Privacy & cookies policies

Futura Medical are committed to protecting your personal privacy and choices. This information notice sets out the basis on which we process your personal data.

How we use your information

This privacy notice tells you what to expect when Futura Medical collects personal information. It applies to information we collect about:

• visitors to our websites;
• people who use our services, e.g. email or phone, complete a survey or provide feedback, subscribe to our alert service or request a publication from us; representatives from organisations with whom we have a working relationship, collaborators and peers;
• suppliers of goods and services (including professional advisors and auditors);
• Customers and complainants;

This notice does not cover our processing of Clinical Trial Participant's personal data, and you are referred to our Clinical Trials Privacy Policy for more information.

This notice does not cover our processing of personal data of job applicants and our current and former employees, interns, and contractors, and Trustees, you are referred to our Employee Privacy Policy for more information.

You will also find more information about:

• How to make a complaint;
• Your rights in relation to personal information about you (including the right of access);
• Links to other websites;
• Changes to this privacy notice; and
• How to contact us.

How we collect personal data:
Visitors to our websites

When someone visits our website www.futuramedical.com we use third party service, Google Analytics, to collect internet log information, including IP addresses. We only collect that data in order to analyse how people use the site, for example, high level details of visitor behaviour patterns such as the number of visitors to the various parts of the site. This type of internet log information, which may include your personal data in the form of your IP address, is processed for our legitimate interests, and for the benefit of our users, of providing a user friendly website for visitor's e.g. performance and debugging purposes, as well as being used to spot hacking attempts and issues in the system in order to help us improve the site and associated functionality. Google Analytics Log information is retained for a maximum of 14 months.

Although we automatically collect IP addresses, Futura Medical will only receive other personal information via our website when it has been provided explicitly by a website visitor, for example, when signing up to our alert service, or sending the organisation an email.

Use of cookies by Futura Medical

You can read more about how we use cookies on our Cookies page.

Website management and search engine

We use a third party provider, Jones and Palmer, to manage and host our website. As a result Jones and Palmer may be a processor on Futura's behalf of the information described above, which is collected or added via our website.

Jones and Palmer uses web servers that are based in the UK and all information will be stored on the web server that the user has visited. For more information, please see Jones and Palmer privacy policy. We have entered into appropriate terms of service with Jones and Palmer, including appropriate written processing terms as required by Article 28 of the GDPR.

People who email us

When you email us; the message, including any attachments, and all personal data will generally only be used to answer your query but may also be monitored and used for the organisation's legitimate interests of security and monitoring compliance with the organisation's policy. We will only add you to our marketing database if you have asked us to do so, or you have subscribed to our alert service. Email monitoring or blocking software may also be used.

In any case email messages will only be stored for as long as may be justified and lawful in the circumstances, including as may be necessary for legal, tax or regulatory reasons or for legitimate and lawful business purposes and in line with our retention schedules.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our email system; any email sent to Futura Medical is therefore sent at your own risk. Once we have received your information, we will use strict procedures and security features to prevent unauthorised access to it whilst it is stored in our systems.

People who complete post market surveys / feedback forms

We use a third party provider to facilitate surveys. Information submitted via a survey form is hosted by their servers and will be logged and anonymised by Futura Medical for statistical purposes. Information may also be immediately processed and sent to a relevant member of staff to review and/or action feedback.

Where surveys contain personal information they will be treated with the strictest confidence and will not be passed on to any third parties without the express consent of the original sender, unless we are under an obligation (for example a legal or regulatory obligation) to share the information. An example may be if you include information about an adverse reaction to one of our products in your survey responses and we are required by applicable regulations or codes of practice to pass that information on to the medicines regulator.

Where you provide personal information, it will only be used for the stated purposes of the survey and/or in providing a service you requested, for example when asking us for further information or giving feedback. We will not pass your details to any third party unless the law requires us to. Information relating to post market surveys / feedback will be retained for 25 years from receipt in accordance with requirements under the EU and/or UK clinical trials regulations.

People who subscribe to our alert service

Futura Medical offers services to the public including regular updates on news and information relevant to Futura Medical, its investors, products and related matters. We have to hold the details of anyone who opts to receive relevant information from us in order to provide that information. However, we only use these details to provide the service the person has requested. When people do subscribe to our services, they can cancel their subscription at any time and are given an easy way of doing this in each email we send. We use a third party provider, BrighterIR to manage our alert service subscriptions but we will not sell or pass on your details to any other third parties unless the law requires us to.

If you wish to unsubscribe and/or do not want us to use your data in this way you can unsubscribe by clicking the link included in each email we send or by emailing us directly.

