Privacy Policy

Last updated 8 November 2026

This Privacy Policy explains how the Oxford Brain Diagnostics Group collects, uses, stores and protects personal data when you visit our website, deal with us as a customer or prospective customer, or use the Platform. OBD is committed to handling your personal data in an open and transparent way.

Who we are and how to contact us

The Oxford Brain Diagnostics Group (“OBD Group”) is both (i) Oxford Brain Diagnostics Ltd (“OBD UK”), a company registered in England and Wales under company number 11703979, with its registered office at Oxford Centre for Innovation, Blue Boar Court, 9 Alfred Street, Oxford, OX1 4EH, United Kingdom; and (ii) Oxford Brain Diagnostics Inc. (“OBD US”), located at 418 Broadway, Suite R, Albany, NY 12207, United States. In the event your personal data is shared within the OBD Group, this is done so in accordance with Sections 6 and 7 of this Privacy Policy.

In this Privacy Policy, “OBD”, “we”, “us” and “our” refer to the entity responsible for the relevant activity, as identified below.

For privacy questions, to exercise your data protection rights, or to contact our Data Protection Officer, please email privacy@oxfordbraindiagnostics.com

Scope and Responsibility

For the personal data described in this Privacy Policy, OBD is the data controller under the UK GDPR and the Data Protection Act 2018, meaning we decide how and why it is processed. This Privacy Policy applies to:

visitors to our website;
contacts at our customers and prospective customers;
marketing recipients;
contacts at our supplier and partners; and
individuals who have a login to the Platform (Authorised Users), in relation to their account details and their use of the Platform.

This Privacy Policy does not cover patient images, clinical reports or research participant information; such activities are explained in our Clinical and Research Privacy Policy.

Information we collect

Information you give us

Account information. Your name, work email address, contact details, job title and the company you work for.
Billing information. Billing contact details and records of invoices and payments. Payments are made by bank transfer or Direct Debit, and we do not collect card details.
Anything you send us by email, via the website or through the Platform, including feedback, support requests and correspondence.

Information we collect automatically

Usage data. Information about how you use our website and the Platform, including IP address, browser type, operating system, pages visited and features used.
We use cookies and similar technologies on our website and the Platform. See section 5.

Information from other sources

Your company. The company that gives you access to the Platform provides your name and work email so we can set up your login.
If your company connects another service to the Platform, we may receive data from it, such as authentication details.
Public sources. We may use public sources to confirm details about the company you work for.

Under section 4 of our Website Terms of Use, you must not send us patient images, medical records or other health information about any individual through our website or general enquiry channels. If we receive such information through those channels, we will delete it as soon as practicable, let the sender know where possible, and not use it for any other purpose. Patient data shared with us under an agreement with a healthcare provider, research partner or customer is covered by our Clinical and Research Privacy Policy.

Why we use information and our lawful bases

Purpose	Legal basis
Enquiry and correspondence information to answer questions, arrange discussions and provide support	Legitimate interests
Managing customer, supplier and partner relationships, administer contracts and deliver services.	Legitimate interests, necessary for performing our contract with your company
Setting up and managing your login, and providing the Platform to your company	Legitimate interests, necessary for performing our contract with your company
Invoicing and collecting payment	Legitimate interests, and legal obligation for tax and accounting records
Providing support and responding to enquiries	Legitimate interests, necessary for performing our contract with your company
Telling you about changes to the Platform, our terms and conditions or this Privacy Policy	Legitimate interests
Keeping the Platform secure and preventing fraud or misuse	Legitimate interests, legal obligation and necessary for performing our contract with your company
Understanding technical and security information to operate and protect our systems, detect misuse and maintain reliable services	Legitimate interests, necessary for performing our contract with your company
Understanding how the Platform is used so we can improve it, using aggregated and anonymised statistics where possible	Legitimate interests
Sending newsletters, research updates, promotional content or event information	Consent, which you can withdraw at any time

Legal Basis. Where we rely on legitimate interests, we assess the effect on individuals and balance our interests against their rights. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Where provision of information is a statutory or contractual requirement, we will explain this and the consequences of not providing it at the point of collection.

Automated decisions. We do not make decisions about you based solely on automated processing of your personal data that have legal or similarly significant effects.

