Thank you for taking the time to read the privacy policy of Samphire Neuroscience Ltd (1360 0022), a registered company in the United Kingdom, trading as ‘Samphire Neuroscience’ (Samphire, we, us, our).

This notice describes how we collect, store, transfer and use personal data. It tells you about your privacy rights and how the law protects you.

In the context of the law and this notice:

• ‘personal data’ is information that clearly identifies you as an individual or which could be used to identify you if combined with other information; and
• acting in any way on personal data is referred to as ‘processing’.

This notice applies to personal data collected through our website (the Website), and through our mobile application(s), social media platforms and online retail platforms (the Services).

We reserve the right to amend this policy from time to time, and we’ll make sure the latest version of the policy is always available.

Data protection officer

We have appointed a data protection officer (DPO) who is responsible for ensuring that our privacy policy is followed. If you have any questions about how we process your personal data, including any requests to exercise your legal rights, please contact our DPO, at the email address set out below.

How we obtain personal data

We collect information that assists us in providing you with the Services. Wherever possible, we try to minimise the amount of information we collect about you, or make the collection of such information optional.

The information we process about you includes information you have directly provided to us, that we gather from third party databases and service providers; and as a result of monitoring how you use our website or our services.

Direct collection from you

When you use our Website or Services we may ask you to provide personal data. This can be categorised into the following groups:

• personal identifiers (such as your name);
• contact information (such as your email address or telephone number);
• account information (such as a username or password);
• payment information (such as your credit card information);
• health information (such as your experience with cycle-related challenges, or related diagnoses);
• records of communication you may have with us (such as if you send us an email, or contact us through social media); and
• product and service preferences (such as the fact you have asked us to send you more details, or registered for updates).

In addition, we may process and store any other information you may choose to share with us.

Indirect collection from your use of our Website and Services

By using our website and our services, we may collect and process different types of information. This includes:

• your account details, such as your username or email address;
• information you contribute to our community, such as reviews or product suggestions;
• your replies to polls, quizzes and surveys that we may run, which may include health information and contact information;
• technical information about the hardware and the software you use to access our website and use our services, including your Internet Protocol (IP) address, your browser type and version and your device’s operating system;
• usage information, including the frequency at which you use our services, the pages of our website that you visit, whether you receive messages from us and whether you reply to those messages;
• transaction information that includes the details of the products services you have bought from us and payments made to us for those services; and
• your preferences to receive communications, including marketing communication, from us; how you wish to communicate with us; and responses and actions in relation to your use of our services.

Collection from third parties, such as your Doctor.

We confirm some of the information you provide to us directly using data from other sources. An example of this is that we may validate your credit card information with a third party payment processor.

We also add to the information we hold about you, sometimes to remove the need for you to provide it to us and sometimes in order to be able to assess the quality of the services you offer. For example, if you have spoken to your Doctor about Samphire, and have given them permission to reach out to us on your behalf, we may record information that they give us, and associate it with you.

Where and how your personal information is stored

By default, we store your personal information for so long as you are receiving Services from us, plus one year. We may store your personal information for longer if we have a specific legal requirement to do so, such as where medical device regulation requires it.

We may continue to store anonymised and aggregated data that is based on information you have previously provided to us even after you are no longer receiving Services from us. If this occurs, we will ensure that nothing that can identify you as an individual will be stored.

By default, your personal information is stored within either the United Kingdom or the European Union. Sometimes, for technical reasons, our subcontractors may need to move information to other countries. If this occurs, we make sure that appropriate data protection measures are adopted.We use a range of subcontractors to help us provide the Services and our Website. These include: Google, Webflow, Tally, and Amazon Web Services. When subcontractors help us provide this website and our services, we make sure that appropriate data protection measures are adopted, including ensuring that data is encrypted in transit and at rest.

Our use of aggregated and anonymous information

We may use data which is fully de-identified and aggregated through statistical or demographic for a wide range of purposes. These include assessing whether our Services’ features are useful.

If we combine or connect aggregated information with your personal data so that it can identify you in any way, we treat the combined information as personal data, and it will be used in accordance with this privacy notice.

Special personal data

Special personal data is data about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We may collect special personal data about you if there is a lawful basis on which to do so.