Representatives, contributors, collaborators and peers

When organisations or individuals collaborate with us we will only use the information they supply, which may include names and contact details, for the purpose of the collaboration, for example administration of meetings. As such the most likely lawful grounds for our processing such personal data may be performance or preparation to perform a contract with the data subject where our collaborators are acting in their individual capacity. Alternatively, the processing may be based on Futura Medical's legitimate interests. Typically these legitimate interests will include taking part in collaborations, researching the effects of new and existing products and achieving the commercial aims of the business as well as ensuring the continued relevance, efficacy and safety of our products. Where necessary in order to keep you properly informed we will provide more detailed fair processing notices at the time of collection of such data.

Suppliers of goods and services

When companies provide goods or services we will only use the information they supply, which may include names and contact details for individuals, to maintain our working relationship and contractual arrangements. This may include monitoring of the service and levels of service provided to Futura Medical. In most cases, unless the supplier is an individual contracting with Futura Medical (in which case performance of a contract will apply), we will usually rely on our legitimate interests in processing personal data of our suppliers' employees. Such legitimate interests may include pursuit of the commercial aims and general conduct of our business.

Customers Complainants and enquirers

When we receive a complaint from a person we create a file or a record containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint, as well as the substance of the complaint and details of any specific incidents reported (which may include any special category data you have provided to us, such as information about your health or any injury you have sustained).

We will only use the personal information we collect to process the complaint and to check on the level of service and/or products we provide. We may need personal information for regulatory requirements, we may also be required to pass personal information onto the relevant regulatory body. We will make this information anonymous or pseudonymous before sharing with such third parties where it is appropriate and lawful to do so. We may compile and publish statistics showing information on the number of complaints we receive, but not in a form which identifies anyone.

We will endeavour to keep the complainant's identity strictly confidential where appropriate and legal to do so. If a complainant doesn't want information identifying him or her to be disclosed to staff involved in the complaint, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files/records in line with our retention policy. Personal information for product complaints, including confidential health information, is retained for 15 years in accordance with regulatory, legal and insurance requirements and will be protected in accordance with our internal complaints procedures. Information relating to other types of complaints will be retained for two years from disclosure. It will be retained in a secure environment and access to it will be restricted according to the 'need to know' principle.

Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide. All product or clinical trial enquiries will be addressed within one month of receipt and all personal information shared will be not be retained after the enquiry is closed out unless we are required to retain it by applicable law, regulations or codes of practice.

Some enquiries may be forwarded onto Optimum Strategic Communications who look after our Investor and Public Relations for them to respond on our behalf.

Research Participants

If you require information about how we deal with the personal data of participants in our clinical trials and other research projects, please refer to our separate Research Participant's Privacy Policy available here.

How to make a complaint

Futura Medical tries to meet the highest standards when collecting and using personal information. For this reason, we take any such complaints very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of the Futura Medical's collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this or any specific questions or objections in relation to the use of your information in the ways which have been described should be sent to Futura Medical at the address detailed in the 'How to contact us' section below.

We would also encourage you to contact us if you are unhappy with any aspect of the way in which we deal with a request for information we hold about you. In the first instance we hope you will contact Futura Medical (our details are given in the section: 'How to contact us'). You can contact or complain to The Information Commissioner at any time, current details can be found at https://ico.org.uk/make-a-complaint/ or use the details below:

The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Telephone: 0303 123 1113

If you disagree with the Information Commissioner's decision and feel we have failed to disclose information without good reason you may apply to a Court for disclosure.

Your Rights
Access to personal information

Futura Medical tries to be as open as it can be in terms of giving people access to their personal information.

You have the right to access personal data held about you. Your right of access can be exercised at any time by contacting Futura Medical at the address detailed in the 'How to contact us' section below.

If we do hold personal data about you we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible and easily accessible form. There are some exceptions to this and we may refuse access where by providing access, we would reveal information which relates to and identifies another person unless that person has given consent to that disclosure to you. In such cases we will try to provide your records with any such information removed and we would inform you if this is the case.
• we will not usually charge a fee and will aim to respond promptly and in any case within one month of receiving your request.

In certain circumstances you may also have the right to ask us not to process your personal data. You can exercise your right to prevent such processing at any time by contacting us at the address detailed in the 'How to contact us' section below. We will let you know how we are going to deal with your request to stop processing, and if we are refusing that request we will provide you with information of our grounds for refusal.

To make a request to Futura Medical for any personal information we may hold you need to put the request in writing and provide adequate information to verify your identity and enable your records to be located (for example full name, address, date of birth, etc.).

