1. About this notice
This Privacy Policy explains how Bantham Radar Limited ("Bantham", "we", "us") handles personal information in connection with www.radarskinhealth.com (the "Website"), related enquiries and the RADAR Skin Health app and case management platform (the "Platform"). It distinguishes information processed for our own purposes from patient information processed on behalf of healthcare organisations. Effective date: 23rd October 2026.
2. Who is responsible for your information
For Website visits, enquiries, business contacts, supplier relationships and our own account administration, Bantham is normally the controller. For clinical information submitted to the Platform at the instruction of a GP practice, hospital, dermatologist or other healthcare organisation ("Healthcare Provider"), that Healthcare Provider is normally the controller and Bantham normally acts as its processor under a written data processing agreement. The Healthcare Provider determines the clinical purposes and lawful basis for processing patient data. Certain independent activities, if any, must be assessed separately and documented. Nothing in this notice replaces the Healthcare Provider’s own patient privacy notice.
3. Contact details
Bantham Radar Limited. Privacy contact: info@banthamradar.com. Registered office: Station House, Station Road, St. Ives, Cambridgeshire, PE27 5BH. Registered Company number: 13599757. If your enquiry concerns your clinical record, please contact your Healthcare Provider first. You can also contact the UK Information Commissioner’s Office at ico.org.uk.
4. Information we collect
Website and business data may include your name, professional role, organisation, business email, telephone number, correspondence, demonstration requests, preferences, and account or support records. Technical data may include IP address, browser and device characteristics, approximate location derived from IP, access logs and cookie identifiers. Where you use the Platform as a patient, information may include identifiers, contact details, questionnaire responses, skin and other health information, photographs, metadata, relevant clinical history, referral and assessment records, and clinician comments. Health information is special-category personal data. Do not submit clinical or patient information through a general Website contact form.
5. How we use information and our legal bases
As controller, we use enquiry information to respond to requests and arrange demonstrations (legitimate interests or steps requested before a contract); administer business relationships and user access (contract and legitimate interests); maintain security, prevent misuse and investigate incidents (legitimate interests and, where relevant, legal obligations); meet accounting, regulatory and legal duties (legal obligation); and send marketing only where permitted by applicable electronic-marketing rules (consent where required, or another applicable PECR route). We will identify and document the applicable lawful basis for each activity. For patient health data processed for a Healthcare Provider, the Healthcare Provider identifies the Article 6 lawful basis and Article 9 condition; Bantham processes that data on documented instructions and does not rely on a generic patient consent to justify all processing.
6. Clinical information and the RADAR service
The Platform enables patients to submit structured information and images for review by authorised healthcare professionals. Depending on the contracted service, authorised users may review, manage and export information into their clinical record systems. Access is role-based and subject to contractual and security controls. Clinical decisions remain with the responsible Healthcare Provider. We do not use identifiable patient data for our independent marketing or for training or improving AI models unless a separately documented lawful arrangement, appropriate transparency and other required safeguards are in place.
8. International transfers
Where personal data is accessed or processed outside the UK, we will apply an appropriate transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any necessary risk assessment.
9. Security
We use organisational and technical safeguards proportionate to the sensitivity of the information, including controlled access, confidentiality requirements, monitoring and appropriate protections in transit and at rest. No internet service can be guaranteed entirely secure. Security claims, including encryption, should reflect tested actual arrangements and must be consistent across the Website, app-store listings and contractual documentation.
10. Retention
We retain controller information only as long as needed for the stated purpose, legal duties and defensible business records. Patient information held on behalf of Healthcare Providers is retained, returned or deleted in accordance with the relevant contract, documented instructions and applicable clinical-record obligations; copies within backups may be subject to controlled deletion cycles. We will not promise automatic deletion after a fixed period unless that is technically and contractually accurate.
| Data Type | Retention Period |
|---|---|
| ISMS (ISO27001) | 10 Years |
| QMS (ISO9001) | 10 Years |
| Clinical Data | As per contracted terms |
12. Your rights
Subject to legal conditions and exceptions, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent where processing depends on consent. You may also complain to the ICO. We will respond to controller requests in accordance with applicable law. For patient data controlled by a Healthcare Provider, we will assist that organisation with requests as required by our agreement; you should normally contact the provider directly. Rights are not absolute, particularly where healthcare records must be retained.
13. Children and vulnerable individuals
The Platform may be used in relation to children where an authorised Healthcare Provider offers that service and appropriate safeguards and parental responsibility or other lawful arrangements apply. The public Website is intended principally for healthcare professionals and adult visitors. We do not use an arbitrary age threshold to deny that clinically authorised patient records may concern children.
14. Automated processing and AI
The Platform may contain automated workflow, comparison or decision-support functionality. The Platform is intended to support, not replace, assessment by appropriately qualified healthcare professionals. Any material change to processing purposes or AI uses requires separate review.
15. Changes to this policy
We may update this notice to reflect changes in law, technology or our processing. The current version and effective date will appear on the Website. Where required, we will provide additional notice before materially different processing begins.