If you do not provide personal data we need

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform that contract. In that case, we may have to stop providing a service to you. If so, we will notify you of this at the time.

The bases on which we process information about you

The law requires us to determine the bases on which we process different categories of your personal data, and to notify you of the basis for each category. If a basis on which we process your personal data is no longer relevant then we shall immediately stop processing your data. If the basis changes then if required by law we shall notify you of the change and of any new basis under which we have determined that we can continue to process your information.

Information we process because we have a contractual obligation with you

When you create an account on our website, buy a product or service from us, or otherwise agree to our terms and conditions, a contract is formed between you and us. In order to carry out our obligations under that contract we must process the information you give us. Some of this information may be personal data. We may use it in order to: (1) verify your identity for security purposes when you use our services; (2) sell products to you; (3) provide you with our services; or (4) provide you with suggestions and advice on products, services and how to obtain the most from using our website.

We process this information on the basis there is a contract between us, or that you have requested we use the information before we enter into a legal contract. We shall continue to process this information until the contract between us ends or is terminated by either party under the terms of the contract.

Information we process with your consent‍

Through certain actions when otherwise there is no contractual relationship between us, such as when you browse our website or ask us to provide you more information about our business, including our products and services, you provide your consent to us to process information that may be personal data.

Wherever possible, we aim to obtain your explicit consent to process this information, for example, we ask you to agree to our use of non-essential cookies when you access our website.If you have given us explicit permission to do so, we may from time to time pass your name and contact information to selected associates whom we consider may provide services or products you would find useful.

We continue to process your information on this basis until you withdraw your consent or it can be reasonably assumed that your consent no longer exists. You may withdraw your consent at any time by getting in contact with us in writing via our website. However, if you do so, you may not be able to use our website or our services further.

We aim to obtain and keep your consent to process your information. However, while we take your consent into account in decisions about whether or not to process your personal data, the withdrawal of your consent does not necessarily prevent us from continuing to process it. The law may allow us to continue to process your personal data, provided that there is another basis on which we may do so. For example, we may have a legal obligation to do so.

Information we process for the purpose of legitimate interests

We may process information on the basis there is a legitimate interest, either to you or to us, of doing so. Where we process your information on this basis, we do so after having given careful consideration to: (1) whether the same objective could be achieved through other means; (2) whether processing (or not processing) might cause you harm; and (3) whether you would expect us to process your data, and whether you would, in the round, consider it reasonable to do so.

For example, we may process your data on this basis for the purposes of: (1) improving our services; (2) record-keeping for the proper and necessary administration of our business; (3) responding to unsolicited communication from you to which we believe you would expect a response; (4) preventing fraudulent use of our services; (5) exercising our legal rights, including to detect and prevent fraud and to protect our intellectual property; (6) insuring against or obtaining professional advice that is required to manage business risks; or (7) protecting your interests where we believe we have a duty to do so.

Information we process because we have a legal obligation

Sometimes, we must process your information in order to comply with a statutory obligation. For example, we may be required to give information to legal authorities if they so request or if they have the proper authorisation such as a search warrant or court order. This may include your personal data.

Cookies

Cookies are small text files stored on your computer that are used to identify specific computers so that we can collect aggregate information about how our users experience our Services. However, cookies do not contain personal information about specific individuals. We, like almost all other websites, use such information to help improve our Website, or to offer particular features. We may serve you advertisements based on your prior visits to our Website, or prior engagement with our other Services. We may do this through third parties. We may also use analytics data to optimise the provision of these advertisements.

Your rights

You have many rights in respect of your personal information, including (but not limited to):

1. The right to information and rectification: you can request from us a copy of the personal information we hold about you, and for us to correct any information you consider to be incorrect.
2. The right to be forgotten: you can request that we delete your personal information, noting that we will not be able to delete information that we are required to keep under law.
3. The right to withdraw consent: you can withdraw your consent to share your information or to receive Services, including marketing related emails, at any time; and
4. The right to complain: You can file a complaint with the relevant data protection authorities if you believe that we are treating your personal data in violation of applicable law.

You can exercise these rights - and any other rights you may have - by contacting us as set out below.

Contact

If you have any questions, please contact us at hello@samphireneuro.com. Alternatively, you may write to us at 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom.

‍