EarlyCDT website
Privacy Notice
VERSION ADOPTED 22 AUGUST 2023
VERSION ADOPTED 22 AUGUST 2023
Freenome Ltd. (“Freenome,” “we,” or “us”) owns and manages www.EarlyCDT.com (“Website”) and is committed to protecting the privacy and security of your personal information. This notice applies to individuals from whom or about whom we collect personal information (“you” or “your”) through your use of the Website, in accordance with applicable data protection laws and regulations, including without limitation the EU GDPR and the UK GDPR.
Freenome is the “data controller” of your personal data. This means that we are responsible for deciding how we hold and use your personal information. We are required under data protection legislation to notify you of the information contained in this privacy notice. This notice does not form part of any contract of employment or other contract to provide goods or services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.
It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
We will comply with data protection law. This means that the personal information we hold about you must be:
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are "special categories" of more sensitive personal data which require a higher level of protection, such as information about a person's health or sexual orientation. We will not collect any special categories of personal data through the Website.
We may collect, store, and use the following categories of personal information about you:
We use different methods to collect data from and about you including through:
Automated technologies or interaction. As you interact with our Website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.
Technical Data from third parties. We may receive Technical Data or Usage Data from the following third parties:
We may collect, store, and use the following categories of personal information about you:
(a) analytics providers
(b) advertising networks and
(c) search information provider.
Directly from you. We collect the personal information you include in your Inquiry Data when you voluntarily submit it to us.
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
We may also use your personal information in the following situations, which are likely to be rare:
How and what categories of information listed above in paragraph 3 we use depends on your relationship to us, as listed in the following table:
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest |
|---|---|---|
| To administer and protect our business. | (a) Technical (b) Inquiry | (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). (b) Necessary to comply with a legal obligation. |
| To deliver relevant website content and advertisements to you. | (a) Technical | Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, and to develop our business). |
| To use data analytics to improve our website, products/services, marketing, customer relationships and experiences. | (a) Technical (b) Usage | Necessary for our legitimate interests (to keep our website updated and relevant, and to develop our business). |
| To provide you with information about goods or services that may be of interest to you or to respond to your inquiries. | (a) Technical (b) Usage (c) Inquiry | Necessary for our legitimate interests (to develop our products /services and gour business). |
| Purpose/Activity | To administer and protect our business. |
| Type of data | (a) Technical (b) Inquiry |
| Lawful basis for processing including basis of legitimate interest | (a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). (b) Necessary to comply with a legal obligation. |
| Purpose/Activity | To deliver relevant website content and advertisements to you. |
| Type of data | (a) Technical |
| Lawful basis for processing including basis of legitimate interest | Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, and to develop our business). |
| Purpose/Activity | To use data analytics to improve our website, products/services, marketing, customer relationships and experiences. |
| Type of data | (a) Technical (b) Usage |
| Lawful basis for processing including basis of legitimate interest | Necessary for our legitimate interests (to keep our website updated and relevant, and to develop our business). |
| Purpose/Activity | To provide you with information about goods or services that may be of interest to you or to respond to your inquiries. |
| Type of data | (a) Technical (b) Usage (c) Inquiry |
| Lawful basis for processing including basis of legitimate interest | Necessary for our legitimate interests (to develop our products /services and gour business). |
If you fail to provide certain information when requested, you may not be able to use the Website, or we may be prevented from complying with our legal obligations.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if this position changes.
We may have to share your data with third parties, including third-party service providers and other entities such as our affiliates or our parent company, Freenome Holdings, Inc. We require third parties to respect the security of your data and to treat it in accordance with the law. We may transfer your personal information outside the UK. If we do, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the relationship with you or where we have another legitimate interest in doing so.
How secure is my information with third‑parties?
All our third-parties with whom we share personal information are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may transfer the personal information we collect about you to countries outside the UK, including the US, in order to provide the Website to you. However, we will undertake such a transfer only if (1) there is an adequacy decision by the UK Secretary of State that confirms the other country provides an adequate level of protection for your personal information; or (2) we have put in place appropriate measures to ensure that your transferred personal information is treated in a way that is consistent with and which respects the EU laws on data protection, such as those addressed in paragraph 21, below.
Freenome’s Participation in The Data Privacy Framework
We comply with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF,” collectively, all three frameworks are referred to as the “DFP Frameworks”) as set forth by the U.S. Department of Commerce, which has jurisdiction over our compliance with the DPF Frameworks. We have certified to the U.S. Department of Commerce that we adhere to the DPF Frameworks.
If there is any conflict between the terms in this privacy policy and the DPF Principle, the DPF Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
In compliance with the DPF Frameworks we commit to resolve your complaints regarding our handling of your personal data received in reliance on these Frameworks. Should you have a complaint, please contact using the information listed below, in the “How to Contact Us?” section.
If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit JAMS for more information or to file a complaint. JAMS is internationally based, and the services provided by JAMS are provided at no cost to you.
Please note that under certain circumstances, you may be able to invoke binding arbitration to handle complaints related to the DPF Principles not resolved by the other mechanisms listed above, i.e., contacting us or contacting JAMS. For more information about binding arbitration, please visit: https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2.
We have put in place measures to protect the security of your information. Details of these measures are available upon request. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
The following sets forth the privacy rights you may have regarding the personal data we process about you. However, if you exercise any of these rights, you may have to provide us with more personal data than what we have already collected. Doing so may make you subject to other privacy notices, which we will provide to you when required.
Your rights in connection with personal information. Under certain circumstances, by law you have the right to:
No fee usually required. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please notify us in writing. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
We have appointed a data privacy manager to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the data privacy manager. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance using the contact details above so that your concerns may be dealt with via our internal complaints procedure.
Freenome Ltd.
Attn: Privacy Manager
MediCity – D6 Building
1 Thane Road, Nottingham, UK NG90 6BH
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.