Sanguina EU and UK Privacy Notice

Effective Date: March 26, 2025

Sanguina provides products and services for anemia screening, including a mobile application, AnemoCheck
Mobile (our “App”), that allows individuals (“Users”) to measure the likelihood of having iron deficiency or iron deficiency anemia by photographing fingernail capillary beds and tracking iron levels. This Privacy Notice describes how Sanguina collects, shares, or otherwise processes personal information in the context of our App and our website, https://sanguina.com/ (our “Website”), and is addressed to Users and Website visitors (“Visitors”) in Europe (“EU”) and the United Kingdom (“UK”).

For individuals who interact with us online, we collect information you choose to give us and other information that may be collected from your use of our Website and App, including from your device. We use that information to operate our business and for the purposes set forth below. Below, we also describe the choices we offer with respect to your information.

This Privacy Notice does not apply to information for which Sanguina does not determine the purpose and means of processing. This Privacy Notice does not apply to information that cannot be identified by any individual, household, or their devices, such as de-identified or anonymized information.

The sections of this EU and UK Privacy Notice are hyperlinked below for your convenience:

  • Information Collection and Purpose of Processing
  • Legal Basis for Processing
  • How We Share Information
  • Data Retention
  • Your Rights Under EU and UK Law
  • Contact Information

Information Collection and Purpose of Processing

For information regarding the personal information we collect, the types and for information regarding the personal information we collect, the types and
sources of collection, and the purposes for which we process personal data, please see the “Information We Collect,” “Automatic Information Collection, Logging,
and Tracking,” and “Other Ways We Use Information We Collect” sections of our U.S. Privacy Notice. These sections apply to our EU and UK operations and are incorporated by reference into this EU and UK Privacy Notice.

Users and Visitors provide personal information to Sanguina on a voluntary basis, though the provision of some personal information may be necessary in order to enter into a contract and to commence a business relationship with us. Failure to provide certain personal information may result in Sanguina being unable to
provide our Website or the services associated with our App.


Legal Basis for Processing

Sanguina processes personal data of App Users and Website Visitors in the EU and UK pursuant to the following legal bases for processing:

  • We have obtained consent from you for such processing for one or more specific purposes;
  • Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
  • Processing is necessary in order to protect the vital interests of a data subject or of another natural person;
  • Processing is necessary for compliance with a legal obligation to which Sanguina is subject;
  • Processing is necessary for the purposes of our or a third party’s legitimate interests.


Where relying on legitimate interests for processing, such legitimate interests may include any or all the uses detailed above in this EU and UK Privacy Notice and incorporated by reference from our U.S. Privacy Notice, taking into consideration reasonable expectations of data subjects based on the relationship with us.

Where we rely on your consent, you may withdraw your consent at any time, without affecting the lawfulness of processing based on your consent before withdrawal.


How We Share Personal Information

We may share your information with third parties as reasonable to operate our business (including for the purposes described above), to provide the Website and App to you and others, as permitted or required by law, or as directed or authorized by you. For example, we may share data with:

 Third Parties. We may share personal data with third parties utilizing or irecting others to utilize our echnologies, such as pharmaceutical companies, academic or research institutions, or medical device providers. For example, if such a third party utilizes a White Label App, the information provided to the app is available to such third parties.

Affiliated Organizations.  We may share some or all of your information with our parent organizations, subsidiaries, affiliates, joint ventures, or other organizations or entities under common control with us.

 Other Third Party Sharing. We work with third parties to help us provide our Website and App and to support internal operations. In some cases, they may use your information subject to their own privacy policies and to comply with their own legal and regulatory obligations. We work with different types of third parties, presently including:

  • Data hosting, storage and cloud service providers;
  • Payment processors;
  • Platform and/or application security service providers;
  • Technical and customer support providers;
  • Marketing and analytics providers; and
  • Other third parties

 Professional Advisors, Law Enforcement and Regulators. We share information with our professional advisors who provide legal, compliance,
auditing, accounting, banking, consulting, or other professional services, and with regulators, law enforcement, or government agencies, including to:

  • Comply with our legal and regulatory obligations, including those compliance obligations of federal, state or local regulators; 
  • Protect our interests, property or legal rights, or those of our customers or third parties;
  • Respond to a subpoena, court order, or similar law enforcement request, or when we believe in good faith that the disclosure of personal information is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of this Privacy Notice or other applicable terms; and
  • For other legal purposes, such as to enforce our terms and conditions, or to exercise or defend legal claims. 