If you have any difficulty in completing a request for information we hold about you, please contact us for assistance.

If we do hold information about you, you can ask us to correct any mistakes. If your contact details or other personal data changes, or if you become aware of information about you that is out of date, please notify us as soon as possible so we can keep our records up to date.

All reasonable efforts will be made to verify your identity before carrying out any disclosures of information or other rights requests you have made. These efforts may include the request for additional personal information if necessary.

The following is a list of the other rights you enjoy under the data protection legislation. If you wish to exercise your rights in respect of the personal data Futura Medical holds about you, please contact the Privacy Manager at Futura Medical , at privacy.manager@futuramedical.com. Please note that under the legislation we may not always have to comply with your request to exercise your rights, whether we are required to comply with a particular right or not will depend on the basis for our processing. If we do refuse a request to exercise your rights under the data protection legislation we will always provide you with reasons justifying that decision.

• Right to rectification
• Right to erasure (right to be forgotten)
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to not be subject to automatic decision making.

You can find out more about your rights as a data subject by visiting The Information Commissioner's Website at https://ico.org.uk/your-data-matters/

Disclosure of personal information by Futura Medical

Only authorised individuals working for or on-behalf of Futura Medical have access to information unless otherwise specified in this or other privacy notices we have published on this website and/or provided to you by other means. We will not disclose personal data to any other third parties without your permission unless:

• there are exceptional circumstances, such as if the health and safety of others is at risk;
• we are under a duty to disclose or share your data in order to comply with any legal obligation. This may include disclosures on the Futura Medical website, Annual Report to comply with Market Abuse Regulations (MAR) and Corporate Governance Code. Other disclosures  may also include to the courts, police forces or local and central government;
• in order protect our legitimate interests to enforce or apply our terms and conditions and other agreements; or to protect the rights, property, or safety of the organisation, our contacts, or others. This may include disclosures to professional advisors, auditors regulatory bodies, tax authorities, financial organisations and/or legal representatives;
• the disclosure is to third parties working under contract to Futura Medical and acting as a data processor for the organisation. These companies are required to only process information in line with our instructions, for example Jones and Palmer.

Please contact us if you would like further information on:

• agreements we have with other organisations for sharing information;
• factors we shall consider when deciding whether information should be disclosed and circumstances where we can pass on personal data without consent for example, to prevent and detect crime and to produce anonymised statistics;
• our instructions to staff on how to collect, use and delete personal data; and
• how we check that the information we hold is accurate and up to date.

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. How other organisations or websites capture, store and use personal information or site visitor information is outside our control. We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated in October 2019. This statement is subject to change at any time. Whenever a change occurs, an announcement will be made in the news section of www.futuramedical.com.

How to contact us

Questions, comments and requests regarding this privacy policy are welcomed. If you want to request information about our approach to protecting your personal data or about this privacy policy you can email us or write to us at the address below.

The Data Controller, responsible for keeping your information secure in relation to the above services is:

Futura Medical Ltd
Surrey Technology Centre
40 Occam Road
Guildford
Surrey, GU2 7YG
Email: privacy.manager@futuramedical.com
Telephone: +44 (0) 1483 685670

Futura Medical has nominated a Board level representative for Data Protection and a person responsible to lead on Data Protection matters: this is Futura Medical's Office Manager, who can be contacted using the details above.

Acknowledgement

The ICO's privacy notice has been used and adapted under open governance license to draft this notice in an attempt to follow their lead as the regulator for Data Protection in the UK.

Use of cookies by Futura Medical

Cookies are used by us to improve your experience when using our website and to track usage (for example what pages are being viewed) to help us understand how the site is being used. We do not use what people commonly refer to as personal information in the cookies and only track less obviously personal data such as your IP addresses and/or the unique device identifier for the computer you are using. These can be session cookies which are deleted when you close your browser and/or persistent cookies which remain on your computer for a longer period of time.

Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, click here to read more about cookies.

To delete or stop cookies being placed on your computer refer to the help menu on your internet browser. In a few cases blocking cookies may reduce the functionality of our website or prevent access to it depending on your chosen browser options.

To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.

How to change your cookie settings

Futura Medical are committed to protecting your personal privacy and choices. This information notice sets out the basis on which we process your personal data collected for Clinical Trials / Clinical Investigations and research.

Who we are

We are Futura Medical Developments Limited company number 03456088 of registered address Surrey Technology Centre, 40 Occam Road, Surrey Research Park, Guildford, Surrey, GU2 7YG - this policy is written on behalf of us and our parent company (referred to in this policy as us, our, we and Futura).

