1. Purpose

This policy defines the measures in place to control the privacy of personal data collected or processed by Sensyne Health as Controller and or as Processor on behalf of a Controller.

This Privacy Policy does not apply to any of our other services which may have its own privacy policies, or any service(s) offered by a third party, which will be subject to the privacy policy of that third party.

‍

2. Scope

This policy applies to all personal data collected or processed by Sensyne Health Group Limited.

‍

3. Reference documents

• GDPR 2016/679 General Data Protection Regulation
• DPA 2018 Data Protection Act 2018
• ISO 27001:2013 Information Security Management Systems

‍

4. Responsibility and authority

4.1 Top Management is responsible for ensuring that this policy is enforced within Sensyne Health.

4.2 The Data Protection Officer (DPO) is responsible for monitoring the suitable implementation of this policy and its effectiveness.

4.3 All employees are responsible for recognising and handling confidential information in conformity with the requirements of this policy.

‍

5. Definitions

CONTROLLER

Means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

DATA SUBJECT

Means the identified or identifiable living individual to whom personal data relates.

‘OUR’

Means Sensyne Health Group Limited- the organisation processing personal data.

PERSONAL DATA

Means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

PROCESSING

Means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

PROCESSOR

Means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

SPECIAL CATEGORY DATA

Means a personal data which the GDPR classifies as more sensitive, and so needs more protection. This includes; personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

‘US’

Means Sensyne Health Group Limited- the organisation processing personal data.

‘WE’

Mean Sensyne Health Group Limited- the organisation processing personal data.

‘YOU’

Means ‘the Data subject’- the identified or identifiable living individual to whom personal data relates.

‘YOUR’

Means ‘the Data subject’- the identified or identifiable living individual to whom personal data relates.

‘THIRD PARTY’

Means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

‘CONSENT’

‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

‘DATA CONCERNING HEALTH’

‘Data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

ANONYMISATION

According to the ICO guidelines, in order to be truly anonymised under the GDPR, you must strip personal data of sufficient elements that mean the individual can no longer be identified.

‍

6. Privacy Policy

6.1 WHO ‘WE’ ARE

We are the ‘Sensyne Health Group’ of companies (together ‘Sensyne Health’), including: Sensyne Health plc (company number 11425451), Sensyne Health Holdings Limited (company number 09427409), Sensyne Health Group Limited (company number 11240986) all of John Eccles House, Robert Robinson Avenue, Oxford Science Park, Oxford, OX4 4GP, Drayson Technologies Inc, of C/O: Cogency Global Inc., 850 New Burton Road, Suite 201, Dover, Kent, Delaware 19904 U.S.A. (‘Drayson USA’), Drayson Technologies Mexico, S.A. de C.V. of Av. Presidente Masaryk 29 Piso 10-B, Interior 106, Polanco V Sección, Miguel Hidalgo, Ciudad de México (‘Drayson Mexico’) and Drayson Technologies Mexico (Services), S.A. de C.V. of Varsovia 36, Col. Juarez, Mexico City, ZIP 06600 (‘Drayson Mexico (Services)’). ‘We’, ‘us’ and ‘our’ refers to one or more or all of the Sensyne Health Group as the context requires.

6.2 DATA WE COLLECT

Your personal data will be collected when you use one or more of Sensyne Health’s website, services or contact us through any means. You may provide such personal data to us directly and sometimes we may be given the data by a third party, for example in a ‘refer a friend’ program.

Such personal data could include your name, telephone number and email address and, depending on your query or the service you are using, we may require other information such as your age range. Using the definitions in EU law, we will be the ‘data controller’ of personal data we collect and use for our own marketing and account management purposes (‘Account Data’) and the ‘data processor’ of personal data collected through your use of a Website or services, such as data about your device model, operating system or browser, IP address and, if you have enabled tracking for a particular Service, data about your location (‘Service Data’).

When you provide us with personal data about yourself or another person, you are confirming to us that you are authorised to provide us with that information and that any personal data you give us is accurate and up to date.

6.3 LOCATION DATA

Some Websites and Services ask for or need your location to deliver certain benefits or for certain functionality. This will be made clear before collection of location data and if you decide to allow such collection, you are consenting to our collection of location data for processing according to this Privacy Policy.

