Privacy Notice

This Privacy Notice explains how Novarum DX Ltd ("we", "us", "our") collects, uses, and protects personal data in connection with the use of RARE (Rapid Assay Result Ecosystem) – our software-as-a-service platform and its associated mobile applications.

This notice is intended for users who access the Service as part of an Organisation (e.g. companies, research institutes, universities). The platform is a Business-to-Business (B2B) service, and we collect only limited personal data to facilitate access and operation of the Service.

Novarum DX Ltd is the Data Controller for personal data processed via the RARE platform.

We are registered in Scotland and subject to UK data protection legislation including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect and process the following categories of personal data:

• Name

• Email address

This information is collected when you are registered to use the platform by your Organisation's administrator.

We process your personal data solely to operate, manage and support the RARE platform, specifically to:

• Provide individual user access to the Service

• Enable login, authentication and user role management

• Communicate system updates, account information or service changes

• Provide customer and technical support

The legal basis for processing is Article 6(1)(f) – legitimate interests, specifically the delivery and support of a licensed B2B software platform.

While we do not consider experimental test data to be personal data, users should be aware that:

• Novarum staff have access to test data uploaded or processed through the Service.

• This access is used to support users, improve performance, optimise methods, and inform future product development.

• All test data remains the property of the Organisation who created or uploaded it.

We do not use test data for sales, marketing, or unrelated analytics, nor do we sell or share this data with third parties outside Novarum or its contractors.

We do not share personal data with third parties except:

• Where required to provide essential services (e.g. cloud hosting, payment processors like Stripe)

• Where required by law or legal process

• With your Organisation's authorised administrators

All third parties processing data on our behalf are subject to appropriate data protection contracts and safeguards.

We primarily process and store data in the UK or other countries which provide an adequate level of data protection under UK law. If we transfer data outside the UK, we will ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs).

We retain your personal data only for as long as needed to provide the Service and comply with legal obligations. When your Organisation terminates use of the platform or your user account is deleted:

• Your personal data will be deleted in accordance with our standard data retention policy

• Test data may be deleted or retained in anonymised form, in line with our Terms and Conditions

Under data protection law, you have the following rights:

• Right to access your personal data

• Right to rectification of inaccurate data

• Right to erasure ("right to be forgotten")

• Right to restrict processing

• Right to object to processing based on legitimate interests

• Right to data portability (where applicable)

• Right to lodge a complaint with the UK Information Commissioner's Office (ICO)

To exercise any of these rights, please contact us at: enquiries@novarumdx.com

We may update this Privacy Notice from time to time to reflect changes in law or our practices. Updated versions will be made available via the RARE platform and on our website.