0762.1 Overview
Spotlight Pathology Ltd ("Spotlight Pathology", "we", "our", "us") develops artificial intelligence (AI) enabled decision support tools designed to assist healthcare professionals in the diagnosis and assessment of blood cancers and other pathology-related conditions.
We are committed to protecting personal data and respecting the privacy rights of individuals. This Privacy Notice explains how we collect, use, store, share and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection laws.
Spotlight Pathology Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZB346423.
Registered Address:
- The Innovation Centre, Keckwick Lane, Warrington, Cheshire WA4 4FS
- This Privacy Notice applies to individuals who interact with us, including:
- Customers and prospective customers.
- Healthcare professionals.
- Suppliers and contractors.
- Website users.
- Business contacts.
- Individuals whose information may be processed through our services.
Where we provide a separate privacy notice or contractual terms, those documents will take precedence where they differ from this Privacy Notice.
0762.2 Our Data Protection Principles
We will ensure that personal data is:
- 1. Processed lawfully, fairly, and transparently.
- 2. Collected for specific, explicit, and legitimate purposes.
- 3. Adequate, relevant and limited to what is necessary.
- 4. Accurate and kept up to date.
- 5. Retained only for as long as necessary.
- 6. Protected by appropriate technical and organisational security measures.
- 7. Processed in accordance with individuals' rights under data protection legislation.
0762.3 Our Role as Controller and Processor
Depending on the services we provide, Spotlight Pathology may act as either a Data Controller or a Data Processor. Where we act as a Data Controller, we determine the purposes and means of processing personal data. Where we act as a Data Processor, we process personal data on behalf of healthcare organisations, laboratories, research organisations, NHS bodies or other customers and only in accordance with their documented instructions. If you are a patient and your personal data has been provided to us by a healthcare provider, laboratory, NHS organisation or other healthcare organisation, that organisation will usually remain the primary Data Controller for your information.
0762.4 Personal Data we Collect
We may collect personal data directly from you when you visit our website, contact us by telephone, email or online forms, attend conferences, demonstrations, meetings or events, purchase or use our products and services, or otherwise enter into a business relationship with us.
We may also receive personal data from third parties, including NHS organisations, healthcare providers, pathology laboratories, research organisations, business partners and customers who use our services, where such sharing is necessary for the provision of our services, the fulfilment of contractual obligations, compliance with legal requirements, or other legitimate business purposes.
| Processing Activity | Personal Data Held | Retention Time | Purpose/Legal Basis |
| Marketing and Business Development | Name Professional contact details Job title Organisation Communication preferences | We will retain professional contact information for the duration of our relationship and for up to two years following the last meaningful contact unless you object or request deletion. | Article 6(1)(f) UK GDPR - Legitimate Interests To maintain professional relationships and provide information regarding our products, services, events and developments. |
| Website and Contact Enquiries | Name | Enquiries will normally be retained for up to 12 months following closure, unless a longer retention period is required for legal or regulatory reasons. | Article 6(1)(f) UK GDPR - Legitimate Interests To respond to enquiries, provide information and manage communications. |
| Customer and Business Relationship Management | Name | Article 6(1)(c) UK GDPR - Legal Obligation Article 6(1)(f) UK GDPR - Legitimate Interests To provide products and services, manage customer relationships, maintain regulatory compliance. | |
| Clinical Image and Patient Data | Patient identifiers Date of birth Clinical images Pathology images Diagnostic data Health information Technical metadata associated with pathology analysis | Clinical and patient information is retained in accordance with applicable contracts, controller instructions, legal obligations and regulatory requirements. | Article 6(1)(c) UK GDPR - Legal Obligation |
0762.6 Artificial Intelligence and Automated Processing
Spotlight Pathology develops and uses artificial intelligence technologies to support pathology assessment and diagnostic workflows.
Our systems are designed to assist qualified healthcare professionals and are not intended to replace professional clinical judgement.
We do not make decisions that produce legal or similarly significant effects concerning individuals solely by automated means. Final clinical decisions remain the responsibility of appropriately qualified healthcare professionals.
Any use of patient data for model training, testing, validation or performance monitoring will only occur where there is an appropriate legal basis, contractual arrangement and governance framework in place.
0762.7 Sharing of Personal Data
Your personal data may be shared where necessary with:
- Employees and authorised personnel.
- Our corporate group for business operations and compliance.
- Healthcare providers and laboratories.
- NHS organisations.
- Cloud hosting and IT service providers.
- Regulatory authorities.
- Law enforcement.
- Insurers.
- Research partners where appropriately authorised.
- Other organisations where required by law or contractual obligation.
If our business is acquired, your data may be transferred as part of the transaction.
All third-party processors are required to protect personal data and process it only in accordance with our instructions and applicable data protection laws.
0762.8 International Transfers
Personal data may occasionally be transferred outside the United Kingdom. Where international transfers occur, we will ensure appropriate safeguards are in place, including:
- UK Adequacy Regulations;
- UK International Data Transfer Agreement (IDTA);
- UK Addendum to the EU Standard Contractual Clauses; or
- Other lawful transfer mechanisms recognised under UK data protection legislation.
0762.9 Securing and Processing Your Personal Data
We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised access, or disclosure. Where third-party service providers process data on our behalf, they are contractually required to maintain confidentiality and security.
Our security measures include access controls, encryption where appropriate, monitoring, staff training, contractual controls and secure system management processes.
In the event of a personal data breach, we will assess the risk to individuals and, where required by law, notify the following within the timescales required by applicable legislation:
- The Information Commissioner's Office (ICO); and/or
- Affected individuals
0762.10 Your Rights in Relation to your Personal Data
You have the following rights under UK GDPR:
| Right to be Informed | To understand how your personal data is used. |
| Right of Access | To obtain a copy of your personal data. |
| Right to Rectification | To correct inaccurate or incomplete information. |
| Right to Erasure | To request deletion of personal data in certain circumstances. |
| Right to Restrict Processing | To request restrictions on how your personal data is used. |
| Right to Data Portability | You can request data transfer to another provider where applicable. |
| Right to Object | To object to processing based on legitimate interests and to object to direct marketing at any time. |
| Rights relating to Automated Decision-Making including Profiling | To challenge certain automated decisions where applicable under data protection legislation. |
0762.11 Children's Data
Our products and services are not directed at children. Where we process children's personal data as part of healthcare services provided by our customers or healthcare partners, such processing will occur in accordance with their instructions and applicable legal requirements.
0762.12 How to Contact Us?
For questions regarding this Privacy Notice or how we process personal data, please contact:
- Data Protection Officer: Amicis Data Ltd t/a Clinical DPO
- Phone Number: 0203 411 2848
- Email: SpotlightPathologyDPO@ClinicalDPO.com
0762.13 Complaints
If you have concerns regarding our handling of personal data, please contact our Data Protection Officer in the first instance.
When making a complaint, please provide:
- Your name and contact details,
- Details of your concern,
- Any supporting information relevant to the issue.
Complaints will be acknowledged within 30 days. We aim to fully respond and resolve the matter without undue delay. If your issue requires more time or clarification, we will keep you informed throughout.
If you are dissatisfied in how we have handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Phone: 0303 123 1113
- Address: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Documents and References
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- ISO 27001:2022 - Information security, cybersecurity and privacy protection - Information management security systems - Requirements