If you need to contact us, our details appear below How to contact us.

Purpose of this Policy

The purpose of this policy is to help you understand what types of personal data we collect about you and why we process it. It gives you information about our lawful grounds for processing your personal data, your rights in relation to your personal data and how to make a complaint. It also tells you about when we might share your personal data with others, the steps we take to keep your personal data private, safe and secure and how long we have to keep your information on file.

This policy only relates to personal data collected for Clinical Trials, Clinical Investigations , related research and Futura's regulatory compliance, and it is one of a number of information documents you will receive, and need to read in detail, to help you understand your role and rights as a clinical trial participant. If you are an employee, potential employee, a customer or a website user of Futura, please refer to our other privacy policies here:

Employee privacy policy and

General website privacy policy

If you have any questions about this policy once you have read it or need more information about Futura and how we handle your personal data, please contact our Privacy Manager How to contact us.

Types of personal data and how we obtain it

The law governing personal data changed across the European Union, including the UK, in May 2018; when the General Data Protection Regulation ("GDPR") and the Data Protection Act 2018 came into force. The new law increases the rights of personal data subjects (see the section entitled Your rights for more information). It also increases the responsibilities of companies collecting and handling personal data.

Personal data is any information which identifies an individual living person. It is data from which a person can be identified directly; but also includes data where the person can only be identified indirectly from that information in combination with other information. Personal data may also be special category personal data, including information about a person's health, sex life or sexual orientation. Special category data is considered to be more sensitive than other types of personal data and we can only process and collect it in more limited circumstances.

On the basis of Good Clinical Practice (GCP/ISO14155) Futura Medical will collect CV’s of Investigators, sub investigators and other applicable site personnel.

On the basis of legitimate interest for assessing candidates’ proficiency, Futura Medical will also collect the CV’s for third party trial team members and committee members.

As a Clinical Trial/Clinical investigation participant you will be providing a lot of personal data, including special category data, to the healthcare professionals you encounter at the Clinical Trial/Clinical investigation Site (typically the hospital or clinic where you attend appointments related to the clinical trial and Futura's product(s)). You will need to provide the Clinical Trial/Clinical investigation Site with information including your name, address, date of birth, height, weight and gender. Other types of information which may be gathered about you by the Clinical Trial/Clinical investigation Site might include access to your medical records, information about any ongoing health conditions, information about your sexual partners and their health, other information on your sex life and factors which may affect it. Some or all of that personal data about you may be shared with us by the Clinical Trial/Clinical investigation Site, or you may even provide such information to us directly yourself.

In the course of your participation in the trial, additional personal data about you may be generated or collected (including information you report to the Clinical Trial/Clinical Investigation Site, as well as their opinions about you and how you have responded to our medicine(s)). All of the personal data relevant to you as a trial participant may be generated, collected and shared by your healthcare professionals, the Clinical Trial/Clinical Investigation Site, the Clinical Contract Research Organisation (CRO) which oversees the study or by us, Futura (we are known as the Sponsor of the Clinical Trial/Clinical Investigation, being the company responsible for the medicine being tested). Typically in any Clinical Trial/Clinical Investigation, and to comply with the rules and regulations governing such studies, personal data about the participants (you) will be shared between the healthcare professionals/Clinical Trial/Clinical Investigation Sites (as controllers of your personal data, making decisions about how your personal data is collected and shared), the appointed CRO (usually as processors of your personal data acting under instructions from the Sponsor about what to do with your personal data) and the Sponsor (us/Futura, also as a controller of your personal data as we decide how and why to use your personal data, within the parameters set by the applicable laws and regulations).

Futura will treat all data we receive, generate or collect about you in accordance with the data protection legislation and other confidentiality obligations. We will also keep your personal data to a minimum and relevant for achieving the aims of the study, regulatory approvals of our medicines, medical research or in pursuit of pharmacovigilance and good medicines safety. Wherever possible we, and our study collaborators, will pseudonymise your personal data when sharing and processing that data. Pseudonymised data is where information about a person is identified using a unique identifier (e.g., a study participant number) instead of the person's name, address or date of birth; so the data can only be linked to an identified individual if you have access to additional information (which is held separately from the pseudonymised data). Pseudonymisation can help reduce privacy risks by making it more difficult to identify individuals, but it is still personal data and will be treated by us in accordance with the GDPR and this privacy policy.

Why we process your personal data -
lawful grounds and special conditions

The reason we collect and process your personal data is for the proper conduct of our Clinical Trials/ Clinical Investigations, to monitor the efficacy and safety of our medicines, to conduct other research into our medicines and treatment methods and to support our applications for regulatory approval of our medicines. It is also to satisfy our obligations to monitor and report adverse events and the long term effects of medicines.

