Privacy Policy

1. Introduction

This privacy notice explains how Curistica Ltd (“we”, “us”, “our”) collects, uses, discloses, and safeguards your personal data when you visit our website, use our online tools, engage with us as a client, or receive marketing communications from us. It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and how you can exercise them.

We are committed to being transparent about how we handle your personal information. We do not collect or process special category data.

2. Who We Are

Curistica Ltd (Company number 14679626) is a provider of professional services relating to clinical safety assurance and healthcare technology governance. We are the data controller for the personal information described in this notice, meaning we decide how and why your personal data is processed.

Email: privacy@curistica.com 

Address: Unit A6, Dittons Road, Polegate, England, BN26 6QH, United Kingdom

3. Data Protection Contact

For any questions regarding this privacy notice or our data protection practices, please contact us at privacy@curistica.com.

We will respond to your enquiry within one calendar month.

4. What Personal Data We Collect

We collect different types of personal data depending on how you interact with us. The table below sets out the categories of data we collect for each processing activity.

5. Why We Use Your Personal Data and Our Lawful Basis

Under the UK GDPR, we must have a lawful basis for each processing activity. The table below sets out our purposes and the specific lawful basis we rely on for each.

Where we rely on legitimate interests, we have carried out a balancing test to ensure that your rights and freedoms are not overridden. You have the right to object to processing based on legitimate interests at any time (see Section 10).

6. Cookies

Our website uses cookies to help us understand how visitors use the site and to improve your experience. We use Google Analytics, which places cookies on your device to collect information about your browsing behaviour in an anonymised and aggregated form.

We will ask for your consent before placing any non-essential cookies on your device. You can withdraw your consent or manage your cookie preferences at any time through our cookie consent tool on the website. You can also control cookies through your browser settings.

Strictly necessary cookies, which are essential for the website to function, do not require consent.

7. Who We Share Your Information With

We only share your personal information where there is a lawful reason to do so. We do not sell your personal data to any third party.

Data processors

The following third parties process personal data on our behalf under written data processing agreements:

Other recipients

We may also share your personal data with the following where necessary:

• Professional or legal advisors, for the purpose of obtaining professional advice
• Insurance providers, in relation to professional indemnity or other business insurance claims
• Financial or fraud investigation authorities, where required by law
• Relevant regulatory authorities, where we are legally obliged to do so
• Emergency services, where there is an immediate risk to safety

8. International Transfers

Some of our data processors (including Google) may transfer personal data outside the UK. Where this occurs, we ensure that appropriate safeguards are in place in accordance with the UK GDPR. If you would like further information about the specific safeguards in place for any particular transfer, please contact us.

9. How Long We Keep Your Information

We retain personal data only for as long as necessary for the purpose it was collected. The table below sets out our standard retention periods.

When we no longer need your personal data, we will securely delete or anonymise it. If deletion is not immediately possible (for example, because data is held in backup archives), we will securely isolate your data from further processing until deletion can be completed.

We may also use anonymised and aggregated data, from which you cannot be identified, to analyse trends, improve our tools and services, and develop new features. Because this data is no longer personal data, it falls outside the scope of data protection law and may be retained indefinitely.

10. Your Data Protection Rights

Under data protection law, you have a number of rights over your personal data. However, the rights available to you depend on the lawful basis we rely on for each processing activity. The matrix below shows which rights apply to each purpose described in Section 5.

✓ = This right applies.  ✗ = This right does not apply for this processing activity.

What these rights mean

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct inaccurate data or complete incomplete data.
• Erasure: You can ask us to delete your personal data where we no longer need it. This does not apply where we are required by law to retain the data.
• Restrict processing: You can ask us to limit how we use your data, for example while we verify its accuracy.
• Object: You can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your rights.
• Data portability: You can ask us to provide the data you gave us in a structured, machine-readable format, or to transfer it to another organisation. This applies only where processing is based on consent or contract.
• Withdraw consent: Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

You do not need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond.

To exercise any of these rights, please contact us at privacy@curistica.com.

11. Automated Decision-Making

Some of our online tools use automated processing to generate reports based on information you provide. These tools do not make decisions that produce legal effects or similarly significant effects on you. The outputs are informational and advisory in nature.

If you have concerns about how automated processing has been applied to your data, please contact us and we will review the matter.

12. How We Keep Your Information Safe

We have implemented appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls restricting data to authorised personnel only
• Regular review of security practices and procedures
• Use of reputable, GDPR-compliant cloud service providers

While we take all reasonable steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining robust protections and responding promptly to any incidents.

13. How to Complain

If you have any concerns about how we use your personal data, please contact us at privacy@curistica.com and we will do our best to resolve your concern.

If you remain dissatisfied after raising your concern with us, you have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

14. Changes to This Privacy Notice

We may update this privacy notice from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the date below. We encourage you to review this notice periodically.

Last updated: 09/02/2026
‍Next scheduled review: 08/02/2027

‍