Transaction Impacting the Organization as a Whole. In the event of a transaction or reorganization impacting us as an entity or organization, we may share your personal information. We may share your information in connection with, or during the diligence or negotiation of, any merger, sale of company stock or assets, financing, acquisition, restructuring, divestiture or dissolution of all or a portion of our business, or other similar event.

Other Data Exchanges. As permitted by law, or if you consent, we may share information we collect in exchange for monetary or other consideration.

Other Disclosures. In addition to the above disclosures, we may disclose personal information in the event that we believe such disclosure is (i) necessary to provide our products and services or operate our business; (ii) in accordance with purposes we describe when you share it with us; (iii) permitted by law; or (iv) with your consent or at your direction.

 We may disclose aggregated or deidentified information that does not identify any individual without restriction.


Profiling

As a part of our services, we may utilize automated processing to evaluate certain personal aspects relating to you, including your health, behavior, location,
movements, or other information. In order to produce such analysis, we may collect/process information, including through automated processing, such as age, sex, and anemia status to personalize your experience on the App, identify key demographics for marketing purposes, and/or to provide in-App content customized to you. For more information regarding your rights regarding profiling, see the “Your Rights Under EU and UK Law” section below.


Data Retention

Sanguina will maintain your personal data for as long as we have a business purpose to do so related to the purposes of collection. We will delete your account information, including login and password, upon request.

We may retain personal data when required by law, regulation, or professional standards to maintain the data for a longer period of time.


Your Rights Under EU and UK Law

Under EU and UK law, you have the following rights:

- Right of access. You have the right to obtain from the us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data certain other information, including the purposes of processing, the categories of data concerned, and information regarding recipients. You also have the right to be informed of any appropriate safeguards related to transfers of your personal data to third countries.

- Right of Rectification. You You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary
statement.

- Right to be Forgotten. You have the right to obtain from us the erasure of personal data concerning you without undue delay where certain grounds apply.

- Right to Restriction of Processing. You have the right to obtain from us restriction of processing where one of the following applies:

  • You contest the accuracy of the personal data.
  • The processing is unlawful and you oppose the erasure of the personal data.
  • We no longer need the personal data for the purposes of the processing, but you require the data for the establishment, exercise, or defense of legal claims.
  • You have objected to processing and the objection is pending verification as to whether our legitimate grounds override your objection.

- Right to portability. You have the right to receive personal data oncerning you, which you provided to Sanguina, in a structured, commonly used and machine-readable format and you have the right to transmit that data to another controller without hindrance from us.

- Right to object. You have the right to object on grounds related to your particular situation to our processing on the basis of legitimate interests and/or processing for direct marketing purposes.

- Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the UK or the EU Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing infringes the GDPR.

- Right to  opt out of profiling. You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or that similarly significantly affects you.

 
International Data Transfers

Sanguina may engage in international transfers of personal data of EU and UK residents to the categories of parties described in the “How We Share Personal Information” section, and internally, within the Sanguina organization. We transfer data across borders for the purposes described above in this EU and UK Privacy Notice, including as necessary to run our business and to provide and support our Website and App.

 Sanguina complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. Sanguina has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program, please visit https://www.dataprivacyframework.gov/. To view the entire DPF List, visit https://www.dataprivacyframework.gov/list. To view our DPF Notice, visit https://sanguina.com/pages/dpf-notice.


Contact Information

Sanguina operates via the following legal entity: Sanguina, Inc. 

VeraSafe has been appointed as Sanguina’s representative in the European Union and the United Kingdom for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union as well as Article 27 of the Unite Kingdom General Data Protection Regulation. If you are in the European Economic Area or the United Kingdom, VeraSafe can be contacted in addition to Sanguina (support@sanguina.com), only on matters related to the processing of personal data.

 To make such an inquiry, please contact VeraSafe using this contact form: https://verasafe.com/public-resources/contactdata-protection-representative or via telephone at: +420 228 881 031 (European Economic Area) or +44 (20) 4532 2003 (United Kingdom). Alternatively, VeraSafe can be contacted at:

European Economic Area:

VeraSafe Ireland Ltd.
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork T23AT2P
Ireland

United Kingdom:

VeraSafe United Kingdom Ltd.
37 Albert Embankment
London SE1 7TL
United Kingdom

If you have any questions or concern about this Privacy Notice or the privacy practices at Sanguina, please contact us at support@sanguina.com.