Privacy Policy

Last updated 23 October 2026

Introduction

Oxford Brain Diagnostics respects the privacy of its customers, suppliers, and partners. We have therefore formulated and implemented a policy on complete transparency regarding the processing of personal data, its purpose(s) and the possibilities to exercise your legal rights in the best possible way. For employees, we have formulated a separate privacy policy, available upon employment and upon request.

This privacy policy pertains to processing by Oxford Brain Diagnostics by means other than through the use of cookies. Oxford Brain Diagnostics has formulated a separate cookie notice, which can be found on Oxford Brain Diagnostics' website: https://www.oxfordbraindiagnostics.com.

Who we are and how to contact us

Oxford Brain Diagnostics Ltd (OBD UK) is registered in England and Wales under company number 11703979, with its registered office at Oxford Centre for Innovation, Blue Boar Court, 9 Alfred Street, Oxford, OX1 4EH, United Kingdom. OBD’s US entity is Oxford Brain Diagnostics Inc (OBD US), located at 418 Broadway, Suite R, Albany, NY 12207, United States.

In this notice, “OBD”, “we”, “us” and “our” refer to the entity responsible for the relevant activity, as identified below.

For privacy questions, to exercise your data protection rights, or to contact our Data Protection Officer, please email privacy@oxfordbraindiagnostics.com.

Scope and Responsibility

This notice covers personal information about website visitors, people making enquiries, marketing recipients, and customer, supplier and partner contacts.

OBD UK operates this website and is the controller of personal information collected through it. This means OBD UK determines how and why that information is used.

For other business activities, OBD UK or OBD US may be the controller, depending on which entity determines how and why your personal information is used. We identify the responsible entity when we collect your information or in the relevant business communications.

Information we collect and its sources

We receive information directly from you, from your organisation and other business contacts, from public professional sources, and through website interactions.

We may process your name, job title, organisation, business email address, telephone number, correspondence and enquiry details; contractual, invoicing and payment information relevant to our business relationship; and technical information such as IP address, browser details, website activity and cookie preferences.

Please do not submit patient images, medical records or other sensitive patient information through general website forms or ordinary enquiry emails. Use the agreed secure clinical or research transfer channel.

Why we use information and our lawful bases

We use enquiry and correspondence information to answer questions, arrange discussions and provide support. We ordinarily rely on our legitimate interests in communicating with people who contact us and operating our business. Where you personally enter a contract with us, we may rely on steps taken at your request before entering that contract or performance of that contract.

We use professional contact details to manage customer, supplier and partner relationships, administer contracts and deliver services. For contacts acting for an organisation, our lawful basis is generally our legitimate interests in managing that relationship. We use financial and transaction records for billing, accounting and compliance with legal obligations where those obligations apply.

We use technical and security information to operate and protect our systems, detect misuse and maintain reliable services, relying on our legitimate interests in system security and operation and, where applicable, legal obligations.

We may send news, research updates, event information or other marketing communications relevant to your professional interests. We rely on consent where required by applicable law and otherwise on our legitimate interests in communicating about our services. You may unsubscribe using the link in our marketing emails or contact us. If you opt out, we retain a minimal record of your contact details and opt-out preference to prevent further marketing communications.

Where we rely on legitimate interests, we assess the effect on individuals and balance our interests against their rights. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. Where provision of information is a statutory or contractual requirement, or necessary to enter a contract, we will explain this and the consequences of not providing it at the point of collection.

Cookies and similar technologies

Our website may use cookies and similar technologies for essential functions and, where enabled, analytics or marketing. The cookie information and controls are available through “Cookie preferences” in our website footer. We obtain consent where required before using technologies that require it. You can manage your cookie choices at any time by selecting “Cookie preferences” in the footer of our website.

Who receives business information

We may share personal information with the following categories of recipients, where needed for the purposes described in this notice:

• Technology providers supporting email, document management, cloud storage, website hosting and IT support.
• CRM and marketing providers supporting business contacts, communications, campaigns and website analytics.
• Accounting and financial service providers supporting bookkeeping, invoicing and payments.
• Professional advisers, such as lawyers, accountants, auditors and insurers.
• Regulators, public authorities and other parties, where disclosure is required by law or necessary to establish, exercise or defend legal claims.

