Legal

Privacy Policy

Last updated: 7 June 2026 · Applies to sequova.com and the NEUROS waitlist.

1. Overview

This Privacy Policy explains how Sequova (“Sequova”, “we”, “us”, “our”) collects, uses, stores and protects personal data when you use this website. It is written to comply with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (“PECR”). The website is operated from the United Kingdom and is intended for adult, professional users.

2. Who we are (data controller)

  • Sequova is the “data controller” for personal data processed through this website, meaning we decide why and how it is processed.
  • General contact: info@sequova.com.
  • Privacy and data protection contact: info@sequova.com — please put “Privacy” in the subject line so we can route it correctly.
  • We are not required to appoint a Data Protection Officer under Article 37 UK GDPR, but the contact above is our designated point for all privacy queries.

3. Personal data we collect

We deliberately collect the minimum data needed to operate the website and respond to you.

  • NEUROS waitlist form: your email address.
  • Contact form: your name, email address, and the contents of any message you send.
  • Direct email: if you write to info@sequova.com, we receive your email address and whatever you choose to include.
  • Technical data: when you visit the site, our hosting provider may automatically log standard request data (IP address, browser user-agent, referrer, timestamp, requested URL, response code) for security, abuse prevention and basic operational diagnostics.
  • Special category data: we do not knowingly collect special category data (Article 9 UK GDPR) such as health, ethnicity, religious or political data. Please do not send any in your messages.

4. Purposes and lawful bases

Under Article 6 UK GDPR we must have a lawful basis for every purpose. Ours are:

  • Replying to enquiries — lawful basis: legitimate interest (Art. 6(1)(f)). It is in our legitimate interest, and yours, to receive a reply to a message you initiated.
  • Sending NEUROS waitlist updates and early-access information — lawful basis: consent (Art. 6(1)(a)), given when you submit the waitlist form. Reinforced for marketing by Regulation 22 of PECR.
  • Maintaining basic server and security logs — lawful basis: legitimate interest (Art. 6(1)(f)) in keeping the website secure and available.
  • Complying with legal obligations — lawful basis: legal obligation (Art. 6(1)(c)) where we are required to retain or disclose data by UK law.

We do not carry out profiling or automated decision-making that has legal or similarly significant effects on you (Article 22 UK GDPR).

5. Marketing and PECR

  • We only send marketing emails to people who have actively asked for them (the NEUROS waitlist).
  • Every marketing email includes a one-click unsubscribe link. Unsubscribing is free and processed promptly.
  • You can also withdraw consent at any time by emailing info@sequova.com with “Unsubscribe” in the subject.
  • We do not buy, rent, or otherwise acquire marketing lists, and we do not sell or rent your details to anyone.

6. Cookies and similar technologies

  • This website does not set advertising, tracking or analytics cookies.
  • Strictly necessary functional storage may be used by your browser (for example, to remember whether a form was submitted within the current session). These fall within the exemption in PECR Regulation 6(4) and do not require consent.
  • If we add analytics or other non-essential cookies in future, we will request your consent before they are set, in line with PECR and ICO guidance.

7. Service providers we share data with

We use a small number of trusted service providers (“processors”) who handle data on our written instructions and under contracts that meet Article 28 UK GDPR.

  • Supabase — database and authentication infrastructure; stores waitlist and contact-form submissions.
  • Vercel — website hosting and content delivery; processes basic request logs.
  • Email provider — used to send and receive correspondence with you.
  • We do not share your personal data with any third party for their own marketing purposes.
  • We may disclose personal data where required by law, by a court order, or to protect our legal rights, the rights of users, or public safety.

8. International transfers

  • Some of our processors are based outside the UK, including in the United States and the European Economic Area.
  • Where personal data is transferred outside the UK, we rely on one or more of the safeguards recognised under Article 46 UK GDPR: an adequacy decision by the UK Government, the UK International Data Transfer Agreement (“IDTA”), or the UK Addendum to the EU Standard Contractual Clauses, supplemented where appropriate by a transfer risk assessment.
  • You can request more information about the safeguards in place for any specific transfer by emailing info@sequova.com.

9. How long we keep data

  • NEUROS waitlist emails: kept until NEUROS launches and for up to 12 months after, or until you ask us to remove you — whichever is sooner.
  • Contact form submissions and email correspondence: kept for up to 24 months after the last meaningful exchange, then deleted, unless we are legally required to keep them longer.
  • Server and security logs: typically retained by our hosting provider for up to 30 days, then deleted or anonymised.
  • Records we are legally required to keep (for example, for tax or accounting): retained for the period required by the relevant UK law, then deleted.

10. How we protect your data

  • The website is served over HTTPS, and submissions are transmitted over encrypted connections.
  • Personal data is stored on infrastructure that uses encryption at rest and in transit, with access restricted to authorised personnel only.
  • We follow the principle of data minimisation and only collect data we actually need.
  • We keep our software, dependencies and access credentials reasonably up to date.
  • No system can be guaranteed 100% secure, but we take appropriate technical and organisational measures as required by Article 32 UK GDPR.

11. Data breaches

  • If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours, as required by Article 33 UK GDPR.
  • Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay (Article 34 UK GDPR).

12. Your rights under UK GDPR

You have the following rights in relation to your personal data:

  • Right to be informed — this notice exists to satisfy that right.
  • Right of access — ask for a copy of the personal data we hold about you.
  • Right to rectification — ask us to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — ask us to delete your data where one of the grounds in Article 17 applies.
  • Right to restrict processing — ask us to pause processing while we deal with a query.
  • Right to data portability — ask for a copy of data you provided to us in a structured, commonly used, machine-readable format.
  • Right to object — object to processing based on legitimate interests, or to direct marketing at any time.
  • Right to withdraw consent — where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
  • Rights related to automated decisions — we do not carry out solely automated decision-making with legal or similarly significant effects.

13. How to exercise your rights

  • Email info@sequova.com with “Data request” in the subject line and a clear description of what you want.
  • We may ask you to verify your identity before we act, particularly for access or erasure requests, in order to protect your data.
  • We will respond within one calendar month of receiving your request. For complex or numerous requests, we may extend that period by up to two further months and will let you know within the first month.
  • Exercising your rights is free of charge, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

14. Right to complain

  • We would always rather hear from you first so we can try to fix the problem.
  • You have the right to complain to the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection.
  • ICO website: ico.org.uk · Helpline: 0303 123 1113 · Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

15. Children

  • This website is intended for adults using Sequova in a professional context.
  • We do not knowingly collect personal data from anyone under 13.
  • If you are a parent or guardian and believe a child has submitted personal data, contact info@sequova.com and we will delete it without undue delay.
  • Our website may link to third-party websites and services that we do not control.
  • This Privacy Policy applies only to sequova.com. We are not responsible for the privacy practices of third parties — please review their own policies before sharing personal data with them.

We may disclose personal data where we are required to do so by UK law, by a court order, or by a regulator, or where disclosure is necessary to establish, exercise or defend legal claims. We will only disclose what is strictly necessary.

18. Changes to this policy

  • We may update this Privacy Policy from time to time. The “Last updated” date at the top of the page will always reflect the current version.
  • If we make a material change to how we handle personal data — for example, a new purpose or processor — we will take reasonable steps to bring it to your attention before it takes effect, including, where appropriate, by email to people on the waitlist.

19. Contact us

For any question about this Privacy Policy or how we handle your data, please contact info@sequova.com.