PRIVACY POLICY
Policy version: 17-Oct-2026
INTRODUCTION
This Privacy Policy is provided by Velora Evidence Ltd, a company registered in England and Wales under company number 17245164, with its registered office at Belmont Suite Paragon Business Park, Chorley New Road, Bolton, United Kingdom, BL6 6HG (we, our or us). It explains how we handle personal data in connection with our business website https://veloraevidence.com (Website), enquiries, professional business contacts and related communications (together, the Services).
We are generally the controller of personal data collected for these purposes. This means we decide how and why that personal data is processed. Our processing is governed by applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy explains the personal data we collect, the purposes and lawful bases for processing it, with whom we may share it, how long we retain it, relevant international transfers and your data protection rights.
WHAT THIS POLICY APPLIES TO
This Privacy Policy applies to visitors to the Website, individuals making enquiries and business contacts who communicate with us about our medical affairs, real-world evidence and related consultancy services. Our customers are principally pharmaceutical, biotechnology and medical technology organisations. The Website is designed for professional and business enquiries, not patient care.
Our consultancy work may be governed by separate client contracts and, where applicable, client-specific data protection notices or arrangements. This Privacy Policy does not purport to explain the processing carried out by our clients as independent controllers.
Links to external websites or services, including social media platforms, may be subject to those providers’ own privacy notices. We do not control their independent processing activities.
PERSONAL DATA WE COLLECT ABOUT YOU
The types of personal data we may collect depend on how you interact with us:
Category of data
In more detail
Business contact details
Name, work email address, business telephone number, employer or company name and job title or professional role.
Enquiry and correspondence data
The contents of your enquiry, messages, requests for proposals and other information you choose to include when contacting us, including information you enter in our Website contact form or brochure download form.
Relationship and engagement data
Records of meetings, business communications, quotations, contract administration and other dealings with prospective and current business contacts, where relevant.
Technical and usage data
IP address, browser and device characteristics, approximate location derived from IP address, server logs, the pages accessed and related security and usage information, which our website host, Framer (and its infrastructure providers, such as Cloudflare), collects automatically in server and access logs, including the date and time of your visit and the pages requested. We do not use analytics tools on the Website.
Marketing preferences
Any record of your subscription, consent (where required), marketing preferences or objection to direct marketing, if and when marketing lists or newsletters are introduced.
If you choose not to provide information needed to respond to an enquiry, we may be unable to assist you or consider a request to engage our services. The Website does not offer user accounts, online bookings or payments.
SPECIAL CATEGORY, PATIENT AND SAFETY INFORMATION
We do not ask Website visitors to provide personal information about their health or other special category personal data, patient-identifiable clinical information, or information about criminal convictions. Our consultancy work involves anonymised or aggregated real-world evidence outputs, and we do not collect or manage raw or identifiable patient-level data. During our engagements we may process the professional contact and engagement details of healthcare professionals, researchers and other experts, which we handle as described in this Privacy Policy.
Please do not submit patient-identifiable data, sensitive clinical information, adverse-event reports or urgent medical matters through the Website’s general enquiry form. We are not a pharmaceutical company or marketing authorisation holder and do not process adverse-event or product-safety reports. If such information is nevertheless received, or a member of our team becomes aware of a potential safety event, we will pass it to the relevant marketing authorisation holder in line with its safety-reporting procedures, restrict access to it and securely delete it once it is no longer needed.
HOW YOUR PERSONAL DATA IS COLLECTED
We collect personal data directly when you complete our Website contact form or brochure download form, email or telephone us, request information, attend meetings, engage with us through professional networks or otherwise correspond with us. We may also receive your business contact details from your employer, colleagues, referrals or publicly available professional sources where permitted by law.
When you visit the Website, our website host automatically records technical information such as your IP address and access data, and sets strictly necessary cookies needed to run and secure the Website. Please read our Cookie Policy for further information.
HOW AND WHY WE USE YOUR PERSONAL DATA
Under data protection law, we must identify a lawful basis for each processing purpose. The main grounds relevant to our activities are our legitimate interests, steps needed for a contract with an individual where applicable, legal obligations and consent where required. Where we rely on legitimate interests, we consider those interests against individuals’ rights and reasonable expectations.
What we use your personal data for
Our reasons
Responding to enquiries and providing information about our services
Our legitimate interests in responding to business enquiries and developing client relationships. Where you are personally contracting with us, taking steps at your request before entering a contract may apply.
Communicating with client personnel, professional contacts and suppliers
Our legitimate interests in operating our business, administering engagements and managing professional relationships; legal obligations where relevant.
Administering a direct contract with an individual
Where applicable, performance of a contract with that individual or steps requested before entering it. A contract with a corporate customer does not, by itself, make this ground appropriate for each employee’s personal data.
Maintaining website performance, security and preventing abuse
Our legitimate interests in maintaining the Website, protecting systems and detecting misuse, and compliance with applicable legal obligations.
Website measurement and improvement
Our legitimate interests where the activity is lawful and does not require consent, or consent where applicable for non-essential cookies or similar technologies. Please see the Cookie Policy.
Sending direct marketing and professional updates
Our legitimate interests in appropriate B2B marketing where lawful, and consent where required by applicable electronic marketing rules. We will respect opt-outs and objections.
