Legal
Privacy notice
Legal documents
Introduction
Sanome (Human Digital Twin Ltd t/a Sanome referred to as “Sanome”, “We, “Our” or “Us”), is committed to protecting the privacy and security of your personal information. We take care to protect the privacy of research study participants, clinical trial volunteers, our customers and their staff, our suppliers/partners and their staff, investors, patients, health care professionals, professional advisors, researchers, physicians, prospective employees and all other users or parties that otherwise interact with us or use our website.
We have therefore developed this privacy notice to inform you of the data we collect, what we do with your information, what we do to keep it secure as well as the rights and choices you have over your personal information.
We may provide additional privacy notices or information to you at the time we collect your data. For example, we may provide additional privacy information to clinical trial participants to describe our privacy practices in connection with conducting clinical trials and we also provide additional privacy information to prospective job applicants when they apply for a job with us. Such notices will govern how we process the information you provide at that time.
Throughout this document we refer to Data Protection Legislation, which means the Data Protection Act 2018 (DPA 2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.
We are further committed to compliance with the Health Insurance Portability and Accountability Act (HIPAA), the Medical Devices Regulation and related legislation, requirements and guidance, as applicable to Sanome and you.
Data controller
Sanome is the controller for the personal information we process as identified in this privacy notice. In some circumstances, Sanome will process data on behalf of other organisations (e.g assisting a partner organisation with their own clinical research). In such circumstances, the other organisation will be the controller and so you should refer to their privacy notices for details of how your data is processed.
Occasionally, Sanome may be a joint controller with one of our partner organisations. Such processing may be communicated to you in a separate privacy notice.
We are registered with the UK’s data protection regulator, the Information Commission (which replaced the Information Commissioner’s Office, or ICO, on 30 September 2026), with registration number ZB696884.
We have appointed a Data Protection Officer (DPO) to help us monitor internal compliance, inform, and advise on data protection obligations, and act as a point of contact for you (data subjects) and the ICO.
Our Data Protection Officer can be contacted at dpo@sanome.com
The information we collect and when
We only collect personal information that we know we will genuinely use and in accordance with the Data Protection Legislation. The type of personal information that we will collect depends on the nature of the relationship that we have with you. We may collect the following:
Personal and business contact information (such as name, job title and employer name, email address, mailing address, phone number, and emergency contact information).
Physical, biophysical, or digital data, which may include:
Health and medical information (such as information about physical and mental health conditions, diagnoses or symptoms, treatments for medical conditions, family medical history, medications) in connection with clinical trials and conducting research.
Physical samples provided by you when participating in a trial/research study and data obtained from studying these samples (i.e. biomarker data).
Biographical and demographic information (such as date of birth, ethnicity, gender).
Photos, videos and audio recordings.
Basic information about member of staff (either external or internal) who collected the data (such as name, role type, time at organisation)
Cookies and IP addresses. For more information, please see Cookies section below.
Professional credentials, educational and professional history, and institutional affiliations.
Where you are one of our investors, your investor profile information, and interactions.
We may, in further dealings with you, extend this personal information to include services used, and subscriptions, records of conversations and agreements and payment transactions.
Other information that we may collect that is not specifically listed here but that we will use in accordance with this privacy notice or as otherwise disclosed at the time of collection.
In most instances, you are under no statutory or contractual requirement or obligation to provide us with your personal information; however, we will often require elements of the information above in order to provide our services to you in an efficient and effective manner.
How we use your information
Data collection
In many instances we collect personal information directly from you, for example through online forms, questionnaires, phone conversations, emails, in person (at clinical sites, hospitals, conferences, workshops, seminars or events), medical devices, and so on.
In other instances, we receive data from hospitals and other care organisations which we have partnered with. Data sharing arrangements vary on a case-by-case basis but we always endeavour to reduce the number of personal identifiers we receive to the minimum necessary to carry out our work effectively.
