Privacy Policy

https://originalscience.co.uk (the “Site”) is owned and operated by Hymettus Inc, trading as Original Science. Hymettus Inc is the data controller for the personal data described here.

Purpose

This policy tells you:

1. the personal data we collect;
2. how we use it, and our legal basis for doing so;
3. who has access to it;
4. your rights; and
5. how we use cookies.

It applies in addition to the terms and conditions of the Site.

UK GDPR and GDPR

For users in the United Kingdom we adhere to the UK General Data Protection Regulation as enshrined in the Data Protection Act 2018. For users in the European Union we adhere to Regulation (EU) 2016/679.

Genetic and health data

Genetic data and health data are “special category” personal data under Article 9 of the UK GDPR. They carry stronger protection than ordinary personal data and we treat them accordingly.

Our condition for processing them is your explicit consent, given separately when you order a test and complete the health questionnaire. Where we process health data for the purpose of providing you with treatment, we also rely on Article 9(2)(h), processing necessary for the provision of health care by or under the responsibility of a professional subject to a duty of confidentiality.

You can withdraw that consent at any time by contacting our Data Protection Officer, and we will stop processing and delete your genetic data and report. Withdrawal does not make lawful the processing we carried out beforehand, and it will usually mean we can no longer supply you, because the formulation cannot be produced without the report.

We do not sell your genetic data. We do not share it with insurers, employers, advertisers, data brokers or research databases. We do not use it for advertising or profiling of any kind. It is used to produce your report and your formulation, and for nothing else.

Personal data we collect

We only collect data that helps us achieve the purposes in this policy. We will not collect additional data without telling you first.

Data you give us directly

• first and last name (both are required, because they appear on any prescription);
• email address, phone number and delivery address;
• health questionnaire answers, including your hair loss history, current and past treatments, side effects, medication, pregnancy status where relevant, and other medical conditions you disclose;
• photographs you upload to track progress; and
• anything you write to us in a message or support request.

Data produced about you

• the genetic data derived from your saliva or cheek swab sample, and the report produced from it; and
• your order and payment history.

Data collected automatically

• usage data collected through analytics cookies, covering pages viewed and time on site.

Legal bases for processing

We rely on the following bases under Article 6:

• Contract: to take steps at your request before entering a contract, and to perform the contract once made. Without this data we cannot supply you.
• Consent: for genetic and health data, for analytics cookies, and for marketing email. You may withdraw consent at any time.
• Legal obligation: to keep records the law requires us to keep, including records relating to the supply of medicines and to tax.
• Legitimate interests: to secure the Site and prevent fraud, where those interests are not overridden by your rights.

How we use your data

• to send you a test kit and process your sample;
• to produce your genetic report;
• to allow a registered prescriber to review your report and questionnaire and decide what may safely be supplied;
• to have a registered pharmacy compound and dispense your formulation;
• to take payment and provide receipts;
• to let you track photographs and supply in your dashboard;
• to answer your questions and provide support; and
• to meet our legal and regulatory obligations.

Who we share your data with

We share only what each recipient needs, and each is bound by contract to protect it:

• The laboratory that analyses your sample and produces the genetic report.
• The prescriber who reviews your report and questionnaire. They are a registered healthcare professional bound by a duty of confidentiality.
• The pharmacy that compounds and dispenses your formulation, which receives your name, delivery address and prescription details.
• Stripe, our payment processor. Stripe receives your payment details directly; we never see your full card number.
• Mailgun, which sends our transactional email.
• Our hosting and storage providers, which hold the Site, the database and uploaded photographs.
• Our own staff, where they reasonably need access to do their job.

We will not sell or share your data with anyone else, except:

1. where the law requires it;
2. where it is required for legal proceedings;
3. to establish or defend our legal rights; and
4. to a buyer or potential buyer if we sell the company, in which case your genetic data would transfer only with your explicit consent.

If you follow a link from our Site to another site, we are not responsible for and have no control over their privacy practices.

International data transfers

Some of your personal data is transferred outside the United Kingdom, including to the United States, where Hymettus Inc is incorporated, and to Ireland, where our payment processor operates within the European Union.

Where we transfer personal data internationally we do so only if the destination has been deemed adequate by the United Kingdom adequacy regulations or the European Commission, or where we have put appropriate safeguards in place, such as the UK International Data Transfer Agreement or standard contractual clauses.

How long we keep your data

• Genetic data and your report: kept while your account is open and you are being supplied, and deleted on request. If you close your account we delete them unless we are required to retain them.
• Prescription and medical records: retained for the period required by law and by professional obligations relating to the supply of medicines, which can be longer than you might expect and which we cannot shorten at request.
• Order and payment records: retained as long as tax law requires.
• Photographs: kept until you delete them or close your account.

How we protect your data

Traffic to the Site is encrypted in transit. Data is held in access-controlled databases and object storage, reachable only by staff with a role that requires it, and photographs are served through short-lived links rather than public URLs. Staff are bound by confidentiality obligations.

We take all reasonable precautions, but no system is perfectly secure and we cannot guarantee the security of data beyond what is reasonably practicable.

Your rights

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• the right to withdraw consent at any time.

To exercise any of these, or to ask what we hold and who we have disclosed it to, contact our Data Protection Officer below. We respond within one month.

Cookies

A cookie is a small file stored on your device by a website. You can set your browser to notify you when a cookie is sent, or to block cookies entirely, though that may reduce the quality of your experience.

Essential cookies

Needed to keep you signed in and to keep your session secure. The Site does not work without them.

Analytical cookies

We use Google Analytics to understand anonymised behaviour on the Site, such as which pages are read and for how long, so we can improve it. We do not send your genetic, health or account data to Google.

Modifications

We may amend this policy to maintain compliance with the law and to reflect changes in how we handle data. When we do, we update the date at the top. We recommend reviewing it periodically, and where the change is significant we will notify you by email.

Complaints

If you have a complaint about how we process your personal data, please contact us first so we can try to resolve it. If you are not satisfied, you have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office at ico.org.uk.

Contact

Data Protection Officer
[email protected]
Wework, c/o Hymettus Inc, One City Center, 110 N Corcoran St, Durham, NC 27001, USA