Privacy Policy

Last updated 27 February 2025

Who we are

As Data Controller, we have appointed a Data Protection Officer (DPO) who has ultimate responsibility for this privacy notice and Albus’ Data Protection Policy. If you have any questions about this privacy notice or a request to exercise legal rights, please contact the DPO at privacy@albushealth.com.

If you have a complaint about our use of your personal information, please contact the DPO in the first instance, and we will attempt to resolve it. You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data.

Data we collect about you

‘Personal information’ is any information that can be used to identify a living person. We may collect and process the following:

• Personal identifiers (first name, last name, username or other identifier, title, age or date of birth, gender, job title or occupation, preferred language)
• Contact information (email address, telephone numbers and business address)
• Technical information (IP address, login data, operating system and browser identifiers and versions, time zone and location, browser plug-in identifiers and versions, and other technologies installed on the devices you use to access our websites)
• Usage data (information about how you use our websites, products, and services)
• Marketing data (your preferences on receiving product and marketing information from us, and the communications methods).

Personal health information

We do not routinely collect health data, Protected Health Information (PHI), or any Special Category personal data (as defined in GDPR) through general interactions via our website or our other communication channels. Where we do collect PHI or Special Category data it is as part of our contracted services to customers and falls outside the scope of this privacy notice.

How we collect personal data and how it is used

Most of the personal information we process is provided to us directly by you for any reason including one of the following reasons:

• You request marketing or other information from us
• You request or enquire about our services
• You complete a survey
• You give us feedback

Your personal information may also be shared with us by our customers:

• As an employee or affiliate of our customer, including Healthcare Professionals, they may provide us with your personal data in order for us to perform our services.

We will only use your personal data where it is permitted by law.

The lawful bases we rely on for processing this information are:

• You have provided your explicit consent (which you may withdraw at any time by contacting privacy@albushealth.com)
• We have a legitimate interest, and your interests and fundamental rights do not override that interest
• We have a legal obligation
• For the fulfilment of a contract

Disclosure of personal data

We may share your personal information with third-parties where it is necessary for us to store or process your data. All third-parties must respect the security and privacy of personal data and must not use it for their own purposes.

How we store personal information

Your personal data may be held at our offices or facilities, or those of third-party providers. We have appropriate information security measures in place to prevent personal data from being accidently lost, accessed by unauthorised parties, stolen, or altered. In the event of a personal data breach, we have a process to notify you and any relevant data protection authority, where we are legally required to do so.

Where personal information is stored

Some third-party providers holding personal data may be based outside the UK/EEA. Under data protection law we can only transfer personal data to a country or organisation outside the UK/EEA where there are sufficient safeguards, along with enforceable rights and remedies for data subjects. These destinations may qualify either via an adequacy decision (by the UK or EU) or by Albus being satisfied with the level of protection and enforceable rights in place (usually by incorporating standard data protection contractual clauses into a contract).

Retention of personal information

We will only hold personal data for as long as is reasonably necessary to fulfil the purposes for which we hold it. This may include holding the data to meet legal, regulatory, financial, or other reporting requirements. For details on retention periods for specific types of personal data, please write to privacy@albushealth.com. At the end of the retention period, the personal information will be securely and irrevocably erased.

Your legal rights

Under data protection law you have certain rights, including:

• Your right of access – You have the right to ask us for copies of your personal information (usually called a Data Subject Access Request).
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

If you wish to exercise any of the above rights, contact us at privacy@albushealth.com. You are not required to pay a fee to exercise your rights, although we reserve the right to charge a reasonable administration fee if your request is clearly unfounded, repetitive, or excessive. If you make a request, we will respond to you within one month.