The lawful grounds on which we rely in order to collect and process your personal data are that it is necessary to comply with our legal and regulatory obligations (see section entitled Your rights for more detail on some of the legislation we are subject to and rely on to justify our processing). In summary, it is the framework of legislation, regulations and codes of practice, which apply in your country/the country in which you participate in our Clinical Trial/Clinical Investigation and which govern the conduct of Clinical Trials/Clinical Investigation , the approval of medicines and the monitoring of medicines safety and efficacy.

Much of the processing we carry out on your personal data is also necessary for achieving our legitimate interests, and we have made appropriate assessments that such processing does not have an adverse effect on your interests or fundamental freedoms and rights as a data subject. Some of the legitimate interests on which we rely in processing your personal data from Clinical Trials/Clinical Investigations include pursuit of clinical research, development of safe, effective and commercially viable products, opening up and pursuing appropriate lines of communication with medicines regulators, medical researchers, healthcare professionals and our contractors, prevention of fraud and criminal activity, achieving compliance with our approved Clinical Trial/Clinical Investigation protocols and maintaining secure and effective IT systems and networks (e.g., by storing your personal data in secure cloud environments with adequate back-up and disaster recovery provision to ensure the security and integrity of your personal data).

Your participation in our Clinical Trial/Clinical Investigation may also be considered as a contract for us to provide you with goods and services. Where this analysis applies, we will have an additional lawful ground to justify our processing of your personal data, being performance of, or preparation to perform, a contract.

As explained above, the Clinical Trial/Clinical Investigation will result in the collection, generation and processing of a lot of special category data about participants. Where we process special category data about you, in addition to the lawful grounds set out above, we will also be relying on Schedule 1 Part 1 of the Data Protection Act 2018 and GDPR Article 9(i) and (j) for our special conditions for doing so. The specific special conditions we rely on in this respect include that the processing is necessary for conduct of scientific research (Art 9(j)) and in the public interest for ensuring high standards of quality and safety of medicinal products (Art 9(i)). We have complied with the applicable member state laws governing such activities and carry out the processing in a proportionate way with appropriate safeguards in place, taking account of your rights as an individual (as described in more detail elsewhere in this policy - see sections on your rights, and how we protect your personal. We may also, in certain circumstances, rely on additional special conditions such as establishment, exercise or defence of legal claims (Art 9(f)) or for the purposes of preventive medicine, medical diagnosis, and provision of healthcare (Art 9(h)).

In certain limited circumstances we may alter the purpose for which we are processing your personal data from that for which it was collected. We will only do so if that is lawful under GDPR and justified for example on medical research or medicines safety grounds.

Please note that the CRO and Clinical Trial Site/Clinical Investigation Site healthcare professional involved with your Clinical Trial/Clinical Investigation will have their own privacy policy explaining what data they are collecting and how they are using it. Please review those policies for additional information about the handling of your personal data by our collaborators. While we ensure appropriate processing agreements are in place where required for compliance with the GDPR, we are not directly responsible for the actions of third party collaborators where they are acting independently of Futura. See the information below on our current clinical trials if you are unsure of the identity of the CRO or our other collaborators. If you need further assistance in this respect, please contact our Privacy Manager who will be happy to help.

Who we share your personal data with

As explained in the section entitled "Types of personal data and how we obtain it" your personal data is shared between the healthcare professionals running the study on our behalf, the Clinical Trial/ Clinical Investigation Site, the CRO and us (Futura, the study Sponsor). Your personal data, [albeit in psuedonymised form,] may also form part of our medicines marketing authorisation application in different countries, it may be entered into the European and other Adverse Event Reporting databases. It may also be shared with the various healthcare providers, regulators, advisors and insurers we deal with in order to ensure our Clinical Trials/Clinical Investigation , research and medicines are safe, appropriate and effective and to achieve the general commercial aims of our business (such as investment or sale of the business). Wherever possible, we will share only non-identifiable data with such third parties. But if your personal data is required to be included for legitimate and justifiable reasons, then it will be included in such disclosures of information in accordance with our obligations under the relevant legislation.

Another less direct form of sharing your personal data includes where we use third party service providers to help process your personal data. Wherever that happens, we will enter into written agreements with those service providers to ensure they process your personal data appropriately and in accordance with the data protection legislation and our instructions. Some examples of where others may be involved in processing your personal data on our behalf include our group companies, our IT systems and infrastructure providers, our CROs, and consultants and analysts involved in testing and summarising findings and results from our Clinical Trials/Clinical Investigations.  A list of our current third party contractors involved in processing personal data of Clinical Trial/Clinical Investigation participants, along with information on what processing they carry out on our behalf is available in the Futura Data Protection Impact Assessment (DPAI) for each new Clinical Trial/Clinical Investigation and is available on request.