6.4 SPECIAL CATEGORY DATA

‘Special Category data’ is defined under EU and UK law as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

We only collect Special Category Data where we are the ‘processors’ and have a legal basis and permission to do so by the ‘Controller’ of that data or where we have a legal basis as ‘Controller’ such as explicit consent or where processing is necessary for reasons of public interest and public health.  

Where we collect or process Special Category personal data as identified above, we only do so in accordance with applicable Data Protection Law.

6.5 USING PERSONAL DATA

We will use your personal data for the purposes stated in any data collection notice and in the normal, legitimate, course of our business, including the following required purposes:

• when you contact us, to respond to your message
• when you sign-up to a service, to confirm that you are eligible to receive that service
• to deliver the Websites and services including to contact you about your account, to ensure that the Websites and services are functioning correctly, and to monitor, investigate any bug with, and improve the Websites and services
• to improve your user experience through monitoring traffic on our websites and services.

We may also use your personal data for the following ancillary purposes:

• to inform you about any of our products or services which are similar or connected to the Website or services that you are using; and
• inform you about the Sensyne Health Group, our activities, and services.

6.6 SHARING DATA

We shall only share personal data in the limited circumstances below:

• in order to provide, maintain and otherwise deliver the Websites and Services, we may share the minimum personal data necessary within the Sensyne Health Group and with trusted service providers (who may be outside your jurisdiction, including outside the EEA) for them to deliver the Website or services, and technical, IT, logistical, marketing, promotional or administrative services and process the data for us in accordance with our instructions, and we shall ensure that the recipient has appropriate security and confidentiality measures in place to protect the personal data;
• to the extent required or authorised by law including to comply with a legal obligation such as a court order or binding decision of a legally competent authority, to protect or enforce our legal rights, or to protect the health or life of an individual;
• if we undertake a transaction, or preparations for a transaction, such as a business sale, we may share the personal data to the extent required with the other party to the transaction and only after ensuring that the recipient has appropriate security and confidentiality measures in place to protect the personal data.

Other than for the examples set out above, we shall not share your personal data with other companies or organisations without your prior consent.

6.7 TESTIMONIALS

If you make a positive, public remark about us, a website or services, for example on social media, you agree that we may use that remark as a testimonial.

6.8 NON-PERSONAL OR ANONYMISED DATA

We may process personal data to create non-personal or anonymised data. According to the ICO guidelines, in order to be truly anonymised under the GDPR, you must strip personal data of sufficient elements that mean the individual can no longer be identified.

The security of your personal data is of paramount importance to us. We shall use appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access.

6.9 COOKIES

We may use cookies and similar data collection tools when you visit a website or use a service. Such technology allows us to deliver, personalise or otherwise improve your experience of our websites and services. Accepting cookies may give us access to information, for example, about your browsing behaviour. Most browsers and devices automatically accept cookies and data collection tools by default, but you can usually refuse or selectively accept cookies and data collection tools by adjusting the preferences in your browser or in your device settings. Please see our Cookie Policy for more details.

6.10 CALIFORNIA PRIVACY NOTICE

Please note that our websites do not respond to ‘Do-Not-Track’ signals communicated by your internet browser. As above, please note you can prevent tracking, and collection of location data, through your management of cookies and for mobile services by switching the location tracking mode of your phone to ‘off’.

6.11 YOUR RIGHTS

You are entitled to know if we are processing any personal data about you and, if we are, with certain limitations, to a copy of that personal data. You can also ask us to limit the use and disclosure of your personal data, ask that we do not use your details to contact you for marketing purposes, ask us to remove or correct inaccurate personal data, or revoke your consent in relation to any processing of your personal data. We’ll ask you to prove your identity when you make such a request. We will respond to your request as soon as reasonably possible and in any event, in accordance with any local legal requirement.

We have made available  a letter (FM33) and form (FM32) which can be used for subject access requests. Requests submitted by post or email will also be accepted but use of these documents may speed up the process.

6.12 CONTACT

For any question or request under this policy, you may contact us by post or by email at dpo@sensynehealth.com marked for the attention of the Data Protection Officer.

6.13 CHANGES TO PRIVACY POLICY

This Privacy Policy may change from time to time and the statement will be updated on our website.