Rest of the World.
Welcome to the privacy policy for Astron Health ("we", "us"). Astron Health is a trading name of Astron Health Ltd, a company registered in England and Wales with company registration number 15587830. Astron Health is committed to ensuring that your privacy is protected. This privacy policy sets out how we will collect, store, use, share and protect any information that you provide to us. We also explain your rights and how to contact us. Your personal information will only be used in accordance with this privacy policy.
About us
We have appointed a Data Protection Officer to oversee our handling of personal information. Our Data Protection Officer is Mr. Benjamin Whately, CEO and can be reached at ben@astron.health. We process your information in the ways outlined below.
For the purposes of the data protection law, Astron Health Ltd will be the data controller. Astron Health Ltd is registered with the Information Commissioners' Office (ICO) under registration number: C1532868.
Our processing of your personal information
We will collect and use different personal information about you for different reasons, depending on our relationship with you.
Sometimes we will request or receive "special categories of personal information" (which is information relating to your health, genetic or biometric data, criminal convictions, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership).
Where you provide personal information to us about other individuals (for example, members of your family or other dependents) we will also be data controller of their personal information and we are responsible for protecting their personal information and using it appropriately. This policy will therefore apply to those individuals, and you should refer them to this policy. If you provide us with information relating to other individuals, we are entitled to assume that you have the required authority from that person to provide us with the information and cannot be held responsible if that is not the case.
In order to make this policy as user friendly as possible, we have split it into different sections. Please click on the section below that best describes your relationship with us and the service you receive from us.
We may share your personal data where necessary with the parties set out below in the relevant sections of this policy. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Prospective or existing patients
Where you are a prospective or existing patient enquiring about or receiving cancer treatments or participating in a cancer study.
This section will apply if you currently participate in a cancer study or receive cancer treatment or if you are looking to participate in a cancer study or receive cancer treatment.
What personal information may we collect?
We may collect the following personal information:
- General information such as your name, address, phone numbers and email addresses, date of birth and gender.
- Identification information including passport, driving license, national identity card (for non-UK nationals) or government issued ID verification.
- Employment information such as job title, employment history and professional accreditations.
- Financial information such as your bank details and credit and debit card details.
- Information about your family including information about your dependents.
- Information obtained during telephone recordings.
- Information about your visits to and use of this website (including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views). For more information, please see our cookie policy.
What special categories of personal information may we collect?
- Details about your physical, mental and emotional health including information on your medical history and treatments received, including but not limited to: blood test results, radiology (imaging reports), medical examinations, histology (biopsies), allergies, co-morbidities, current and historical medications, relevant psychological assessments (including quality of life assessments), bone assessments, performance status (i.e. appetite, pain levels, quality of life).
- Details of your race and/or ethnicity.
- Details of any genetic data or biometric data relating to you.
- Details of your sexual orientation (where relevant to your care).
How will we collect your personal information?
We will collect information directly from you when:
- You attend a medical appointment (either in person, or via telehealth) at our clinic or by filling in forms on our website.
- You contact us by email, telephone and through other written and verbal communications.
- Dealing with any complaints you may have.
As well as obtaining information directly from you, we will also collect your personal information from:
- Enquiries and discussions with, and referrals from healthcare professionals including NHS doctors, GPs and oncologists.
- Your GP, other hospitals or clinics where you are currently being treated who may share your medical information with us.
What will we use your personal information for?
There are a number of reasons we use your personal information and for each purpose we need to have a "legal ground" to do so.
We will rely on the following "legal grounds" when we process your "personal information":
- Performance of a contract: We need to use your personal information to enter into or perform the contract that we hold with you.
- Legal obligation: We have a legal or regulatory obligation to use such personal information.
- Legitimate interest: We have a valid business reason (known as a legitimate interest) to use your personal information, and which is necessary for our everyday business operations and activities (e.g., to keep business and accounting records, manage our business operations and to develop and improve our products and services). When using your personal information for these purposes, we will always consider your rights and interests.
- Vital interest: In very rare circumstances we may need to use your personal information to protect your vital interests. This may happen where you are critically ill and we need to administer emergency treatment or pass on your information to others to enable them to administer emergency treatment to you.
In each case we assess our need to use this personal information for these purposes against your rights to privacy to ensure we are protecting your rights.
