We process personal data in several ways as part of providing Oyster Therapeutics services.  This privacy statement outlines what data we collect, why we collect it and how we treat it whilst we are holding it.  Please review the section which details how we might interact with you.

How we process your personal data

You are a potential Client or Partner of Oyster Therapeutics

When you make an enquiry about us you are likely to provide us with some personal data to enable us to contact you or respond to an enquiry.  You may do this via our website or directly, by passing us your business card or any other similar method.

We may also research public sources to obtain business contact details, which we use in marketing our products and services. As business to business communications these are outside of the scope of the Privacy in Electronic Communications Regulation (PECR) but are in scope of the Data Protection Act (2018), therefore we consider these communications to be in our legitimate interest, we will always offer you the opportunity to opt out of these communications.

If we have obtained your personal data from a third party such as one of our academic partners, we will inform you of this when we first correspond with you or at least within one month of receiving it. 

If you have been introduced to us via one of our partners then you should be aware that we will be a Joint Data Controller in respect of the Oyster Therapeutics service.  It is important to us that you understand that you can exercise your rights (outlined below through correspondence with either ourselves or our partner and we aim to make this as easy for you as possible.  You should take some time out to review any partners privacy statement as well as this one in order to understand how they treat your personal data.

You are a patient or subject in one of our research projects

If you are a participant in any of our research projects you will be provided with detailed information relating to the research and how your personal data is used before the research commences.

You will be asked for your consent to join the research project, but the data that we collect will be required to fulfil our legal obligations and the evidencing of our scientific research.  As a result you may not be able to exercise all of your data protection rights (see below).

Any personal data used within our research projects are processed subject to very strict data protection controls,  such as pseudonymisation of records, meaning that Oyster will not know of your identity.

You are a part of the Oyster Therapeutics Research Partner Network

If you are one of our Research Partners, then we will process personal information in order to undertake the management of the research between us.  This means that we will hold contact information, account information as well as financial information, which is needed to pay you any fees.

We may share this data with a third party if this is required to manage our relationship.  For example if there is a dispute over payments of invoices then data may be shared with debt recovery organisations.

We will retain this information for the duration of our relationship, plus a period of up to seven years in order that we might meet any of our accounting obligations.

Where Shared Personal Data exists, we are jointly responsible to ensure:

• It is accurate and up-to-date and has at all times been collected, processed and transferred in accordance with data protection legislation;

• each relevant Data Subject has been provided with sufficient information to enable fair, transparent and lawful processing of the Shared Personal Data for the Permitted Purpose;

• it is entitled to transfer, and the other party is entitled to Process all Shared Personal Data for the Permitted Purpose in accordance with all Data Protection Legislation.

You are associated with Oyster Therapeutics through our supply chain

If you are associated with Oyster Therapeutics through our supply chain, we are likely to retain personal data with employees in your organisation with respect to managing any correspondence relating to the contract in place between our organisations.  For example, we may hold email addresses or mobile phone numbers which we will use for contacting you.  We will retain this information for as long as our relationship with you is current, plus a period of up to seven years in order that we might meet any of our accounting obligations.

We may share this data with a third party if this is required to manage our relationship.  For example, if there is a dispute over payments of invoices then data may be shared with debt recovery organisations.

You are a visitor to our website

There are several ways in which we might gather your personal information via our websites.  You should review the ‘Our Use of Cookies’ section for details on how we use your personal data to track your usage of our website.

If you make an enquiry or contact us via our website we will ask you for contact information as part of the process, we need this in order to follow up with you in resolving your enquiry or meeting our contractual obligations.  We may retain website enquiries for a period of up to 24 months after the enquiry has been resolved.

If you make a ‘Enquiry’ via any of the contact forms on our website then we will treat this information as outlined in the ‘Potential Client’ section.

You have applied for a role within Oyster Therapeutics

If you have applied for a job role with us it is likely that you have provided us with personal information to support your application, typically a CV and contact details.  We will use the information provided to review if you are suitable for an interview and we may also collect additional information from other sources such as your referees or from social media.

If you are unsuccessful at any stage, then we may retain your personal information for up to an additional six months.  We do this in order that we can meet our employment law obligations, but we may also use this information in our legitimate interest, to contact you again if we wish to revisit the application.

If you are successful in your application, we will provide you with an employees Privacy Statement which will detail how we treat the personal data of our employees.  You will receive this as part of your offer notification.

Your Rights

1. Right to be Informed

You have the right to be informed about the data that we process on your behalf.  In most cases we will ensure that the Privacy Statement you are reading now is the means by which we inform you of our usage of your personal data, this will change from time to time and will always be dated in order that you know when this version came into effect. 

There may be circumstances where you would not reasonably be expected to have had visibility of this statement when we obtain your data, such as when someone else provides us with it.  In these circumstances we will inform you when we first communicate with you and at least within 30 days of receiving the data.

