Corporate Privacy Policy
Last Updated: 3rd July 2026
At Vermillion Health, we recognize the significance of protecting your information. This policy outlines how we collect, use, disclose, and protect your personal data in accordance with your legal rights. The policy updates regularly, with changes noted by the last update date.
Data Storage by Region
Depending on the location of your healthcare provider, your data may be stored and processed in a different region.
- EU healthcare providers: data stored in EU
- UK healthcare providers: data stored in UK
- USA healthcare providers: data stored in USA
About Vermillion Health
Vermillion Health Technologies (UK) Limited (Company number: 16873746), with its registered office at Suite 3 Dukes House, 4-6 High Street, Windsor, Berkshire, England, SL4 1LD, delivers neurofeedback and rehabilitation through digital apps (Alevia App), hardware products (Alevia Neurofeedback Headset), and cloud services (Vermillion Health Connect).
UK Legal Framework & Data Protection Officer
Vermillion Health Technologies (UK) Limited processes personal data of UK users in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a UK-established company, Vermillion Health is not required to appoint an Article 27 UK Representative.
Data Protection Officer (DPO): We have appointed a Data Protection Officer to oversee our privacy practices. For any inquiries regarding your data, or to exercise your data rights, you can contact our DPO directly at privacy@vermillionhealth.com. You may also reach us by mail at our registered Windsor office address listed above.
The supervisory authority for UK users is the Information Commissioner’s Office (ICO). If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the ICO at ico.org.uk.
Personal Data Identification
Personal data encompasses any information enabling identification, including obvious details like name and contact information, as well as less obvious identifiers and online data. The company also processes special category data including health information.
Your rights
Users possess several data-related rights, including under UK data protection legislation for UK users:
- Right to be informed through this policy
- Right to access, correct, update, or delete information
- Right to object to processing based on legitimate interest
- Right to refuse direct marketing (though the company currently conducts none)
- Right to data deletion or use restriction under certain circumstances
- Right to data portability
- Right to withdraw consent anytime
For UK users, these rights are granted under the UK GDPR and Data Protection Act 2018. The primary intake point for Right to Erasure requests and Subject Access Requests (SARs) is our DPO at privacy@vermillionhealth.com.
Contact Information
Inquiries about data collection, use, or protection should be directed to privacy@vermillionhealth.com.
Supervisory Authority
Users may lodge complaints with their data protection authority.
New Zealand residents:
New Zealand Office of the Privacy Commissioner
PO Box 10 094,
The Terrace,
Wellington 6143
+64 (09) 3028680
Website: https://www.privacy.org.nz/
United Kingdom residents:
Information Commissioner’s Office (ICO)
https://ico.org.uk
Data Collection
The company collects personal and sensitive data to conduct business and provide services.
(a) Personal and sensitive personal data
- Name, phone number, email address, password
- Physical or postal address
- Age, date of birth, sex, medical information, health data
- Patient Reported Outcome Measures (PROMs) like sleep, pain, anxiety, depression scores
- Daily task completion data and symptom ratings
(b) Other Information
Anonymous, aggregated, de-identified, or non-identifying information.
Data Usage and Legal Basis
The company does not use personal data for marketing and does not share data with third-party marketing services.
| Data Type | Purpose | Legal Basis | UK GDPR Article 6/9 Basis |
|---|---|---|---|
| Name, email, phone, address | Service delivery communication, customer/technical support, service updates | Necessary for service provision | Art. 6(1)(b) – Performance of a Contract |
| Usage statistics | Compliance reporting to user and healthcare provider | Healthcare provider monitoring necessity | Art. 6(1)(f) – Legitimate Interests |
| Patient-reported outcomes and diaries | Historical outcome records, general wellness information | Service provision and provider monitoring | Art. 9(2)(h) – Provision of Health or Social Care |
| EEG brain data | Historical records, customer/technical support | Service provision and provider monitoring | Art. 9(2)(h) – Provision of Health or Social Care (or Art. 9(2)(a) Explicit Consent where (h) does not apply) |
| Financial/product information | Time-based subscription purchasing | Legitimate business purposes | Art. 6(1)(f) – Legitimate Interests |
Data Retention
We do not keep personal data for longer than is necessary for the purpose it was collected for. As a general rule, patient/user data is retained for 8 years following the conclusion of treatment or your last interaction with the service, in line with the NHS Records Management Code of Practice for digital health and medical device records, or such longer period as required to meet other legal, regulatory, or healthcare record-keeping obligations.
International Transfers & Access
While UK user data is stored securely within the United Kingdom (see Data Storage by Region above), certain authorized support, engineering, and maintenance operations may be conducted by our technical teams located in the United Kingdom and New Zealand, on behalf of Vermillion Health Technologies (UK) Limited.
This cross-border data access is fully lawful and compliant with the UK GDPR, as New Zealand is officially recognized by the UK government’s adequacy regulations as providing an adequate level of data protection. Where data is transferred to or accessed from any other jurisdiction not covered by a UK adequacy decision, we rely on Standard Contractual Clauses (SCCs) or another appropriate safeguard.