Last Updated: June 19, 2026
Our Commitment to GDPR
aura-heath is committed to complying with the General Data Protection Regulation (GDPR) and UK data protection legislation. We process personal data lawfully, fairly, and transparently, ensuring that your rights as a data subject are respected and protected.
Data Controller Information
For the purposes of data protection legislation, the data controller is:
aura-heath
47 West George Street
Glasgow, G2 1BP
United Kingdom
Email: [email protected]
Principles of Data Processing
We adhere to the following data protection principles:
- Lawfulness, fairness, and transparency: We process data legally and inform you about how it is used
- Purpose limitation: Data is collected for specific, explicit, and legitimate purposes
- Data minimization: We collect only the data necessary for our stated purposes
- Accuracy: Personal data is kept accurate and up to date
- Storage limitation: Data is retained only as long as necessary
- Integrity and confidentiality: Appropriate security measures protect your data
- Accountability: We demonstrate compliance with these principles
Your Data Subject Rights
Under GDPR, you have the following rights regarding your personal data:
Right to Be Informed
You have the right to clear information about how we collect and use your personal data. This information is provided through our Privacy Policy and this GDPR statement.
Right of Access
You can request a copy of the personal data we hold about you. We will provide this information in a commonly used electronic format within one month of receiving your request.
Right to Rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. We will make corrections within one month of being notified.
Right to Erasure
You may request deletion of your personal data in certain circumstances, including where:
- The data is no longer necessary for the purposes it was collected
- You withdraw consent and there is no other legal basis for processing
- You object to processing and there are no overriding legitimate grounds
- The data has been unlawfully processed
Please note that we may need to retain certain information to comply with legal or regulatory obligations.
Right to Restrict Processing
You can request that we limit how we use your data in specific situations, such as when you contest the accuracy of the data or object to processing.
Right to Data Portability
Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object
You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
Rights Related to Automated Decision Making
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. We do not currently engage in automated decision-making of this nature.
How to Exercise Your Rights
To exercise any of your data subject rights, please contact us by email at [email protected] or by post at the address above. We will:
- Respond to your request within one month
- Verify your identity before disclosing any personal information
- Provide information free of charge unless requests are manifestly unfounded or excessive
- Explain any reasons if we cannot comply with a request
Data Breach Notification
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We maintain procedures to detect, report, and investigate data breaches and will notify the relevant supervisory authority within 72 hours where required.
International Data Transfers
We do not routinely transfer personal data outside the United Kingdom. Should such transfers become necessary, we will ensure appropriate safeguards are in place in accordance with GDPR requirements.
Complaints
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: ico.org.uk
Updates to This Statement
We may update this GDPR compliance statement periodically to reflect changes in our processing activities or regulatory guidance. The date of the latest revision is shown at the top of this page.