Your personal data may also be processed by national or international regulators, enforcement agencies, public authorities, police and courts, but we will only share your personal data with such bodies where it is appropriate and required under legislation, regulation or order of an authorised body.

Where your personal data might be transferred

The data protection legislation requires that we do not transfer your personal data outside the EU unless there are appropriate safeguards in place to protect your data and your rights. A data Protection Impact Assessment (DPIA) document will be generated for each clinical study which will detail the names of companies and brief information on the types of data a processing they carry out in relation to clinical trial participants data. All of the data is pseudonymised before being transferred. All of the companies involved are subject to the appropriate safeguards (either as a member of the EEA and subject to an adequacy decision, or by being bound by us to model clauses/standard contractual clauses approved by the European Commission for the purposes of international transfer of personal data.

How we protect your personal data and retention periods

We have in place a number of cybersecurity and other measures designed to protect your personal data and privacy. A key measure, discussed in more detail elsewhere in this policy, is pseudonymising your data. We generally only process and share your personal data when it is in pseudonymised form. Another measure we take is making sure we only collect and keep your data where it is proportionate to do so. We also minimise our records and we are careful about what information we share about you and how long we keep it. We keep our IT systems up to date, and only use service providers with a proven track record in the Clinical Trials/Clinical Investigations field and who work to high recognised standards (for example ISO27001). There are very rigorous international standards governing Clinical Trials/Clinical Investigations work, to ensure confidentiality and regulatory control of human medicines testing. As a result, much of what we and others involved in the clinical trial do accords with the requirements of the GDPR.

As explained elsewhere in this policy, we may have to keep your personal data and information about your involvement in our Clinical Trial/Clinical Investigation on record for a long time. This is the case even if you withdraw from the trial or ask us to stop processing your personal data. Because of the legislation and regulations governing Clinical Trials/Clinical Investigations, medicines safety and marketing authorisations, we are required to retain all of your personal data as a clinical trial participant for a period of 25 years after the study has finished pursuant to EMA Guideline on GCP compliance. This is so we can contact you in the unlikely event that a long term effect of the medicine is discovered. For other data it may be two years from the date the marketing authorisation was granted. In any event we will keep our retention periods and our records of your personal data under review to record retention proportionate and to the minimum necessary to achieve the purpose required.

Your rights

A key change brought in by the new data protection legislation is that we will no longer be relying on your consent as the lawful basis for our personal data processing, although we will still need your consent for other things (e.g., your participation in our Clinical Trial/Clinical Investigation, access to certain medical records and other confidentiality considerations). This means that once you agree to take part in one of our Clinical Trials/Clinical Investigations, your rights under the GDPR to object to our continued processing of your personal data or to ask us to delete your personal data will be limited. This is because the GDPR sits alongside and has to be read in conjunction with other legislation, regulations and codes of practice governing what Futura and our collaborators do in relation to Clinical Trials, Clinical Investigations, research and medicines approvals.

Typically, your data protection rights will be limited where continued retention of records and processing is required for good reasons (e.g., public safety or wider social benefit). Some examples include keeping medicines and research safe, promoting innovation in medicines, achieving good pharmacovigilance and adverse event reporting, maintaining public confidence in the safety and efficacy of Clinical Trials/Clinical Investigations and approval of medicines and monitoring the long term effects of medicines (keeping you informed if there are any safety concerns).

This doesn't mean your personal data will be shared publicly, but it may mean that we have to keep your information on file for long periods of time (even if you ask us to delete it) or that we may have to share certain of your personal data with regulators, healthcare providers and insurers - but we will always act in accordance with our obligations under the legislation and have appropriate security and confidentiality measures in place to protect your privacy (as to which see the section entitled How we protect your personal data). Other sources of our obligations may include the EU Clinical Trial Directive (2001/20/EC) (and its national implementing or equivalent legislation in the countries in which we conduct trials), from 2019 the new EU Clinical Trial Regulation (No 536/2014) (and equivalent national implementing legislation), the UK Policy Framework for Health and Social Care Research, the EU Directives relating to pharmacovigilance (201/84/EU, 2012/26/EU and 2001/83/EC) and the EU Regulations on authorisation and supervision of medicines (1235/2010, 1027/2012 and 726/2004).

