Point Lumina Medical Advisory Ltd - Privacy Notice | Review Your Privacy Rights

1. Who we are and what this notice covers

Point Lumina Medical Advisory Ltd, a company incorporated and registered in England and Wales with company number 17236907 whose registered office is at 4 Roy Grove, Hampton, England, TW12 3DN ("Point Lumina", "we", "us" or "our") is a consultancy that helps pharmaceutical and medical affairs organisations improve their processes. We are the controller of the personal data described in this notice, which means we decide how and why it is used. We are registered with the Information Commissioner's Office (ICO) under registration number ZC239186.

This notice explains how we collect and use personal data about:

people who work for our customers, prospective customers and the consultancies we work with;
our suppliers and subcontractors, and the people who work for them;
our professional and business development contacts; and
people who visit our website or contact us.

It applies whether we collect your personal data from you or from somewhere else. When we handle personal data on behalf of a customer as part of a project, for example information about the customer's staff that the customer gives us, the customer is responsible for that personal data and its own privacy notice applies.

2. The personal data we collect

Depending on how you deal with us, we may collect:

Identity and contact details: your name, job title, employer, business email address, telephone number, business address and online profile(s) (e.g. LinkedIn).
Professional information: your role, organisation, career history, areas of expertise and professional interests, publications, conference appearances, website posts and comments you have made publicly, together with our notes about our dealings with you.
Contract and financial details: if you contract with us yourself (for example as a sole trader or freelance supplier), your contact address, bank details, invoices and payment records.
Correspondence: emails, messages and notes of calls and meetings with you.
Website information: information you send us through the contact form on our website www.pointlumina.com and information collected through cookies and similar technologies, as explained in our cookie policy at www.pointlumina.com.

We do not intend to collect special category data about you (such as information about your health, ethnicity, religious beliefs or sexual orientation) or information about criminal convictions or offences. If a public source happens to include this kind of information about you, we will not record it.

If we need your personal data to enter into or perform a contract with you and you do not provide it, we may not be able to enter into or perform that contract.

3. Where we get your personal data

We collect personal data:

from you, for example when you contact us, meet us, enter into a contract with us or send us an invoice;
from the organisation you work for, for example where a customer or supplier names you as a contact for a contract or project;
from publicly available sources, including organisations' websites, news and trade publications, conference and event programmes, public registers such as Companies House, and social networking sites such as LinkedIn (public profiles, posts and comments);
through search engines and AI research tools, which we use to help us find and summarise publicly available information; and
from people who know you, for example where a mutual contact introduces us or recommends you.

4. How and why we use your personal data

UK data protection law only allows us to use personal data where we have a lawful basis for doing so. The table below sets out what we use your personal data for and the lawful basis we rely on for each purpose.

  
        Purpose
        Personal data used
        Lawful basis
      
          Running our business and managing contracts:
          entering into and performing contracts with our suppliers,
          subcontractors and customers, making and receiving payments,
          and keeping our accounts.
        
          Identity and contact details, contract and financial details,
          correspondence
        
          Performance of a contract with you, or taking
          steps at your request before entering into one, where you are
          the contracting party.

          Legitimate interests where you work for the
          organisation we contract with: our interest in administering
          our contracts with that organisation.

          Legal obligation for keeping tax and
          accounting records.
        
          Customer contact and relationship management:
          keeping in touch with customers, former colleagues and
          professional contacts, and keeping our contact records up to date.
        
          Identity and contact details, professional information,
          correspondence
        
          Legitimate interests: maintaining our
          professional relationships and developing our business.
        
          Research and business development:
          researching organisations and individuals using publicly
          available sources, including with the help of AI tools, to
          understand their work and published views, and to identify
          potential customers and collaborators to contact.
        
          Identity and contact details, professional information
        
          Legitimate interests: finding new customers
          and collaborators for our business. We only use information
          that is publicly available and relates to your professional
          profile, and you can object at any time (see section 9).
        
          Responding to you: dealing with enquiries
          and messages, including through our website and LinkedIn.
        
          Identity and contact details, correspondence
        
          Legitimate interests: responding to people
          who contact us.
        
          Legal and regulatory matters: complying
          with our legal obligations, and establishing, exercising
          or defending legal claims.
        
          Any of the above, as relevant
        
          Legal obligation, and
          legitimate interests in protecting our
          business and enforcing our rights.

Purpose	Personal data used	Lawful basis
Running our business and managing contracts: entering into and performing contracts with our suppliers, subcontractors and customers, making and receiving payments, and keeping our accounts.	Identity and contact details, contract and financial details, correspondence	Performance of a contract with you, or taking steps at your request before entering into one, where you are the contracting party. Legitimate interests where you work for the organisation we contract with: our interest in administering our contracts with that organisation. Legal obligation for keeping tax and accounting records.
Customer contact and relationship management: keeping in touch with customers, former colleagues and professional contacts, and keeping our contact records up to date.	Identity and contact details, professional information, correspondence	Legitimate interests: maintaining our professional relationships and developing our business.
Research and business development: researching organisations and individuals using publicly available sources, including with the help of AI tools, to understand their work and published views, and to identify potential customers and collaborators to contact.	Identity and contact details, professional information	Legitimate interests: finding new customers and collaborators for our business. We only use information that is publicly available and relates to your professional profile, and you can object at any time (see section 9).
Responding to you: dealing with enquiries and messages, including through our website and LinkedIn.	Identity and contact details, correspondence	Legitimate interests: responding to people who contact us.
Legal and regulatory matters: complying with our legal obligations, and establishing, exercising or defending legal claims.	Any of the above, as relevant	Legal obligation, and legitimate interests in protecting our business and enforcing our rights.

