Legal
Data Sourcing Statement
Where the data inside Corryk comes from, what personal data it contains, why we are permitted to process it, and how an individual can object.
This document sets out how Corryk processes personal data within the Terminal dataset, as distinct from personal data about visitors, prospects and users, which is addressed in the Privacy Policy. Corryk compiles information about healthcare businesses across Europe from public registers and official statistics. Some of that information relates to identifiable individuals. This statement sets out what is held, from where, on what basis, and what is not done.
Contents
1. What Corryk holds
Corryk maintains a structured record of private healthcare providers across European markets — dental and medical practices, clinics, diagnostic laboratories, care homes, pharmacies, opticians and similar businesses. For each we may hold the registered entity and its identifiers, trading names, addresses and site locations, sector classification, capacity indicators such as registered beds or sites, published regulatory inspection outcomes, corporate group structure where it is publicly recorded, and financial figures.
Our customers are professional investors and corporate acquirers. They use Corryk to understand market structure and to identify businesses that may be open to investment or acquisition.
2. What counts as personal data in our dataset
Most of what we hold is information about companies, which is not personal data. Three categories are or may be personal data, and we treat them as such:
- Company officers and shareholders. Names, roles, appointment dates and — where a register publishes it — a partial date of birth or a service address, taken from national company registers.
- Sole practitioners and unincorporated businesses. Where a business is a named individual — a single-handed dental or veterinary practice, for instance — information about that business is also information about that person.
- Modelled owner-age bands. Where we indicate that a business owner may be approaching retirement, that is a statistical estimate, not a record.
3. Where it comes from
All personal data in the dataset comes from sources that are lawfully and publicly available. Personal data is not purchased from data brokers, and personal social media profiles are not scraped.
| Category | Examples |
|---|---|
| National company registers | Companies House, INPI, SIRENE, KBO, CVR, Handelsregister; equivalents in each market |
| Health and care regulators | CQC, FINESS, RPPS; equivalent provider registers in each market |
| Official statistics | National statistical institutes; Eurostat |
| Open government data | Datasets under the Open Government Licence and equivalents |
| Public company disclosures | Annual reports, filings and announcements of listed and filing companies |
Source licences are respected (e.g. CQC data under the Open Government Licence). Sources whose licence prohibits commercial use are not used, including as training or reference data.
4. Our lawful basis, and the balancing test
We process this personal data on the basis of legitimate interests (UK and EU GDPR Article 6(1)(f)). We have carried out and documented a legitimate interests assessment. In summary:
- Purpose. To provide professional investors and acquirers with an accurate view of healthcare market structure and ownership. Corporate transactions are a normal and lawful part of economic activity, and reliable information about who owns and operates healthcare businesses supports better-informed transactions.
- Necessity. The identity of a business's owners and officers is intrinsic to the question being asked. It cannot be answered with anonymised data, because the question is precisely who controls the business. We limit ourselves to what is necessary and do not collect additional personal detail because it happens to be available.
- Balance. The data concerns individuals acting in a business capacity, not a private one. It comes from registers those individuals are legally required to file with, and which exist specifically so that the public can see who stands behind a company. Access to the Corryk dataset is limited to vetted professional subscribers, not the general public. No special category data is held. On that basis Corryk's interests are not overridden by the interests or fundamental rights of the individuals concerned. Where an individual objects in a particular case, section 6 applies.
5. Article 14 and why you were not contacted individually
Where personal data is obtained from someone other than the individual, Article 14 normally requires the controller to inform that individual. Article 14(5)(b) disapplies that duty where it would involve disproportionate effort, and requires the controller instead to make the information publicly available.
Our dataset is derived from public registers and covers a very large number of records across many countries. Contacting each person individually would require us to obtain personal contact details we do not hold and have no other reason to hold — that is, we would have to collect more personal data in order to give notice about less. We consider that disproportionate, and contrary to the data minimisation principle.
This page is the measure we rely on instead. It is public, indexed, permanently available, and linked from every page of our website. It names our sources, states what we hold, and explains how to object.
6. Your rights, including objection and suppression
If your details appear in our dataset, you have the right to:
- Know what we hold. Ask us and we will tell you, and provide a copy.
- Have it corrected. If something is wrong, we will fix it. Please tell us the correct position — and note that where the error originates in a public register, correcting it at source will usually be more effective, since we refresh from that source.
- Object. Because Corryk relies on legitimate interests, you may object at any time on grounds relating to your particular situation. Processing will then stop unless Corryk can demonstrate compelling legitimate grounds that override your interests.
- Have it erased in the circumstances set out in Article 17.
- Restrict processing while a dispute about accuracy or objection is resolved.
Write to privacy@corryk.com. We acknowledge within five working days and respond within one month. There is no charge.
7. Accuracy, and how estimates are labelled
A significant proportion of the figures in Corryk are modelled rather than reported — most obviously revenue, because small companies in many jurisdictions are not required to file a profit and loss account. The Terminal labels each figure and its provenance as follows:
- Every figure is marked as filed or modelled.
- Modelled figures carry a calibrated confidence indicator derived from validation against companies that do file.
- Where a data point cannot be detected in a particular market, the Terminal records the absence explicitly rather than returning an empty value.
8. What we do not do
- We hold no patient data and no health data about any individual. Our subject is healthcare businesses, not the people treated by them.
- We hold no special category data as defined in Article 9, and no criminal offence data.
- We do not scrape personal social media profiles, and we do not buy personal data from data brokers.
- We do not sell personal data.
- We do not carry out automated decision-making producing legal or similarly significant effects on individuals.
- We do not use sources whose licence prohibits commercial use — including indirectly, as reference or training data.
Contact
Endenex Limited (trading as Corryk), company number 17061688, registered office 6th Floor, 37 Lombard Street, London EC3V 9BQ. Data protection contact: privacy@corryk.com.