When we use your "special categories of personal information", we must have an additional "condition"
For certain processing purposes, we have outlined alternative legal grounds. We will rely on the following conditions when we process your special categories of personal information:
- You have given your explicit consent to our use of your special categories of personal information.
- We need to use such special categories of personal information to establish, exercise or defend legal rights, such as when we are facing legal proceedings or want to bring legal proceedings ourselves.
- We need to use such special categories of personal information for the purposes of preventive medicine, medical diagnosis, provision of healthcare and treatment and the management of health care systems and services.
- We need to use such special categories of personal information for the purposes of medical and scientific research, where that research is not to support measures or decisions with respect to particular individuals.
As per the Data Protection Act 2018, when we process data based on condition in (3) above, this will be processed by or under the responsibility of a professional who is subject to the obligation of professional secrecy under relevant EU or national law.
Who will we share your personal information with?
We will keep your personal information confidential, and we will only share it where necessary for the purposes set out above with the following parties.
- Our business partners, suppliers and sub-contractors for the performance of any contract we enter into with you or with them for your benefit. For example, medical details you send to us electronically for assessment of your condition, arrangement of appointment or any other purpose may be transmitted to consultants employed by, or contracted to, Astron Health for their professional opinion.
- Healthcare professionals including NHS doctors, GPs, oncologists, referring consultants or your other primary care provider(s).
- We will share your personal information with a registered pharmacy which is providing you with items we have prescribed for you.
- Other third parties who we have entered into contractual arrangements with to provide services we need to carry out our everyday business activities such as document management providers, back-office system providers, storage warehouses, IT suppliers, actuaries, auditors, lawyers, pharmacy providers, your health insurance provider, outsourced business process management providers, our subcontractors and tax advisers.
- Our insurers (if appropriate) and with your health insurance company to facilitate reimbursement to you of costs incurred by you.
- Prospective purchasers of our business, so that you may continue receiving a seamless service from the Astron Health.
- Those who we are under a duty to disclose or share your personal data with in order to comply with any legal obligation or for the purposes of fraud protection and credit risk reduction.
- Third parties, using anonymised data, for the purposes of conducting marketing-related activities, including conducting market research and reports.
Users of the Astron Health website
Where you are a user of the Astron Health website.
If you are a user of the Astron Health website, this section will be relevant to you and sets out our uses of your personal information.
What personal information will we collect?
- General information such as your name, phone number, email address, date of birth and gender.
- Information about your visits to and use of this website (including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views). For more information, please see our cookie policy.
What special categories of personal information will we collect?
- Details about your physical health, including information on your cancer type and medical diagnosis.
- Details about your medical history and current and past treatments.
How will we collect your personal information?
We will collect information directly from you when:
- When you use our website and submit a form to enquire about appointments or to request a new patient information pack.
- If you provide us directly with your personal information and request to be kept informed of news from the clinic.
As well as obtaining information directly from you, we will also collect your personal information from:
- Your family or friends, who may, on your behalf, enquire about appointments or to request a patient information pack.
- Our website may also collect your device’s unique identifier, such as your IP address.
What will we use your personal information for?
We may use your personal information for a number of different purposes. In each case, we must have a "legal ground" to do so. We will rely on the following "legal grounds", when we process your "personal information":
- Legitimate interest: We need to use your personal information for a valid business reason (known as legitimate interest) (e.g., to monitor the number of visitors and usage of our website, to follow up on enquiries and to provide marketing information to you). When using your personal information for these purposes, we will always consider your rights and interests.
If you have filled in contact information, we will contact you to discuss the treatment and our clinical services. This will be based on you having consented to us contacting you.
When the information that we process is classed as "special categories of personal information", we must have an additional "condition". We will rely on the following conditions when we process your "special categories of personal information":
- You have provided your explicit consent to our use of your special categories of personal information (e.g., in relation to your marketing preferences).
Healthcare Professionals
Where you are a healthcare professional.
If you are a healthcare professional, this section will be relevant to you and sets out our uses of your personal information.
What personal information will we collect?
- We will collect your name and address, your contact information such as your email address and telephone numbers, and information about your professional work such as your employer, your job title and your research interests.
- Information about your visits to and use of this website (including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views). For more information, please see our cookie policy.
What special categories of personal information will we collect?
We do not collect any of your special categories of personal information. In the event that this changes, we will let you know.
How will we collect your information?