In other instances, we may collect personal information from our website, public forums (e.g., social media), when you have or intend to attend an event to which we are affiliated, from contract research organisations, hospitals, healthcare professionals, partners and so on.
Lawful basis
We only process, store or transfer your personal information when we have a lawful basis for doing so. The legal basis we rely on to process the information identified in this notice are as follows:
Legitimate Interest: processing is necessary for the purposes of our legitimate interests (i.e., our business interests), except where such interests are overridden by your interests or fundamental rights and freedoms.
Consent: You have given consent to the processing of your personal data for one or more specific purposes.
Legal obligation: processing is necessary for compliance with our legal obligations.
Vital interests: processing is necessary in order to protect the vital interests of the data subject or of another natural person.
Contractual obligation: processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
Processing activities
We may use your data to:
Processing activity | Lawful basis |
Contact you, following your enquiry, reply to any questions, suggestions, issues, or complaints you have contacted us about. | Legitimate Interest |
Communicate with you and send B2B marketing communications, including where you have attended events or webinars. See also “How we keep you updated on our services” below. | |
Determine whether you are eligible to take part in a clinical trial or research. | |
Perform and administer clinical trials and research. | |
Clean raw data to assist development of early warnings and/or research | |
Identify and combine biomarkers to develop engaging, useful and accurate early warning systems that enable early detection and prevention of disease. | |
Creating dashboards to help hospital research teams identify trends and help identify potential improvements in care | |
Optimise our product for clinical studies/ research. | |
Meet our high security standards in managing your personal data, our systems and our website. | |
Register you as a user on a mobile application, enable you to use the app, and enable us to make improvements to the app. | |
To send you push notifications on our mobile application, if you have started, but not completed, the sign-up process. | Consent |
Generate marketing/analytics from our website using cookies. This includes the monitoring, development and improvement of the website and your experience. For full details on our use of cookies please see our Cookie Policy. | Consent |
To be contacted regarding participation in Sanome studies or with a copy of our newsletter, providing you have opted in. | |
Negotiate and/or enter into and/or fulfil a contract with you, or the organisation for which you work. | Contractual Obligation (when the contract is with you) or Legitimate Interest (when the contract is with the organisation for which you work) |
Fulfil pre-contractual steps, such as supplier questionnaires, as part of our onboarding process. | |
Comply with applicable laws, lawful requests, and legal process, where appropriate/necessary. | Legal Obligation |
Comply with regulatory monitoring and reporting obligations, where appropriate/necessary. | |
Share your data with healthcare professionals if you are taken ill or involved in an accident while visiting our office or sites, and are unable to provide your consent. | Vital Interest |
Professional Users of our regulated products which deliver clinical decision support services to aid patient care management | Legal and Contractual |
Patients | Legal and Contractual |
Process patient information through our clinical decision support products. Where we do this on behalf of a hospital or care organisation, that organisation is the controller, and its own privacy notice explains how your information is used (see “Data controller” above). Where we are the controller, for example when meeting our safety monitoring and reporting duties as a medical device manufacturer, we rely on the lawful basis shown here. | Legal Obligation |
Provide our clinical decision support products to hospitals and care organisations. This includes setting up and managing accounts for healthcare professionals who use them, providing support, and monitoring the products’ safety and performance. | Legitimate Interest (the contract is with the organisation the healthcare professional works for) and Legal Obligation (safety and performance monitoring we must carry out as a medical device manufacturer) |
Sensitive information
As well as the lawful bases identified above, when the data we are processing is considered ‘special category data’, such as your ethnicity, health or genetic information, we ensure that we have your explicit consent or are specifically authorized by the Confidentiality Advisory Group (CAG) or the processing is necessary for one of the following:
Purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
Public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.
Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Pseudonymised information
Pseudonymisation is a security technique which replaces identifiers from a set of data, such as your name, with a pseudonym (i.e a code), so that the remaining information cannot be linked to you. In some instances, when Sanome receives your data, it will already be pseudonymised and so we will not be able to link it directly to you. In other instances, Sanome will pseudonymise your data ourselves to ensure only those with a need-to-know basis can identify you. We incorporate this technique to provide you with an additional layer of privacy and security but will still treat your pseudonymised data as personal data and manage it in line with Data Protection Legislation.
Anonymous information
In addition, we may create anonymous, aggregated, or de-identified data from your personal information and other individuals whose personal information we collect. We do this by excluding information that makes the data personally identifiable to you and use that anonymous data for research purposes.
Automated processing
We use algorithms to help us analyse data, including within our clinical decision support products. These algorithms do not make decisions about you. When our products are used in patient care, they provide information to support the healthcare professionals caring for you, and those professionals make all decisions about your care. When we use algorithms for research and product development, the results are reviewed by our data scientists.
Cookies
We use cookies and similar technologies on our website to enhance your experience, analyse traffic, and for marketing purposes. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.
Who we might share your information with
We may share your personal data with trusted third-party organisations as follows:
With business partners and corporate affiliates to support our services, as outlined in this notice.
With third party companies or individuals (data processors) to perform services on our behalf. This would include biomarker companies, contract research organisations; data storage and analytics companies; technology support and services (email, web hosting, marketing, and advertising providers, etc.). We only share your data with data processors that can provide sufficient guarantees that they will process your data securely and in accordance with Data Protection Legislation. Our data processors cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us or further sub-processors which must process your personal information to the same high standards.
With partners with whom we jointly process your data. We may also share your personal information with health care professionals, researchers, academics, public health organisations, and publishers for purposes consistent with this privacy notice.
With professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.
With government or law enforcement officials or private parties as required by law and disclose and use such information as we believe necessary or appropriate.
In some situations, we may have a separate agreement or relationship with you with respect to a specific type of processing of your data, such as if you participate in trial/research. These situations will be governed by specific terms, privacy notices, or consent forms that provide additional information about how we will use your information and how it is shared. We will honour these additional terms with respect to your information and thus, strongly recommend you review the additional terms prior to participating.
International transfers of information
Whenever we transfer your personal information outside of the UK or the EEA to countries not deemed by the ICO/European Commission (as relevant) to provide an adequate level of personal information protection, the transfer will be based on appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms recognised under Data Protection Legislation.
How we keep you updated on our services
As a business contact, we will send you relevant news about our services in a number of ways including by email, but only if we have a legitimate interest to do so. Marketing communications will be sent from our own domain.
Each email communication will have an option to object to the processing, if you wish to amend your marketing preferences, you can do so by following the link in the email and updating your preferences or by contacting us using the details below.
We make every effort to ensure that we only send such communications to those acting in a business capacity and do not send such materials to consumers via personal email addresses if it is clear they are not acting in such a capacity.
An exception to this will be where you have provided your consent to be contacted about future clinical trials or user research studies or have signed up to our newsletter. In such cases you can withdraw this consent by contacting us using the details provided in this notice.
Your rights over your information
We would ask for proof of identity and sufficient information about your interactions with us so that we can locate your personal information.
The right to be informed about our collection and use of personal data
You have the right to be informed about the collection and use of your personal data. We ensure we do this with our internal data protection policies and through this and other privacy notices. These are regularly reviewed and updated to ensure these are accurate and reflect our data processing activities.
Right to access your personal information
You have the right to access the personal information that we hold about you by making a request. This is referred to as a ‘Data Subject Access Request’. If we agree that we are obliged to provide personal information to you (or someone else on your behalf), we will provide it to you or them free of charge and aim to do so within one month from when your identity has been confirmed. Our response is based on a reasonable and proportionate search for the information requested.
If you would like to exercise this right, please contact us as set out below.
Right to rectify your personal information
If any of the personal information we hold about you is inaccurate, incomplete, or out of date, you may ask us to correct it.