Under the data protection legislation, individuals have the following rights in relation to their personal data:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

However, as mentioned above certain of your rights may be limited where we have overriding legal or regulatory obligations. Your rights to request deletion of your data or to restrict or object to processing may not apply. You can always request to exercise your rights, and we will provide you with information of the grounds for our refusal if we are not going to comply with a particular request you have made.

We will always try to reduce the amount of personal data we keep to the minimum necessary to achieve the required purpose, and we use measures such as pseudonymisation and the security measures discussed above to protect your privacy even where your personal rights to insist on restricted processing or deletion are limited.

You can find out more about your rights under the data protection legislation by visiting https://ico.org.uk/your-data-matters/ or contacting the Information Commissioner's Office to discuss your concerns https://ico.org.uk/make-a-complaint/.

How to complain

We hope you will approach Futura in the first instance if you have any concerns or complaints about how we collect or use your personal data. Please contact the Privacy Manager at the contact points listed below How to contact us. You can complain direct to the Information Commissioner's Office at any time - please go to https://ico.org.uk/make-a-complaint/ where you will find details on how to complain and up to date contact details for the ICO. If you are based outside the UK you can contact your local Data Protection Authority.

Recent clinical trials (including CRO and Clinical Site details)

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated in September 2021. This notice is not a contract and is subject to change at any time. Whenever a change occurs, an announcement will be made in the news section of www.futuramedical.com.

How to contact us

Questions, comments and requests regarding this privacy policy are welcomed. If you want to request information about our approach to protecting your personal data or about this privacy policy you can email us or write to us at the address below.

The Data Controller, responsible for keeping your information secure in relation to the above services is:

Futura Medical Ltd
Surrey Technology Centre
40 Occam Road
Guildford
Surrey, GU2 7YG
Email: privacy.manager@futuramedical.com
Telephone: +44 (0) 1483 685670

Futura Medical has nominated a Board level representative for Data Protection and a person responsible to lead on Data Protection matters: this is Futura Medical's Privacy Manager, who can be contacted using the details above.

What Is the Purpose of this Document?

Futura Medical Developments Limited is a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to current and former employees, workers and contractors (this notice along with our general website privacy policy is also relevant to prospective employees). This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

Depending on when you joined Futura, your contract of employment (or other documents) may state that we rely on your consent when processing your personal data. Since the introduction of the new data protection legislation in May 2018 that is no longer correct. As explained in more detail below, we do not rely on consent for most of the processing we do. We have other lawful grounds for processing your personal data, as explained in How we will use information about you section. Some of your rights to restrict or object to our processing or to request deletion of your personal data may be limited.

Data Protection Principles

The Kind of Information We Hold About You

We will collect, store, and use the following categories of personal information about you:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Date of birth.
• Gender.
• Marital status and dependants.
• Next of kin and emergency contact information.
• National Insurance number.
• Bank account details, payroll records and tax status information.
• Salary, annual leave, pension and benefits information.
• Start date and, if different, the date of your continuous employment.
• Leaving date and your reason for leaving.
• Location of employment or workplace.
• Copy of passport
• Copy of Driving licence
• Recruitment information (including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process).
• Employment records (including job titles, work history, working hours, holidays, training records and professional memberships).
• Performance information.
• Disciplinary and grievance information.
• CCTV footage and other information obtained through electronic means such as swipe card records through third parties may be collected.
• Information about your use of our information and communications systems.
• Results of HMRC employment status check, details of your interest in and connection with the intermediary through which your services are supplied.

We may also collect, store and use the following more sensitive types of personal information:

• information about your race or ethnicity, religious beliefs, sexual orientation and political opinions.
• information about your health, including any medical condition, health and sickness records, including:
• where you leave employment and under any share plan operated by a group company the reason for leaving is determined to be ill-health, injury or disability, the records relating to that decision;
• details of any absences (other than holidays) from work including time on statutory parental leave and sick leave; and
• where you leave employment and the reason for leaving is related to your health, information about that condition needed for pensions and permanent health insurance purposes.
• information about criminal convictions and offences are not currently collected at this moment in time, however we will notify you in writing if this position changes.

How Is Your Personal Information Collected?

We collect personal information about employees, prospective employees, workers and contactors through the application and recruitment process, either directly from candidates or sometimes from an employment agency or a background check provider. We may sometimes collect additional information from third parties including former employers, and other background check agencies.

We will collect additional personal information in the course of job-related activities throughout the period of you working for us.