Legal, regulatory, accounting and dispute-related matters
Compliance with legal obligations and/or our legitimate interests in protecting and enforcing our legal rights.
Business sales or restructuring
Our legitimate interests in administering and protecting the business, subject to appropriate safeguards and any applicable legal obligations.
Where processing relies on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. For the processing of cookies and similar technologies, further details are set out in the Cookie Policy.
MARKETING
We may contact relevant business representatives about our consultancy services, professional insights, conferences or related news, where permitted by law. Any future mailing-list subscription or newsletter will be administered in accordance with the applicable rules for direct electronic marketing, including the Privacy and Electronic Communications Regulations 2003 (PECR) and, where relevant, other countries’ laws.
For UK corporate business contacts, some unsolicited business-to-business emails may be permitted without prior PECR consent, but we must still comply with data protection requirements, identify ourselves and provide a practical means to object. The rules are different for sole traders and certain partnerships, and consent or another permitted exception may be required. We will not assume that submitting a general enquiry constitutes consent to marketing.
You may object to direct marketing at any time by using the unsubscribe or opt-out method in the communication, or by contacting us using the details below. We will maintain relevant suppression records to respect your choice.
WHO WE SHARE YOUR PERSONAL DATA WITH
We may disclose relevant personal data, where necessary and subject to appropriate safeguards, to:
our website host and technical service providers, including Framer, and any suppliers supporting Website operation, security or maintenance;
our email, cloud storage, information technology, professional communication and customer relationship management providers, where used;
our professional advisers, including legal, tax, audit and accounting advisers;
relevant customers or service providers where necessary to respond to or administer an engagement, consistent with applicable contractual arrangements, including passing any potential safety event to the relevant marketing authorisation holder;
public authorities, regulators, law enforcement agencies, courts and tribunals where disclosure is required or permitted by law; and
a prospective buyer, investor or successor in connection with a bona fide sale, investment or restructuring of our business, subject to appropriate safeguards.
We require processors acting on our behalf to process personal data under appropriate contractual obligations and in accordance with applicable law. We do not sell personal data to third parties for their own marketing.
HOW LONG YOUR PERSONAL DATA WILL BE KEPT
We keep personal data only for as long as reasonably necessary for the purposes for which we collected it, including responding to enquiries, managing business relationships and satisfying legal, tax, accounting, regulatory or dispute-related obligations. Relevant factors include the nature and sensitivity of the data, the continuing relationship, retention requirements and potential legal claims.
Routine enquiries that do not result in a business relationship will normally be reviewed for deletion sooner than core contractual or accounting records. Where an applicable legal retention period requires records to be kept, we will retain them for that period and securely erase or anonymise them when no longer required.
TRANSFERRING YOUR PERSONAL DATA OUT OF THE UK
Our business has an international client base, and some suppliers and business contacts may be located outside the United Kingdom. Personal data may therefore be accessed from or transferred to other countries, including in connection with Website hosting, cloud services, professional communications and international engagements.
Where a transfer from the UK is a restricted transfer under the UK GDPR, we will use a lawful transfer mechanism, such as an applicable UK adequacy regulation, approved contractual safeguards (including the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses where appropriate), or another permitted exception, together with any additional measures required.
You may request information about the safeguards applicable to a relevant transfer by contacting us using the details below.
YOUR RIGHTS
Subject to conditions and exemptions under applicable law, you may have the following rights in relation to personal data we hold about you:
Access
Request a copy of your personal data.
Rectification
Ask us to correct inaccurate personal data or complete incomplete data.
Erasure
Ask us to erase personal data in certain circumstances.
Restriction
Ask us to restrict processing in certain circumstances.
Data portability
In certain cases, receive data you provided to us in a structured, commonly used and machine-readable form and transmit it to another controller.
Objection
Object at any time to direct marketing, and object to certain other processing based on legitimate interests.
Withdraw consent
Withdraw consent at any time, where consent is the lawful basis for processing.
Automated decision-making
Exercise applicable rights in relation to solely automated decisions producing legal or similarly significant effects. We do not currently envisage making such decisions through the Website.
To exercise a right, contact us using the details below and describe your request. We may ask for proportionate information to verify your identity. We will respond within the timeframe required by applicable law. You will not usually be charged for exercising your rights.
KEEPING YOUR PERSONAL DATA SECURE
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration and loss, taking into account the nature of the data and risks involved. Access is limited to those with an appropriate business need. No internet transmission or storage system is completely risk-free.
Where required by law, we will notify the relevant supervisory authority and affected individuals of personal data breaches.
HOW TO COMPLAIN
If you have a concern about our use of personal data, please contact us first so that we can consider it. You also have the right to complain to the UK Information Commissioner’s Office (ICO), at www.ico.org.uk/make-a-complaint or telephone 0303 123 1113.
CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most recent version will be published on the Website with its effective date. Where appropriate, we will provide additional notice of material changes.
HOW TO CONTACT US
The data controller for the processing described in this Privacy Policy is Velora Evidence Ltd, company number 17245164, at Belmont Suite Paragon Business Park, Chorley New Road, Bolton, United Kingdom, BL6 6HG. We are registered with the UK Information Commissioner's Office under registration number ZC265936.
Privacy enquiries and requests may be sent to: privacy@veloraevidence.com.