- Where you contact us directly by email, phone or via the website and request and provide us with your personal information and request to be kept informed of news from the clinic.
- When you use our website, we will collect your browsing information.
What will we use your personal information for?
We may use your personal information for a number of different purposes. In each case, we must have a "legal ground" to do so. We will rely on the following "legal ground", when we process your "personal information":
- Legitimate interest: We need to use your personal information for a legitimate interest in the form of a valid business reason (e.g., to monitor the number of visitors and usage of our website, to follow up on your enquiries and to send you research materials and updates about our activities). When using your personal information for these purposes, we will always consider your rights and interests.
Who will we share your personal information with?
We will keep your personal information confidential, and we will only share it where necessary for the purposes set out above with the following parties:
- Other group companies based in the EEA.
- Third parties who we have entered into contractual arrangements with to provide services we need to carry out everyday business activities such as IT suppliers, marketing services providers and website providers.
- Third party healthcare providers who are involved in the care of a patient, who may need to contact you regarding the care of that patient.
Business partners, Sub-contractors and suppliers
Business partners, sub-contractors or other third-party suppliers.
If you are a business partner, sub-contractor or other third-party supplier, this section will be relevant to you and sets out our uses of your personal information.
What personal information will we collect?
- Your name, address, date of birth and gender.
- Contact information, including previous contact information, such as your telephone numbers and email addresses.
- Information about your job such as job title and previous roles.
- Information which we have gathered from publicly available sources such as internet search engines and social media sites as part of our general due diligence enquiries.
- Information about your visits to and use of this website (including your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views). For more information, please see our cookie policy.
What special categories of personal information will we collect?
We do not collect any of your special categories of personal information. In the event that this changes, we will let you know.
How will we collect your information?
As well as obtaining information directly from you, we will collect information from:
- Other group companies based in the EEA.
- Publicly available sources such as internet search engines and social media sites.
- Our website may also collect your device’s unique identifier, such as an IP address.
What will we use your personal information for?
We may use your personal information for a number of different purposes. In each case, we must have a "legal ground" to do so. We will rely on the following "legal grounds", when we process your "personal information":
- Performance of a contract: We need to use your personal information to enter into or perform the contract that we hold with you. For example, we may need certain information in order to operate our business arrangement.
- Legal obligation: We have a legal or regulatory obligation to use such personal information. For example, we may be required to carry out certain background checks.
- Legitimate interest: We need to use your personal information for a valid business reason (e.g., to keep business and accounting records, manage our business operations and to improve quality, training and security). When using your personal information for these purposes, we will always consider your rights and interests.
Who will we share your personal information with?
We will keep your personal information confidential, and we will only share it where necessary for the purposes set out above with the following parties:
- Other group companies based in the EEA.
- Our third-party service providers such as IT suppliers, actuaries, auditors, lawyers, document management providers, outsourced business process management providers, our subcontractors and tax advisers.
- Selected third parties in connection with any sale, transfer or disposal of our business.
What marketing activities do we carry out?
We may use your personal information to provide you with information about our products or services or which may be of interest to you where you are an existing patient, which are complementary to, or part of, the ongoing services we offer or where you have provided your consent for us to do so.
We may use your personal information to provide you with information about our products, our services or our research which may be of interest to you where you are a healthcare professional who has registered an interest in learning more about our work.
We are committed to only sending you marketing communications that you have clearly expressed an interest in receiving. If you wish to opt out of marketing, you may do so by clicking on the "unsubscribe" link that appears in all emails or telling us when we call you. Otherwise, you can always contact us at support@astron.health to update your contact preferences.
Please note that, even if you opt out of receiving marketing messages, we may still send you communications which are relevant to the nature of the clinical services we offer you as a patient.
How long do we keep your personal information for?
We will retain your personal information for as long as your account is active or as reasonably necessary to provide you services, comply with our legal and regulatory obligations, resolve disputes and/or enforce our agreements.
The exact time period will depend on your relationship with us and the type of personal information we hold.
If you would like further information regarding the periods for which your personal information will be stored, please contact us at support@astron.health.
How do we protect your information?
We are committed to ensuring that your information is secure.