How We Will Use Information About You

Situations in which we will use your personal information

We need all the categories of information in the list above primarily to allow us to perform our contract with you and to enable us to comply with legal obligations, such as satisfying HMRC reporting requirements, payment of tax and national insurance and satisfying right to work requirements. In some cases we may use your personal information to pursue our legitimate interests, provided your interests and fundamental rights do not override those interests. Such legitimate interests include pursuit of the commercial aims of our business, protecting the rights and interests of our other employees, investors and customers as well as activities such as detecting and preventing potential fraud and criminal activity. We may also process your information (including special category data) in preparation for the defence or pursuit of legal claims. The situations in which we will process your personal information are listed below.

• Making a decision about your recruitment or appointment. CV, application form.
• Determining the terms on which you work for us.
• Checking you are legally entitled to work in the UK.
• Paying you and, if you are an employee or deemed employee for tax purposes, deducting tax and National Insurance contributions (NICs).
• Providing the following benefits to you: Life Insurance, Private Medical Insurance and Pension.
• Inviting you to participate in any share plans operated by a group company.
• Granting awards under any share plans operated by a group company.
• Share dealing requests and granting or refusing permission to deal Futura Medical plc shares.
• Administering your participation in any share plans operated by a group company, including communicating with you about your participation and collecting any tax and NICs due on any share awards.
• Liaising with the trustees or managers of a pension arrangement operated your pension provider and any other provider of employee benefits.
• Administering the contract we have entered into with you.
• Business management and planning, including accounting and auditing.
• Conducting performance reviews, managing performance and determining performance requirements.
• Making decisions about salary reviews and compensation.
• Assessing qualifications for a particular job or task, including decisions about promotions.
• Gathering evidence for possible grievance or disciplinary hearings.
• Making decisions about your continued employment or engagement.
• Making arrangements for the termination of our working relationship.
• Education, training and development requirements.
• Dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.
• Ascertaining your fitness to work.
• Managing sickness absence.
• Complying with health and safety obligations.
• To prevent fraud.
• To monitor your use of our information and communication systems to ensure compliance with our IT policies.
• To ensure network and information security, including preventing unauthorised access to our computer and electronic communications systems and preventing malicious software distribution.
• Equal opportunities monitoring.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a benefit), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of our workers).

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How We Use Particularly Sensitive Personal Information

Situations in which we will use your sensitive personal information

In general, we will not process particularly sensitive personal information about you unless it is necessary for performing or exercising obligations or rights in connection with employment. On rare occasions, there may be other reasons for processing, such as it is in the public interest to do so. The situations in which we will process your particularly sensitive personal information are listed below. We have indicated the purpose or purposes for which we are processing or will process your more sensitive personal information.

• We will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments, to monitor and manage sickness absence and to administer benefits including statutory maternity pay, statutory sick pay, pensions and permanent health insurance. We need to process this information to exercise rights and perform obligations in connection with your employment.
• We will use information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In limited circumstances, we may approach you for your explicit written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Information About Criminal Convictions

We generally do not process criminal convictions data but in the future we may do, however we will notify you in writing if this position changes.

Automated Decision-making

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

Data Sharing

Why might you share my personal information with third parties?

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

Which third-party service providers process my personal information?

"Third parties" includes third-party service providers (including contractors and designated agents) and other entities within our group. The following activities are carried out by third-party service providers: pension administration, benefits provision and administration, IT services.

We may, where necessary, share personal data with your chosen pension provider although you will normally be in contact with your pension provider direct. You should refer to your pension provider's privacy policy for more information.

We will share personal data relating to your participation in any share plans operated by a group company with third party administrators, nominees, registrars and trustees for the purposes of administering the share plans. The following third party service providers process personal data about you for this purpose: Liberum, Analyst and Broker and Link Asset, Share Registrars For PDMR (Executive and non executive Directors (employees), this is also published through RNS disclosures

How secure is my information with third-party service providers?

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

What about other third parties?

We may share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

We may also need to share your personal information with a regulator or to otherwise comply with the law. This may include making returns to HMRC, disclosures to stock exchange regulators (including a Regulatory News Service) and disclosures to shareholders such as directors' remuneration reporting requirements.

Transferring information outside the EU

We do not transfer the personal information we collect about you outside the EU.

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data Retention
How long will you use my information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from the Office Manager. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with our data retention policy, applicable laws and regulations.

Your Rights
Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Privacy Manager in writing to privacy.manager@futuramedical.com

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to Withdraw Consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Privacy Manager. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Data Protection Officer

We have appointed a data privacy manager to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Privacy manager. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

Changes to this Privacy Notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this privacy notice, please contact the Privacy Manager on privacy.manager@futuramedical.com