ECHOES Privacy Policy

PRIVACY POLICY

Last updated: 26 July 2026

This Privacy Policy explains how ECHOES Clinical Placements ApS, trading as ECHOES ("ECHOES", "we", "us", "our"), collects, uses, stores, and shares personal data when you visit the ECHOES website, contact the programme, apply for a placement, or otherwise interact with ECHOES. This policy is intended to provide clear information to visitors, applicants, students, university contacts, collaboration partners, and other individuals who engage with ECHOES, in line with transparency requirements under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

Controller: ECHOES Clinical Placements ApS
Trading name: ECHOES
Registered address: Njalsgade 21F, 2nd floor, 2300 Copenhagen S, Denmark
CVR number: 46633385
Email (privacy): info@echoesclinicalplacements.com
Telephone: +45 24 21 26 20

If ECHOES appoints a Data Protection Officer or EU/UK representative in the future, this Privacy Policy will be updated to include their contact details, as required by GDPR.

What we collect

This Privacy Policy applies to the processing of personal data relating to website visitors; prospective students and applicants; students who are accepted into or participating in the programme; university staff, referees, and institutional partners; and hospital, clinic, laboratory, and community partners who contact ECHOES through the website.

The personal data we collect depends on how you interact with ECHOES.

A. Website and contact data — name, email address, phone number (if provided), university or organisation name, and the content of any message you submit through our contact or enquiry forms.

B. Application and programme data — your name and contact details; university, course, year of study, and professional background; placement preferences and dates of interest; CV, motivation statement, reference details, and supporting documents; emergency contact details; passport information, visa, and travel details, if required for programme administration; and insurance information, if needed to confirm programme participation requirements.

C. Sensitive or special category data — where necessary, ECHOES may collect limited special category data such as health-related information, disability information, dietary information connected to health or religion, or accessibility needs, for example to assess fitness for placement support, accommodation or accessibility needs, safeguarding, or emergency planning. Under GDPR, special category data (including health data) requires additional protection and normally requires a condition under Article 9 such as explicit consent. If ECHOES collects any health-related or other special category data from students, we will normally rely on explicit consent for clearly specified purposes, together with an explanation of why the data is needed, how it will be used, and who will receive it.

D. Technical and usage data — IP address, browser type and device information, basic usage or analytics data, cookie identifiers and similar technology identifiers, where used (see the "Cookies and similar technologies" section below).

We collect personal data when you visit the website; complete a contact, enquiry, expression-of-interest, or application form; email ECHOES directly; join a call or meeting arranged through the programme; submit documents for review; are nominated or referred by a university or partner institution; or interact with cookies or analytics tools, where enabled.

Some data is necessary for us to assess an application, respond to an enquiry, or administer a placement and related arrangements. If you choose not to provide it, we may not be able to consider your application, respond fully, or complete programme arrangements. We indicate on our forms which fields are required and which are optional.

How we use it

Under GDPR, we must explain why we process personal data and the legal basis we rely on for each type of processing.

Enquiries and requests

Responding to enquiries and requests (e.g. name, email, message content) — legal basis: Article 6(1)(f) legitimate interests in operating and responding to programme enquiries, or Article 6(1)(b) where the request is a pre-contractual step at the applicant's request.

Applications

Assessing applications and deciding whether to offer a placement (e.g. application form data, CV, references, academic details) — legal basis: Article 6(1)(b) pre-contractual steps at the applicant's request; and, where relevant, Article 6(1)(f) legitimate interests in running a selective programme.

Accepted students

Managing accepted students before, during, and after placement (e.g. contact details, programme records, logistics, university coordination) — legal basis: Article 6(1)(b) performance of a contract or pre-contractual measures, and Article 6(1)(f) legitimate interests in programme administration.

Universities and partners

Communicating with universities and partners (e.g. names, roles, email addresses, institutional information) — legal basis: Article 6(1)(f) legitimate interests in managing academic and operational partnerships.

Safety, health, and accessibility

Safeguarding, emergency support, accessibility, and health-related arrangements (e.g. emergency contacts, accessibility information, relevant health/disability information) — legal basis: Article 6(1)(f) legitimate interests in protecting students and ensuring safe placements, and, for special category data, Article 9(2)(a) explicit consent unless another Article 9 condition clearly applies.

Legal obligations and disputes

Legal compliance, record-keeping, and dispute handling (e.g. identification, communications, records, invoices) — legal basis: Article 6(1)(c) compliance with legal obligations, and/or Article 6(1)(f) legitimate interests in establishing, exercising, or defending legal claims.

Website and analytics

Improving website performance and understanding usage (e.g. cookies, IP address, analytics events) — legal basis: Article 6(1)(a) consent for non-essential cookies and similar tracking where required by law.

Newsletters and updates

Sending newsletters or marketing updates (e.g. email address, communication preferences) — legal basis: Article 6(1)(a) consent, unless a lawful "soft opt-in" rule applies under local law.

Where we rely on legitimate interests, we do so only after balancing those interests against your rights and freedoms, as required by GDPR. ECHOES does not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. If this changes in the future, we will update this Privacy Policy and provide the additional information required by GDPR.