2. Right to Access

You have the right to access any personal data that we process on your behalf.   If we do not hold any of your personal data, we will inform of this also.  

We will provide this on request and we will also provide you with the purposes for which we process your data.  If we have transferred your data to a ‘third country’, then we will inform you of the safeguards that we have put in place to ensure that it receives the same protections as you would expect. 

We will provide you with a copy of any personal data free of charge, except in circumstances where additional copies of the same data is requested or where we deem your request to be excessive, where we may apply a reasonable fee to cover our administration costs.  

3. Right to Rectification

It is our policy to ensure that any personal data that we hold remains accurate and up to date.  If you believe that we are processing inaccurate personal data, you have the right to have this personal data corrected.

We may ask you to prove your identity to us prior to making any changes in order to confirm the integrity of the request.

4. Right to Erasure

You have the right to have your personal data removed from our systems.  This right only applies where:

• the personal data is no longer necessary for the purposes for which it was collected
• we processed your personal data on the basis of your consent and you have withdrawn this
• we are processing your personal data on the basis of legitimate interest and there are no legitimate grounds remaining for its continued use
• the processing is deemed unlawful
• the personal data must be erased to comply with a legal obligation
• where the data applies to a child and their usage of ‘information society services’

5. Right to Restrict Processing

You have the right to ask us to restrict or cease the processing of your personal data.  You may wish to use this right if you want to ask us to stop doing something, but not erase the data.  This may be necessary for example if the data we are processing is incorrect, or you need us not to erase the data in order that you can retain it as evidence against legal claims etc.

6. Right to Data Portability

You have the right to ask us to transfer your personal data to another Data Controller where the processing is based upon a contract with you or with your consent and the data is processed by automated means.

7. Right to Object

You have the right to object to any processing which is bases upon our legitimate interests (or in the public interest).

8. Automated Decision Making

You have the right not to be subject to a decision based solely on automated means, for example in any automated scoring systems we might apply to learning.

Where you exercise this right, you have the right to have an individual to make this decision based upon the original facts and any other information that you might provide.

In the case of the above rights above numbered 2 through to 8, Oyster Therapeutics will assess the request against any of our contractual or lawful obligations before responding.  If we conclude that we must reject your request we will provide you with a rationale.  In all circumstances we will respond to a request within 30 days.

In the case of the above rights above numbered 2, 3, 5 and 7 these rights may not apply when personal data is being archived for scientific research reasons.

If you do not accept our decision, or if you have any other reason to be concerned about how we treat your personal data then you have the right to register a complaint regarding the use of your personal data to a supervisory authority at any time. The UK’s supervisory authority is the Information Commissioners Office details of which can be found at ico.org.uk.

International Data Transfers

Oyster Therapeutics do not routinely transfer personal data outside of the UK or the EU. 

If there are exceptional circumstances where your personal data needs to be processed outside of the EU, we will ensure that we have put in place recognised safeguards or that the transfer is subject to a recognised exception (as documented in UK and EU Data Protection Regulation).

Our Use of Cookies

What are Cookies?

Cookies are simple ’text files’ which are downloaded onto your computer the first time that you visit a website and they can then be read by the website.  Typically, they contain two pieces of information: a site name and unique user ID.  Cookies are NOT programs and do not run anything on your computer.

How do cookies help me?

Some cookies are sophisticated and might record things like your preferences for page layouts and colour schemes. They can also be used to store data for example for things like progress in a training course or information on what is in your ‘shopping cart’.

The possibilities are endless, and generally the role of cookies is beneficial, making your interaction with frequently-visited sites smoother – for no extra effort on your part.

What should I be wary of?

By their nature cookies are recording behavioural data on your habits on websites and sharing this with the organisation, if you do not trust the organisation then you should be wary about the information being shared with them as they can influence what you see on the internet, for example through targeted advertising.  As this can occur without warning we believe (and the law states) that you need to be aware when cookies are in use and provide your consent to their usage. 

What cookies to Oyster use?

Oyster Therapeutics uses Google Analytics 4 (GA4) and its associated cookies:

Cookie Name: _ga_  

Used by Google Analytics to distinguish visitors and measure website usage.

Duration: Up to 2 years

Status: Optional – Analytics

Cookie Name: _ga_X0YF7ZHVLQ

Used by Google Analytics to maintain information about a visitor's session.

Duration: Up to 2 years

Status: Optional – Analytics

How do we use this information?

We use Google Analytics to understand how visitors find and interact with our website. This may include pages visited, time spent on the website, approximate geographical location, device type and browser information.

This information helps us improve website content, usability and performance. We do not use Google Analytics to directly identify individual visitors.

How can I manage cookies?

You can accept or reject optional analytics cookies through our website's cookie preferences. You can also manage or delete cookies through your browser settings.

For more information about Google's privacy practices, visit https://policies.google.com/privacy.

If you have any questions about our use of cookies, please contact Oyster Therapeutics through our website.

‍