If you would like to exercise this right, please contact us as set out below.
Right to object or restrict our processing of your data
You have the right to object to us processing your personal information for particular purposes or have its processing restricted in certain circumstances.
If you would like to exercise this right, please contact us as set out below.
Right to erasure
You have the right to have personal data erased. This is also known as the ‘right to be forgotten’. The right is not absolute and only applies in certain circumstances.
If you would like to exercise this right, please contact us as set out below.
Right to portability
The right to portability gives you the right to receive personal data you have provided to a controller in a structured, commonly used, and machine-readable format. It also gives you the right to request that a controller transmits this data directly to another controller.
This right is unlikely to apply to Sanome’s use of your data, but if you would like to discuss this right, please contact us as set out below.
Right to complain
You have the right to raise a complaint about how we have handled your personal data directly with us, in addition to your right to complain to the Information Commission. If you would like to raise a complaint, please contact us using the details in the “How to contact us” section below, and we will acknowledge your complaint within 30 days.
Rights in relation to automated processing
An automated decision is one made by a computer system without any meaningful involvement from a person. If a significant decision about you is made in this way, you have the right to be told about it, to give your views, to ask for a person to review it, and to challenge it.
These rights are unlikely to apply to Sanome’s use of your data, because our systems do not make decisions about you and a person is always involved (see “Automated processing” above). If you would like to discuss this further, please contact us as set out below.
For more information about your privacy rights
The Information Commission regulates data protection and privacy in the UK. It took over from the Information Commissioner’s Office (ICO) on 30 September 2026. Its website has guidance for the public and a public register of data controllers, including Sanome: https://ico.org.uk/for-the-public
You can complain to the Information Commission at any time about the way we use your information. If you live or work in the European Union, you can also complain to the data protection authority in your country. However, we hope you will raise any issue or complaint with us first, using the contact details below. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have.
How long we keep your information for
We will retain your personal information in order to provide you with a high-quality service, in accordance with Data Protection Legislation and for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means.
In some circumstances we may anonymise your personal information (so that it can no longer be associated with you).
Giving your reviews and sharing your thoughts
When using our websites, you may be able to share information through social networks like Facebook and Twitter. For example, when you ‘like’, ‘share’ or review our Services. When doing this, your personal information may be visible to the providers of those social networks and/or their other users. Please remember it is your responsibility to set appropriate privacy settings on your social network accounts, so you are comfortable with how your information is used and shared on them.
Security
Data security is of great importance to Sanome and to protect your data we have put in place suitable physical, electronic, and managerial procedures to safeguard and secure your collected data.
We take security measures to protect your information including:
Limiting access to our buildings to those that we have determined are entitled to be there (by use of passes, key card access and other related technologies).
Implementing access controls to our information technology.
We use appropriate procedures and technical security measures (including strict encryption, pseudonymisation and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices, and stores.
What happens if our business changes hands?
We may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of our business. Any personal data that you have provided will, where it is relevant to any part of our business that is being transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy notice, be permitted to use that data only for the purposes for which it was originally collected by us.
Changes to our privacy notice
We may change this privacy notice from time to time (for example, if the law changes). We recommend that you check this notice regularly to keep up to date.
Other links
Please be aware that the website may link to other websites that may be accessed by you. We are not responsible for the data policies, content or security of such sites. We do not have any control over any use of your data by third parties when you visit such sites or otherwise provide your data through these channels.
How to contact us
If you would like to exercise one of your rights as set out above, or you have a question or a complaint about this notice, the way your personal information is processed, please contact us by one of the following means:
Post | Human Digital Twin Ltd t/a Sanome |
You can make a complaint to the Information Commission (here: https://ico.org.uk/global/contact-us/) at any time about the way we use your information. However, we hope that you would consider raising any issue or complaint you have with us first using the contact details above. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have.
Thank you for taking the time to read our privacy notice.
This notice was last updated on 28 September 2026