Cookies and similar technologies

Our website may use cookies and similar technologies for essential functions and, where enabled, analytics or marketing. The cookie information and controls available through “Cookie preferences” in our website footer explain the technologies used, their purposes, providers and duration, and how to change your choices. We obtain consent where required before using technologies that require it. You can manage your cookie choices at any time by selecting “Cookie preferences” in the footer of our website.

Sharing your information

We do not sell or rent your personal data. We may share personal information with the following categories of recipients, where needed for the purposes described in this Privacy Policy:

Service providers. We use trusted providers (see below) who process personal data on our behalf and only on our instructions, under contracts that require them to keep the personal data confidential and secure.

Document management (e.g. Microsoft Sharepoint)
Website hosting (e.g. Intuitiv Digital)
Cloud support (e.g. AWS)
Payment and payment collection (e.g. Xero)
Email delivery (e.g. Microsoft Outlook, Hubspot); and
Customer support and IT security tools. (e.g. Wazuh)

Your company. Administrators at the company that gave you access can see your account details and your activity in the Platform.

Legal and regulatory authorities. We may disclose your personal data to regulators, law enforcement or other public bodies where the law requires it, in response to valid legal process, to establish, exercise or defend legal claims, or to protect our rights and the safety of others.

CRM and marketing providers. We may disclose your personal data to CRM and marketing providers to support business contacts, communications, campaigns and website analytics.

Business transfers. If OBD is involved in a merger, acquisition or sale of all or part of its assets, your personal data may be transferred as part of that transaction. We will tell you about any such change and make sure your personal data remains protected to an equivalent standard.

We limit sharing to the information needed for the relevant purpose. At all times your personal data will be processed in accordance with (i) this Privacy Policy; and (ii) any additional data protection terms, incorporated into the agreement that we have with providers or companies, which are no less stringent than the protection afforded by this Privacy Policy.

We may share information between OBD UK and OBD US to respond to enquiries, manage customer and partner relationships, coordinate marketing, and provide shared administrative and operational support. We limit this sharing to information needed for the relevant purpose and ensure transfers are done so in accordance with applicable data protection law.

International transfers

Business information may be processed by OBD in the United Kingdom and the United States, and by our service providers in other countries where they host information or provide support. Where required by applicable data protection law, we use appropriate safeguards for international transfers.

Where a transfer of personal information from the UK or European Economic Area requires safeguards, we use an applicable adequacy arrangement or appropriate contractual safeguards, together with any required assessment and supplementary measures. Depending on the transfer, these may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses. Reliance on the EU–US Data Privacy Framework or its UK Extension requires verification that the relevant recipient and transfer are covered.

You can contact us for information about the safeguards applicable to your information and how to obtain a copy, subject to appropriate redactions.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including:

Encryption. Data is stored in encrypted systems on hosted cloud services such as Microsoft Office 365 and AWS, in transit, and at rest.
Access controls. Access to personal data is limited to authorised personnel who need it for their work.
Secure infrastructure. The Platform is hosted on cloud infrastructure on Amazon Web Services. Our other systems are provided by established cloud service providers.
Security testing. We regularly test and review our security measures and fix what the testing finds.
Training. Our staff receive regular training on data protection and security.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will tell you and the regulator where the law requires it.

Retention

We retain business information for as long as reasonably necessary for the purposes described in this Privacy Policy, including for legal, accounting and reporting purposes. The period depends on the type of information and why we hold it:

Enquiries and correspondence: for as long as needed to respond, provide follow-up support and maintain relevant records of our communications.
Business contacts and CRM records: while we have an ongoing business relationship or a reasonable expectation of further relevant contact. We review these records annually and delete or update information that is no longer needed.
Marketing information: while you remain subscribed or we otherwise have a lawful basis to send relevant marketing communications.
Contracts, invoices and related records: for the duration of the relationship and afterwards as needed to meet accounting, tax and other legal obligations, and to establish, exercise or defend legal claims.
Website and security logs: for the period needed to operate and protect our website, investigate incidents and resolve technical issues.

If you opt out of marketing, we retain a minimal record of your contact details and opt-out preference to prevent further marketing communications.

When information is no longer required, we delete it or anonymise it. Residual copies in backups are retained until they expire or are overwritten under our backup procedures. Information may be retained longer where required by law or in connection with a dispute or investigation.