We will store your personal information (including the special category information) in a specialist I.T. system, hosted in the Microsoft Azure cloud platform. Azure data storage adheres to all data protection, privacy and security standards. More information can be found here. In order to prevent unauthorised access, loss, misuse or disclosure, we take and maintain appropriate technical, organisational and physical safeguards designed to protect your personal information. We have put in place physical, electronic, and managerial procedures to safeguard and secure the information you provide to us including the use of pseudonymisation, encryption generally, a clean desk policy and access controls which we regularly review. Our overall data security policies are documented under our Systems Level Security Policy and reviewed regularly.
What is our approach to sending your personal information overseas?
There may be some instances where your personal information is transferred to countries outside of the UK or EEA (as applicable), such as when we transfer information to a patient's primary healthcare provider based outside the UK or EEA (as applicable), when we are treating a patient via telehealth or when a patient elects to travel to a country outside the UK or EEA (as applicable) for their treatment.
Where such a transfer takes place, we will take the appropriate safeguarding measures to ensure that your personal information is adequately protected. We will do so in a number of ways including where required:
- entering into data transfer contracts and using specific contractual provisions that have been approved by the Information Commissioners’ Office otherwise known as the "International Data Transfer Agreement"; and
- we will only transfer personal information to companies in non-UK or non-EEA countries (as applicable) who have been deemed by UK or European data protection authorities (as applicable) to have adequate levels of data protection for the protection of personal information.
We are also entitled under UK or European data protection laws to transfer your personal information to countries outside the UK or EEA where it is necessary for the performance of the contract we have with you.
If you would like further information regarding our data transfers and the steps we take to safeguard your personal information, please contact us at support@astron.health.
Your rights
Under data protection law you have a number of rights in relation to the personal information that we hold about you which we set out below. You can exercise your rights by contacting us at any time at support@astron.health.
Please note that although we take your rights seriously, there may be some circumstances where we cannot comply with your request such as where complying with it would mean that we couldn't comply with our own legal or regulatory requirements. However, we will always respond to any request you make and if we can't comply with your request, we will tell you why.
The right to access your personal information
You have the right to access the information that we hold about you. We will not usually charge you in relation to a request. We are happy to provide you with such details but in the interests of confidentiality, we follow strict disclosure procedures which may mean that we will require proof of identify from you prior to disclosing such information. We will usually provide your personal information to you in writing unless you request otherwise. Where your request has been made electronically (e.g., by email), a copy of your personal information will be provided to you by secure electronic means where possible.
The right to rectification
We take reasonable efforts to ensure that the personal information we are holding on you is accurate and up to date. However, if you do not believe this is the case, please contact us and we will promptly correct any information found to be incorrect.
The right to restriction of processing
In certain circumstances, you have the right to ask us to stop using your personal information, for example where you think that we no longer need to use your personal information.
The right to withdraw your consent
Where we rely on your consent to process your personal information, you have the right to withdraw such consent to further use of your personal information at any time.
The right to erasure
In certain circumstances, you have the right to request that your personal information is deleted such as where we no longer need your personal information for the purpose we originally collected it.
The right to object to direct marketing
You have a choice about whether or not you wish to receive marketing information from us and you have the right to request that we stop sending you marketing messages at any time. You can do this either by clicking on the "unsubscribe" button in any email that we send to you or by contacting us at support@astron.health.
The right to data portability
In certain circumstances, you have the right to request that we transfer any personal information that you have provided to us to a third party of your choice.
Rights relating to automated decision-making
We do not carry out any automated decision-making but in the event that this changes in the future, we will notify you.
The right to make a complaint with the Information Commissioner's Office (ICO)
You have a right to complain to the ICO if you believe that any use of your personal information by us is in breach of applicable data protection laws and regulations. You can visit the ICO's website at https://ico.org.uk for more information. Please note that lodging a complaint will not affect any other legal rights or remedies that you have.
Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. You should familiarise yourself with the privacy statement applicable to the website in question before use.
Contacting us
If you would like any further information about any of the matters in this policy or if you have any other questions about how we collect, store or use your personal information, you may contact our Data Protection Officer, Mr. Benjamin Whately, by email at ben@astron.health.
GDPR in Europe
Astron Health, which processes the personal data of individuals in the European Union and European Economic Area, in either role of 'data controller' or 'data processor', has appointed DataRep as its Data Protection Representative for the purposes of GDPR.
Updates to this policy
We may need to change this policy from time to time, for example, as the result of changes to law, technologies, or other developments. We will provide you with the most up-to-date notice and you can check this document periodically to view it.
This policy was last updated on 9 January 2025.