Health and other sensitive information

ECHOES seeks to avoid collecting more health or other special category data than is genuinely necessary. When such data is required (for example, to arrange accessibility support or respond to emergencies), we will keep it limited, protect it carefully, and, where appropriate, ask for explicit consent for those specific purposes. We will explain what information is being requested, why it is needed, who will have access to it, and how long it will be kept. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Who we share it with

We share personal data only where necessary, appropriate, and consistent with applicable data protection law. Depending on the context, this may include internal ECHOES team members involved in programme administration; selected university contacts, where you ask us to communicate with your home institution or where this is necessary for placement administration; local host institutions, mentors, hospitals, clinics, laboratories, or community partners, but only to the extent needed to arrange or run the placement; IT, email, hosting, form, scheduling, analytics, storage, and document-processing providers acting as data processors on our behalf; professional advisers such as lawyers, accountants, insurers, or auditors, where reasonably necessary; and public authorities, regulators, courts, or law enforcement, where we are legally required to do so.

When data leaves the EU/EEA

Because ECHOES may work with students from the EU and the United States and may use technology providers or communicate with universities outside the EU/EEA, personal data may be transferred internationally, including to countries that do not provide the same level of data protection as the EU/EEA. Where personal data is transferred outside the EU/EEA, we will rely on one or more of the following mechanisms recognised by GDPR: an adequacy decision by the European Commission recognising that the destination country ensures an adequate level of protection; the EU-U.S. Data Privacy Framework, where the recipient in the United States is properly certified and the transfer falls within the scope of that framework; or the European Commission's Standard Contractual Clauses (SCCs), together with supplementary safeguards where appropriate.

Further information on adequacy decisions and transfer tools is available from the European Commission.

How long we keep it

We keep personal data only for as long as necessary for the purposes for which it was collected or to comply with legal, accounting, or reporting obligations. Actual retention periods may vary depending on legal requirements in Denmark and other relevant jurisdictions. Indicative retention periods are:

General enquiries: up to 12 months after the last meaningful contact.
Unsuccessful applications: up to 12-24 months after a decision, unless a longer period is necessary to handle potential disputes or you agree to be considered for future cohorts.
Accepted student records: for the duration of the placement and up to 6 years afterwards for legal, insurance, safeguarding, tax, or audit purposes.
Financial records: for the period required by applicable accounting and tax law.
Consent records and cookie preferences: for as long as necessary to demonstrate compliance or until consent is refreshed.

We may retain anonymised or aggregated information that does not identify individuals for longer periods.

Cookies and similar technologies

Our website uses cookies and similar technologies to provide core functionality and, where enabled, to help us understand how the site is used. Under EU rules, non-essential cookies (such as many analytics or advertising cookies) require your prior consent.

ECHOES uses essential cookies to keep this website secure and functioning. Where non-essential analytics or similar tools are used, we ask for your consent before placing those cookies. We do not place non-essential cookies on your device before you have given consent, we do not make access to the website conditional on accepting non-essential cookies, and we do not treat scrolling or continued browsing as valid consent.

You can change or withdraw your cookie choices at any time via "Cookie Settings" in the footer. For a full list of the cookies we use, see our Cookie Policy.

How we protect it

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures may include access controls, role-based permissions, secure email and storage providers, encryption in transit, and limiting access to those who need the information for programme administration. No internet-based service can guarantee absolute security, but ECHOES takes reasonable steps to protect the data it holds and to select service providers that offer appropriate safeguards.

Your rights

If GDPR applies to you, you may have the following rights in relation to your personal data.

Right of access to your personal data and to receive a copy.
Right to request correction of inaccurate or incomplete data.
Right to request deletion of your data in certain circumstances.
Right to request restriction of processing in certain circumstances.
Right to object to processing based on our legitimate interests.
Right to data portability, where applicable, to receive your data in a structured, commonly used, and machine-readable format and have it transmitted to another controller.
Right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Right to lodge a complaint with a supervisory authority.

To exercise these rights, please get in touch with us at: info@echoesclinicalplacements.com

If you are in the EU/EEA, you can also complain to your local data protection authority. As ECHOES is established in Denmark, the lead supervisory authority will generally be the Danish Data Protection Agency (Datatilsynet), whose contact information is available on its website.

The programme is intended for adult students and university-level participants. ECHOES does not knowingly market placements to children or intentionally collect personal data directly from minors through the website.

Applicants in the United States

For applicants from the United States, this Privacy Policy also explains what information ECHOES collects, how it is used, who receives it, and how to contact us with privacy questions. US privacy expectations typically focus on transparency around collection, use, sharing, and security of personal information. ECHOES is not currently offering services that are automatically subject to every state-specific US privacy regime. However, if the programme expands materially in the US, this Privacy Policy will be reviewed and, if necessary, updated to reflect additional state-level rules.

Contact

If you have questions about this Privacy Policy, our processing of your personal data, or if you wish to exercise your privacy rights, you can contact us at:

ECHOES Clinical Placements ApS (trading as ECHOES)
Email: info@echoesclinicalplacements.com
Address: Njalsgade 21F, 2nd floor, 2300 Copenhagen S, Denmark

We may update this Privacy Policy from time to time to reflect legal, operational, or technical changes. When we do so, we will post the updated version on this page and revise the "Last updated" date at the top.