Last updated: 9 November 2026
1. Who we are
Circularity Health (“we”, “us”) is a concept-stage research organisation with planned operations in London, United Kingdom, and San Francisco, United States. For the purposes of UK GDPR, we are the data controller for personal data submitted through this website.
[PLACEHOLDER — insert the registered company name, company number and registered address once the entity is incorporated.]
2. What we collect
We only collect what you choose to send us through the forms on this site:
- Partnership and investor enquiries: name, email address, organisation, role, interest type, message, and whether you requested the concept deck.
- Contact messages: name, email address, organisation (optional), topic and message.
- Newsletter subscriptions: email address and the page you subscribed from.
- Technical data: standard server logs needed to operate and secure the site. We do not use advertising trackers.
We ask that you do not send medical information, health records or special category data through this website.
3. Why we use it, and our lawful basis
- To respond to your enquiry — lawful basis: legitimate interests (responding to a business or research enquiry you initiated), or steps prior to entering a contract.
- To send research notes — lawful basis: consent. You may withdraw consent at any time using the unsubscribe link in any email.
- To keep the site secure — lawful basis: legitimate interests (security and abuse prevention).
4. Cookies and measurement
Essential cookies are used to operate the site. Optional measurement is only enabled if you accept it in the consent banner, and your choice is stored in your browser. You can change your decision at any time using the “Cookie settings” link in the footer.
5. Sharing
We do not sell personal data. We share it only with service providers who help us operate the site and communications (for example hosting and email delivery), under written terms, and where required by law.
[PLACEHOLDER — list the current processors, their locations and the transfer mechanism used for any transfers outside the UK/EEA.]
6. Retention
Enquiries are kept for up to 24 months after our last contact, then deleted. Newsletter subscriptions are kept until you unsubscribe, plus a short suppression record so we do not contact you again.
7. Your rights (UK GDPR)
You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these, contact us using the details on our Contact page.
You also have the right to complain to the Information Commissioner’s Office (ICO) in the UK.
8. California privacy notice (CCPA/CPRA)
California residents may request to know what personal information we hold, request deletion, or request correction, and may designate an authorised agent to act on their behalf. We do not sell or share personal information for cross-context behavioural advertising, and we do not use it for profiling with legal or significant effects.
We will not discriminate against you for exercising these rights. Requests can be made through our Contact page; we will verify your identity before acting.
9. Security
Data is transmitted over encrypted connections and access is restricted to those who need it. No system is perfectly secure, but we limit what we collect so that a breach has less to expose.
10. Children
This site is not directed at anyone under 18, and we do not knowingly collect their data.
11. Changes
If we make material changes to this policy we will update the date above and, where appropriate, notify newsletter subscribers by email.
12. Contact
For any privacy question or request, use the form on our Contact page. [PLACEHOLDER — add the data protection contact and any appointed representative.]