What professional information we hold about clinicians and scientists working in transplantation, why we hold it, and how to have it removed. Last updated 10 August 2026.
We are a transplant diagnostics company. We keep a small amount of professional information
about clinicians, scientists and other people who work in transplantation, so that we know
who works where, who leads which programme, and who we should be talking to about our
research.
We do not hold anything about your health, your private life or your personal circumstances.
We do not sell this information to anyone. If you would rather we did not hold it, tell us
and we will stop, and we will not ask you to justify it.
Scira Diagnostics Ltd is a company registered in England and Wales, number 17338766, with
its registered office at Aston Park Farm, Stringers Lane, Aston, Hertfordshire, SG2 7EF. We
develop diagnostic tests for transplant medicine.
For the information described here, Scira Diagnostics Ltd is the data controller. We use
a software platform called Ariadne Forum, provided to us by Patient Thread Limited, which
acts as our data processor under a written contract and only on our instructions.
Contact for anything in this notice: privacy@scirabio.com
Only professional information, and only what we need:
before, so we do not lose track when people move
boards
agreed to do next
We want to be specific about this, because it is the part people worry about.
or sex life.** Again, no field exists.
email address.
are entirely separate, and our commercial system cannot reach them.
Mostly from public professional sources: your institution's website, publications, society
office-holder lists, congress programmes and faculty lists, guideline documents, and
publicly available registry data.
We also record what you tell us directly, when we meet you at a congress, speak to you, or
work with you.
Because we often collect this from public sources rather than from you, you may not have
known we held anything until you read this. That is precisely why this notice exists, and
why we link to it from the first message we send you.
Our legal basis is legitimate interests under Article 6(1)(f) of the UK GDPR. Our
legitimate interests are:
professionals where a transparency code requires it, and carrying out anti-bribery checks
on commercial partners
We have carried out and documented a balancing test weighing our interests against your
rights. You are welcome to ask for a summary of it, and we will send you one.
Where we send you marketing emails, we rely on your consent, and every such email has
an unsubscribe link that works immediately.
We calculate an internal score of professional prominence and place people in one of three
tiers. We want to be open about how it works, because being ranked by a company you have
never met is reasonably something you would want to understand.
The score is calculated only from objective, publicly verifiable professional facts:
More recent activity counts for more than activity from many years ago.
Three things it is not. It is not a judgement of your ability or your worth. It contains
no subjective assessment of you as a person. And it is not used to make any automated
decision about you: it helps our team prioritise who to approach, and a person always makes
the decision.
If you ask us how you were scored, we will tell you. We can give you the actual formula
and your individual component scores, because we store them.
We do not sell this information and we do not license it to anyone.
It is seen by our own staff who need it, and by:
processing contract
in the form that code requires, for example under the ABPI Code in the UK, EFPIA codes in
Europe, or the Open Payments system in the United States. If this applies to you, we will
tell you before it happens.
In the United Kingdom or the European Union. We do not transfer this information outside the
UK or EU unless we have completed a transfer risk assessment and put an approved safeguard
in place, such as the UK International Data Transfer Agreement.
meaningful contact with you and no current reason to hold your record, we delete it.
record retention.
requires it.
contact you again, which is your name, an identifier, and the date and scope of your
objection.
You have the right to:
information is of no use to us either
We will not ask you to justify it and we will not argue that our commercial interests
outweigh your objection.
marketing but nothing else
To exercise any of these, email privacy@scirabio.com. We will respond within one month.
There is no charge.
If you are unhappy with how we have handled your information, you can complain to the
Information Commissioner's Office at ico.org.uk/make-a-complaint or 0303 123 1113. We
would appreciate the chance to put it right first, but you do not have to come to us before
going to them.
If we change this notice materially, we will update the date at the top and, where the
change affects you significantly, tell you directly.
Serving the notice. Article 14 requires proactive notification where data is obtained
from a source other than the data subject, within a reasonable period and at the latest
within one month, or at the time of first communication if sooner. Our approach:
1. Publish this notice at a stable URL before any field data entry.
2. Include the footer line in every first communication. This satisfies Art. 14(3)(b) and is
the primary mechanism.
3. For records held but not yet contacted, rely partly on **Art. 14(5)(b) disproportionate
effort**, with the reasoning recorded in GDPR-02 section 4.4. Do not treat this as
indefinite: it is a bridge until first contact, not a permanent exemption.
4. Record service in `crm.persons.privacy_notice_sent_at`. Review quarterly that everyone
contacted in the period has it populated.
Tone. Deliberately plain. A notice that a consultant will actually read is worth more
than one drafted to be litigation-proof and therefore unread. The commitments made here,
particularly not challenging objections and disclosing the scoring formula, are real
commitments and are reflected in GDPR-02 and GDPR-06. Do not weaken this text without
changing those documents too.
Before publishing: confirm the `privacy@scirabio.com` mailbox exists and is monitored,
confirm the final URL, and confirm the ICO registration in GDPR-01 action 1 is complete.