Your rights and choices

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to:

Ask for a copy of the personal data we hold about you and information about how we process it.
Ask us to correct inaccurate or incomplete personal data.
Ask us to delete your personal data in certain circumstances, such as when it is no longer needed or you withdraw consent.
Ask us to limit processing in certain situations, such as while we check its accuracy.
Ask for your personal data in a structured, machine-readable format.
Object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent. Where we rely on consent, withdraw it at any time. This does not affect processing that has already taken place.

We may request proportionate information to verify your identity or clarify the request. Please do not send identity documents unless we request them through an appropriate channel. We respond within the time required by applicable law. Under the UK and EU General Data Protection Regulation, the usual period is one month, with extensions available in circumstances permitted by law for example if the request is complex.

To exercise any of these rights or submit an appeal where available, email privacy@oxfordbraindiagnostics.com. Where permitted by applicable law, an authorised agent may submit a request on your behalf. We will not discriminate against you for exercising your privacy rights.

Additional information for US residents in certain states, including California

In addition to the data protection laws referred to in this Privacy Policy, we also comply with the relevant privacy laws in the United States, including, where applicable, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, “CCPA”). The CCPA was implemented to enhance privacy rights and consumer protection for residents in California and therefore it applies to businesses that carry our business activities in California.

Collection of Personal Information

When we act as a “Service Provider” (as defined in the CCPA) or a “Processor” (as defined in applicable US state privacy laws), we may process “Personal Information” or “Personal Data” on behalf of our customers. In such case, we will provide reasonable assistance to that customer as necessary to enable them to respond to your requests for the exercise of your privacy rights – you should therefore submit your request directly to the relevant customer.

“Personal Information” is defined under US state privacy laws as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. We shall refer to such information as “Personal Information” throughout this Section.

In accordance with applicable US state privacy laws, Personal Information does not include:

Publicly available information, such as government records or information that has lawfully been made available to the general public by the consumer or from widely distributed media; and
De-identified or aggregated information.

Section 3 above (titled “Information We Collect”) describes the types of Personal Information that we collect. We have collected within the last 12 months the

Identifiers, such as your name, alias, postal address, email address, IP address or other similar identifiers;
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as your contact information;
Characteristics of protected classifications under California or federal law;
Commercial information, such as transaction information;
Internet or network activity information, such as your interactions with our website;
Geolocation data, such as your approximate location based on your IP address;
Audio, electronic, visual, and similar information, such as call or video recordings;
Professional or employment-related information, such as your title or industry;
Sensitive personal information as defined in the CPRA, such as your account log-in in combination with the password or credentials to access the account (if you have an account with us); and
Inferences drawn from any of the above Personal Information to create a summary about you, for example of your preferences and characteristics.

We may use, process and disclose de-identified or aggregated and other non-identifiable information including related to our business and our services for quality control, analytics, research, development and other purposes. Such information will not identify you individually.

Where we use, disclose or process de-identified data (data that is no longer reasonably linked or linkable to an identified or identifiable natural person, household, or personal or household device) we will maintain and use the information in de-identified form and not to attempt to re-identify the information, except in order to determine whether our de-identification processes are reasonable and adequate pursuant to applicable privacy laws.

Sources of Personal Information

Section 3 above (titled “Information We Collect”) also details the sources of Personal Information that we collect.

Purposes of Processing Personal Information

Section 4 above (titled “Why we use information and our lawful basis”) describes the purposes of our use or processing of Personal Information.

Notwithstanding the purposes described above, we do not use or disclose sensitive personal information beyond the purposes authorised by applicable law (including the CCPA). Accordingly, we only use and disclose sensitive personal information as reasonably necessary (i) to perform our services requested by you, (ii) to help ensure security and integrity, including to prevent, detect, and investigate security incidents, (iii) to detect, prevent and respond to malicious, fraudulent, deceptive, or illegal conduct, (iv) to verify or maintain the quality and safety of our services, (v) for compliance with our legal obligations, and (vi) to our service providers who perform services on our behalf.

Disclosure of Personal Information

Section 6 above (titled “Sharing Your Information”) describes the categories of recipients with whom we disclose Personal Information.

Certain US state privacy laws (such as the CCPA) define a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and also define “sharing” broadly, including as disclosing or making available personal information to a third party for purposes of cross-context behavioural advertising.

As mentioned above, we are in most cases a Service Provider or a Processor to a business that has provided your Personal Information to us for processing. Accordingly, we do not “sell” or “share” (as defined by applicable laws) such Personal Information to any third party.

