Privacy Policy.

01Who we are

Humans Nexus is a Humans Holdings company providing clinical-grade infrastructure for microsampling and monitoring, at home and at the point of care. For the personal data described in this policy, the data controller is the Humans Holdings operating entity that contracts with you.

You can reach our privacy team at privacy@humansnexus.com. Where a Data Protection Officer (DPO) has been appointed, their contact details will be published here.

02Scope of this policy

This policy explains how we handle personal data when you visit our website, contact us, or use our infrastructure as a partner laboratory, healthcare provider, sponsor or end participant. It does not cover the independent processing carried out by partners who act as their own controllers; their own notices apply to that processing.

03The data we collect

We collect only what each interaction requires:

• Identity & contact (name, organisation, role, email, phone, and the content of messages you send us).
• Health & sample data, where you participate in a collection programme: sample identifiers, collection metadata and, where applicable, results. This is special-category data and is handled under section 05.
• Technical & usage (IP address, device and browser information, and aggregate analytics about how the site is used).
• Commercial (records relating to enquiries, contracts and correspondence with partner organisations).

04How we use it & our legal bases

We process personal data only where a lawful basis under Article 6 GDPR applies:

• To provide and operate the service, performance of a contract.
• To respond to enquiries and run our business, our legitimate interests, balanced against your rights.
• To meet legal, regulatory and quality obligations (compliance with a legal obligation, including medical-device and in-vitro-diagnostic regulation).
• For optional analytics and communications, your consent, which you may withdraw at any time.

05Health & special-category data

Sample and health data is special-category data under Article 9 GDPR and receives heightened protection. We process it only on a valid Article 9 condition, typically your explicit consent, or the provision of health care under a contract with a health professional, and always under appropriate technical and organisational safeguards. We do not use health data for advertising, and we never sell it.

06Who we share data with

We share data only as needed to deliver the service and meet our obligations:

• Accredited laboratories that analyse samples.
• Logistics and courier partners that move samples under documented chain of custody.
• Processors, vetted technology and infrastructure providers acting on our instructions under a data-processing agreement.
• Authorities where we are legally required to disclose.

We do not sell personal data and do not share it with third parties for their own marketing.

07International transfers

Our infrastructure is EU-sovereign by design, and we keep personal data within the European Economic Area wherever possible. Where any transfer outside the EEA is unavoidable, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses, with supplementary measures as required.

08How long we keep it

We keep personal data only as long as necessary for the purpose it was collected, to meet legal, regulatory and quality-system retention requirements, and to defend legal claims. When data is no longer needed it is securely deleted or anonymised.

09How we protect it

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, access controls on a least-privilege basis, audit logging, and supplier due diligence. No system is perfectly secure, but we work to a standard befitting clinical-grade data.

10Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting prior processing; and
• lodge a complaint with your supervisory authority.

To exercise any of these, contact us using the details in section 14. We will respond within the statutory time limits.

11Cookies & analytics

We use a minimal set of cookies necessary to run the site and, with your consent, privacy-respecting analytics to understand and improve it. You can manage non-essential cookies through your browser or any consent control we provide. A dedicated cookie notice will be linked here.

12Children

Our website and services are directed to organisations and adults, not children. Where a collection programme involves a minor, it is arranged through and consented to by a parent, guardian or treating clinician under the applicable programme terms.

13Changes to this policy

We may update this policy to reflect changes in our practices or the law. The "last updated" date above shows the current version. Material changes will be communicated through the site or directly where appropriate.

14How to contact us

For any privacy question or to exercise your rights, contact our privacy team at privacy@humansnexus.com. If you are not satisfied with our response, you have the right to complain to the data-protection supervisory authority in your country.