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your interests and rights, and concluded that they are not. You can ask us for more information about this.

Use of AI tools: we use AI tools to help us search for, analyse and summarise publicly available information. We manually review all results, and the results are used only for our own internal decisions about who to contact and how. We do not publish them, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. We do not enter special category data into AI tools, and where a tool offers the option we set it not to use our inputs to train its AI models.

We do not send newsletters or bulk marketing emails. If we contact you about our services, we will do so individually, and we will stop if you ask us to.

5. Who we share your personal data with

We share personal data with the following types of recipient, but only to the extent they need it:

IT and software providers who host or support our systems, including our email, file storage, website hosting service SquareSpace, accounting software provider Xero, accounting company 123Financials, and Revolut Business bank.
AI and search tool providers that we use for research, including Perplexity, Grammarly.
Professional advisers, such as our accountants, lawyers and insurers.
Customers and consultancies we work with, where this is needed for a project, for example when we introduce a supplier or subcontractor to a customer.
Law enforcement agencies, regulators and other authorities, where we are required by law to share it.
A buyer or prospective buyer of our business, if we sell or transfer all or part of it.

We do not sell personal data.

6. International transfers

Some of our service providers are based outside the UK, including in the United States. Where we transfer personal data outside the UK, we make sure it is protected in one of the ways UK data protection law requires: either the country (or, for the United States, the organisation receiving the data, through the UK Extension to the EU-US Data Privacy Framework) is covered by UK adequacy regulations, or we use contract terms approved for UK transfers, such as the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses. You can contact us for more information about the safeguards we use.

7. How long we keep your personal data

We keep personal data only for as long as we need it for the purposes described in this notice, and then delete it or anonymise it.

  
        Personal data
        How long we keep it
      
        Contract, invoice and payment records
        
          Six years after the end of the financial year to which they
          relate, to meet tax and accounting requirements and in case
          of legal claims.
        
          Correspondence and notes about customers, suppliers and
          subcontractors
        
          For the length of our relationship and for six years after
          it ends, in case of legal claims.
        
          Contact details of former colleagues and professional contacts
        
          For as long as we remain in touch. We review our contact
          records every two years and delete details that are no
          longer relevant.
        
          Research notes about people we do not go on to work with
          or contact
        
          12 months from when we collected them, unless we are in
          contact with you by then.
        
        Website enquiries
        
          Two years after our last contact with you, unless you
          become a customer or supplier.

Personal data	How long we keep it
Contract, invoice and payment records	Six years after the end of the financial year to which they relate, to meet tax and accounting requirements and in case of legal claims.
Correspondence and notes about customers, suppliers and subcontractors	For the length of our relationship and for six years after it ends, in case of legal claims.
Contact details of former colleagues and professional contacts	For as long as we remain in touch. We review our contact records every two years and delete details that are no longer relevant.
Research notes about people we do not go on to work with or contact	12 months from when we collected them, unless we are in contact with you by then.
Website enquiries	Two years after our last contact with you, unless you become a customer or supplier.

8. How we protect your personal data

We use appropriate technical and organisational measures to keep personal data secure, including password-protected and multi-factor authenticated accounts, reputable cloud service providers and limiting what we enter into AI tools. If we become aware of a personal data breach that is likely to result in a risk to you, we will tell the ICO and, where required, we will tell you.

9. Your rights

You have the following rights in relation to your personal data. Some of them only apply in certain circumstances.

Access: to ask for a copy of your personal data.
Rectification: to ask us to correct personal data that is inaccurate or incomplete.
Erasure: to ask us to delete your personal data.
Restriction: to ask us to limit how we use your personal data.
Portability: to ask us to transfer personal data you have given us to you or another organisation, in a structured, commonly used and machine-readable format.
Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. We do not make decisions of this kind.

Your right to object: where we use your personal data on the basis of our legitimate interests, including for research and business development, you have the right to object at any time. We will then stop unless we have compelling legitimate grounds that override your interests, or we need the personal data for legal claims. If you object to us contacting you about our services, we will always stop.

To exercise any of these rights, please contact us using the details in section 11. We will not usually charge a fee, and we will respond within one month (which may be extended by up to two further months for complex requests).

10. Complaints

If you are unhappy with how we have used your personal data, please contact us first and we will try to resolve your concern. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.

11. Contact us

If you have any questions about this notice or how we use your personal data, please contact us by email at privacy@pointlumina.com.

12. Changes to this notice

We may update this notice from time to time. The latest version will always be available on our website at www.pointlumina.com, and we will tell you about significant changes where appropriate.