Where we determine the purposes and means of the processing that we perform, for example when you provide the information directly to us or on our website, we are a “Business” (as defined in the CCPA) or a “Controller” (as defined in applicable US state privacy laws). In such case, we may disclose certain identifiers and Internet and electronic network activity usage information to advertising and data analytics partners. We may do so for the purposes described in Section 4 above (titled “Why we use information and our lawful basis”), including (i) to provide, analyse and improve our website, products, and other services and (ii) develop and manage our relationships with you and our business partners.

In this circumstance, we rely on such laws’ marketing exemption allowing us to: (i) store marketing information on third party systems, provided applicable terms are in place with our service provider; (ii) provide opt-outs from marketing communications, as opposed to requiring an opt-in; and (iii) follow applicable cookie consents on our website.

We do not sell or share sensitive personal information, nor do we sell or share any Personal Information about individuals who we know are under eighteen (18) years old.

Do Not Track Browser Settings

California law requires us to let you know how we respond to web browser “Do Not Track” (“DNT”) signals. Because there currently is not an industry or legal standard for recognising or honouring DNT signals, we do not respond to them at this time.

Data Protection Rights for Residents in Certain U.S. States (including California)

Subject to certain limitations and exceptions under applicable law, verified residents in certain U.S. states (including California) may have, pursuant to applicable law, the following additional privacy rights with respect to their personal information:

Right to Know. You have the right to ask us to disclose to you (i) the categories of personal information that we collect, (ii) the categories of sources from which the personal information is collected, (iii) the business or commercial purpose for collecting, selling, or sharing personal information, (iv) the categories of third parties to whom we disclose personal information, and (v) a copy of the specific pieces of personal information we have collected about you.
Right to Access. You have a right to ask us to provide you with a copy of the specific pieces of personal information that we retain about you.
Right to Correct. Subject to certain conditions and exceptions, you have a right to request that we correct inaccurate personal information that we maintain about you, taking into account the nature and purposes of the processing of the personal information.
Right to Deletion. You have the right to ask us to delete personal information we have collected about you, in certain circumstances.
Right to Limit Use and Disclosure. Subject to certain conditions and exceptions, you have the right to limit the use and disclosure of sensitive personal information (as defined under applicable local laws). However, as stated above, we do not use or disclose your sensitive personal information for purposes except as described herein (and as permitted pursuant to applicable law, including where applicable, the CCPA).
Right to Non-Discrimination. You have the right not to be subject to discriminatory treatment for exercising rights under the applicable privacy laws.
Right to Opt-Out. Subject to applicable laws, you have the right to opt out of certain types of processing, including:
- to opt out of the “sale” (as such term is defined under applicable law) of your personal information;
- to opt out of targeted advertising by us (or for California residents, to opt out of the “sharing”, as defined by the CCPA, of your personal information); and
- to opt out of any processing of personal information for purposes of making decisions that produce legal or similarly significant effects.
Right to Appeal. If we deny your privacy rights request, you may, depending on applicable law, also appeal our decision by submitting your appeal by contacting us at privacy@oxfordbraindiagnostics.com.

California’s “Shine the Light” law (Civil Code Section § 1798.83) also permits California residents to request, once a year and free of charge, certain information regarding our disclosure of personal information to third parties for their direct marketing purposes in the preceding calendar year.

Please note that the rights described above are not absolute, and where an exception under applicable law applies, we may be entitled to refuse requests in whole or in part. You may exercise any of the above privacy rights by contacting us by email at privacy@oxfordbraindiagnostics.com.

We will take steps to verify your request by matching the information provided by you with the information we have in our records. In particular, your request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
Describe your request with sufficient details that allows us to properly understand, evaluate, and respond to it.

Please note, in some cases, we may request additional information in order to verify your request or where necessary to process your request.

Authorised agents may initiate a request on behalf of another individual through one of the above methods; authorised agents will be required to provide proof of their authorisation and we may also require that the relevant consumer directly verify their identity and the authority of the authorised agent.

Concerns and complaints

Please contact us if you have a concern about how your information is handled. You also have the right to complain to the relevant data protection regulator. In the UK, this is the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/. In the EEA, you may contact the supervisory authority in the country where you live or work or where the alleged infringement occurred.

Changes to this notice

We may update this Privacy Policy to reflect changes to our activities or legal requirements. The date at the start shows when it was last updated. Where required, we will provide additional notice of material changes.