We limit sharing to the information needed for the relevant purpose.

We may share information between OBD UK and OBD US to respond to inquiries, manage customer and partner relationships, coordinate marketing, and provide shared administrative and operational support. We limit this sharing to information needed for the relevant purpose.

We may disclose information where required by law, to respond to lawful regulatory requests, or to establish, exercise or defend legal claims. If a business transaction affects OBD, information may be disclosed to relevant parties subject to appropriate confidentiality protections and applicable legal requirements.

International transfers

Business information may be processed by OBD in the United Kingdom and the United States, and by our service providers in other countries where they host information or provide support. Where required by applicable data protection law, we use appropriate safeguards for international transfers.

Where a transfer of personal information from the UK or European Economic Area requires safeguards, we use an applicable adequacy arrangement or appropriate contractual safeguards, together with any required assessment and supplementary measures. Depending on the transfer, these may include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses. Reliance on the EU–US Data Privacy Framework or its UK Extension requires verification that the relevant recipient and transfer are covered.

You can contact us for information about the safeguards applicable to your information and how to obtain a copy, subject to appropriate redactions.

Security

We use technical and organisational measures appropriate to the information and risks involved. These include access restrictions, encryption, security monitoring, vulnerability management, staff training and incident response procedures, as appropriate to the processing and associated risks. We assess suspected incidents and provide notifications where required by applicable law and agreements.

Retention

We retain business information for as long as reasonably necessary for the purposes described in this notice. The period depends on the type of information and why we hold it:

• Enquiries and correspondence: for as long as needed to respond, provide follow-up support and maintain relevant records of our communications.
• Business contacts and CRM records: while we have an ongoing business relationship or a reasonable expectation of further relevant contact. We review these records annually and delete or update information that is no longer needed.
• Marketing information: while you remain subscribed or we otherwise have a lawful basis to send relevant marketing communications.
• Contracts, invoices and related records: for the duration of the relationship and afterwards as needed to meet accounting, tax and other legal obligations, and to establish, exercise or defend legal claims.
• Website and security logs: for the period needed to operate and protect our website, investigate incidents and resolve technical issues.

If you opt out of marketing, we retain a minimal record of your contact details and opt-out preference to prevent further marketing communications.

When information is no longer required, we delete it or anonymise it. Residual copies in backups are retained until they expire or are overwritten under our backup procedures. Information may be retained longer where required by law or in connection with a dispute or investigation.

Your rights and choices

Depending on the law that applies and the circumstances, you may have rights to access your personal information; correct inaccurate information; request deletion or restriction; receive certain information in a portable form; object to processing based on legitimate interests; and withdraw consent where processing relies on consent. You may object to direct marketing at any time. These rights are subject to applicable conditions and exceptions.

Contact us using the details in section 1. We may request proportionate information to verify your identity or clarify the request. Please do not send identity documents unless we request them through an appropriate channel. We respond within the time required by applicable law. Under UK and EU GDPR, the usual period is one month, with extensions available in circumstances permitted by law; we will explain any applicable extension.

Depending on where you live and whether applicable US state privacy laws cover our processing of your information, you may have rights to access, correct or delete your personal information, obtain a portable copy, and opt out of certain uses, including targeted advertising or the sale or sharing of personal information. You may also have the right to appeal a decision concerning your request.

To exercise any of these rights or submit an appeal where available, email privacy@oxfordbraindiagnostics.com. Where permitted by applicable law, an authorised agent may submit a request on your behalf. We will not discriminate against you for exercising your privacy rights.

 

Concerns and complaints

Please contact us if you have a concern about how your information is handled. You also have the right to complain to the relevant data protection regulator. In the UK, this is the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/. In the EEA, you may contact the supervisory authority in the country where you live or work or where the alleged infringement occurred.

Changes to this notice

We may update this notice to reflect changes to our activities or legal requirements. The date at the start shows when it was last updated. Where required, we will provide additional notice of material changes.