Privacy and Cookies Policy

Last updated September 2025

This Data Protection and Privacy Policy outlines the principles and guidelines for the collection, processing, storage, and protection of personal data by Flow Health Science Inc. We are committed to ensuring the privacy and security of personal data in accordance with applicable data protection laws and regulations.

Scope

This policy applies to all team members, contractors, clients and third parties who process personal data on behalf of Flow Health Science Inc. This policy refers to all personal data collected and processed in the course of our business activities.

GDPR – General Data Protection Regulation UK

Under GDPR, the lawful bases we rely on for processing this information, are as follows:

We will collect and process your personal data only if one of the following applies:

• You have consented to us doing so, for example by opting in to receiving email newsletters or accepting cookies
• We need to do so to comply with our obligations under a contract with you, for example to communicate on a day-to-day basis with our clients.
• We need to do so to comply with a legal obligation, for example to cooperate with a law enforcement investigation.
• We have a legitimate interest in doing so which might reasonably be expected as part of running our business and which is not overridden by your interests or fundamental rights and freedoms. Such legitimate interests could include the provision of services by us, or administrative or operational processes, or marketing.

The type of personal information we collect

Employees – including but not limited to:

• Personal identifiers, contacts and characteristics (name, date of birth, address, sex etc…)
• Financial information
• Education and qualifications
• Work experience
• National Insurance number
• Tax code
• Emergency contact details
• Employment history with the organisation
• Employment terms and conditions (e.g. pay, hours of work, holidays, benefits, absence)
• Any accidents connected with work
• Any training taken
• Any disciplinary action

Contractors, clients and third parties – including but not limited to:

• Personal identifiers, contacts, and characteristics
• Organisation and staff details
• Financial information

Data Collection and Processing

• We will only collect and/or store personal data that is necessary for the specified purposes and will inform individuals about the purposes of data collection.
• Personal data collected will be accurate, up-to-date, and kept for no longer than necessary.
• Consent will be obtained when required for data processing, and individuals will have the right to withdraw consent at any time.

Data Security

• We will implement technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, and destruction.
• Employees and third parties handling personal data will be trained on data protection best practices.

Data Subject Rights

• Individuals have the right to access, rectify, delete, or restrict the processing of their personal data, and we will respond to such requests within the timeframes required by law.
• Data subjects have the right to data portability and the right to lodge a complaint with the relevant data protection authority.

Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact our DPO if you wish to make a request.

Data Transfers

Personal data transfers to countries outside the European Economic Area (EEA) or other regions with data protection laws will only occur when adequate safeguards are in place.

Data Breach Response

In the event of a data breach, we will notify the relevant supervisory authority and affected individuals as required by law.

Monitoring and Review

We will regularly review and update this policy to ensure its continued effectiveness and compliance with data protection laws.

Responsibilities

• The Data Protection Officer (DPO) is responsible for ensuring compliance with this policy and relevant data protection laws.
• All team members are responsible for adhering to this policy and reporting any potential data protection issues.

Contact Information

For questions, concerns, or requests related to data protection, individuals can contact the DPO via email, at info@flowhealthscience.com.

You can also complain to the ICO if you are unhappy with how we have used your data.

ICO website: https://www.ico.org.uk

Legal Compliance

This policy is in accordance with applicable data protection laws and regulations including The Data Protection Act 2018.