistical analytics, we do not ask for consent for these cookies.

You can opt out of Google Analytics at any time with Google’s free opt-out browser add-on, or by blocking or deleting cookies in your browser settings.

Browser storage: our website saves two small notes in your browser (not cookies). One remembers that you have subscribed, so we stop showing you sign-up forms; the other remembers that you closed our sign-up pop-up, so it does not appear again for 14 days. They stay in your browser and are not sent to us. Unsubscribing on our Unsubscribe page clears the first one, and you can clear both at any time in your browser settings.

Changes to This Policy

We may update this policy from time to time. The “Last updated” date at the top shows the current version.

Questions? Email us at [email protected] or use our contact form.