Privacy Policy

This notice covers archipelagohealth.org and the enquiries sent through it. It is written to meet Article 12 of the Data Protection (Jersey) Law 2018, and we have tried to keep it in plain language. It does not cover the Longitude test itself: when the test becomes available, the clinical data involved will be explained in a separate notice given at the point of ordering.

Who we are

The controller of the personal data described here is Archipelago Health Holdings Limited, trading as Archipelago Health, a company registered in Jersey with number 166172.

We have not appointed a data protection officer; the law does not require one for an organisation of our size. Questions about anything in this notice go to the email address above.

What we collect, why, and on what basis

Jersey law requires a lawful basis under Schedule 2 of the Data Protection (Jersey) Law 2018 for each thing we do with personal data. We use four, and we have set them out activity by activity rather than once for the whole site.

Messages and partner enquiries

When you use the contact form, the partner enquiry form or simply email us, we receive your name, email address, your message and, for partner enquiries, your organisation and the kind of organisation it is. We use these to answer you and, for partners, to send the partner pack you asked for.

Basis: steps taken at your request with a view to a possible agreement (Schedule 2, Part 1, paragraph 2). You asked us something; this is what it takes to reply.

Registering interest in Longitude

The register-interest form on the home page collects your name and email address. We use them for one purpose: to tell you when Longitude becomes available where you are, and how to get it.

Basis: your consent (Article 11), given by submitting the form. You can withdraw it at any time by replying to any email we send or writing to enquiries@archipelagohealth.org, and we will stop. That right to stop direct marketing is absolute under Article 36 of the Law: there is no balancing test on our side.

Analytics

If, and only if, you accept analytics cookies, Google Analytics records which pages are viewed, roughly where visitors are, what device and browser they use and how they arrived. This is tied to a random identifier in a cookie, not to your name, and Google Analytics does not store your IP address. Nothing is loaded and no analytics cookie is set until you accept.

Basis: your consent (Schedule 2, Part 1, paragraph 1), which you can withdraw in one click on the cookie page. Jersey has no separate cookie law, so we could lawfully run analytics without asking; we ask anyway. The cookie policy lists exactly what is set.

Server and security logs

Like every website, our hosting platform records each request: the IP address it came from, the page requested, the time, and the browser identification string. We use these logs to keep the site running, to spot faults and to detect and block abuse. Our forms also include a hidden field that only automated spam fills in; submissions that trip it are discarded and not read.

Basis: our legitimate interests (Schedule 2, Part 1, paragraph 5). The interest is the security and reliability of the site. We think this is a fair use of the data because it is the minimum any web server needs, it is what every visitor to any website expects, nobody looks at the logs unless something goes wrong, we do not use them to build profiles of anyone, and they are deleted on the platform's normal schedule. We judged that this does not prejudice your rights or interests.

Where the law requires it

If we are legally obliged to disclose personal data, for example to a court or a regulator, we will do so under Schedule 2, Part 2, paragraph 7 of the Law.

What we do not do

We do not collect health data through this website. We do not sell personal data, share it with advertisers, or add you to any list you did not ask to join. We do not pass website enquiries to Nightingale Health or any other partner unless you ask us to.

Who receives your data

Your data is seen by the small Archipelago Health team who handle enquiries. Two companies process it on our behalf, under contracts that restrict them to our instructions:

• Google (Google LLC and its affiliates, United States). Hosts this website (Firebase App Hosting, in the Netherlands (Google Cloud region europe-west4)), provides our Archipelago Health mailboxes (Google Workspace) and, only if you accept analytics cookies, Google Analytics.
• Resend (Resend, Inc., United States). Delivers the emails that carry your form submission to us and the acknowledgement back to you.

Beyond that, we would share data only with our professional advisers when needed, with a buyer if the business were ever sold, or where the law requires it.

Transfers outside Jersey

The website itself runs in the Netherlands (Google Cloud region europe-west4). Both processors above are United States companies, so some data, including our mailbox contents and, with your consent, analytics data, is processed in the United States.

Article 66 of the Law allows a transfer where the destination ensures an adequate level of protection. Google and Resend are each certified under the EU-US Data Privacy Framework, which the European Commission has recognised as adequate; Jersey adopts the Commission's adequacy decisions, so these transfers are adequate under Article 66(2)(a). As a second safeguard we also rely on the standard contractual clauses in each company's data processing terms, recognised under Article 67.

How long we keep it

We do not keep a database of website visitors. Form submissions arrive as emails and live in our enquiries mailbox, which we treat as the record. We keep:

• Messages and partner enquiries for as long as there is a realistic chance of the conversation continuing. We review the mailbox at least once a year and delete threads that have gone quiet. If an enquiry becomes a working relationship, we keep the correspondence for the life of that relationship and for as long afterwards as our record-keeping obligations require.
• Interest registrations until we have told you about the launch and any follow-up you asked for, or until you ask us to stop, whichever is first.
• Analytics data for the period set in our Google Analytics account; we keep this at Google's default, under which identifiable event data is deleted after two months and only aggregate reports remain.
• Server logs for the hosting platform's default retention period, currently 30 days.

Whatever the schedule, you can ask us to delete your data sooner; see your rights below.

Your rights

Part 6 of the Data Protection (Jersey) Law 2018 gives you the right to:

• ask for a copy of the personal data we hold about you (Articles 28 to 30);
• have inaccurate data corrected (Article 31);
• have your data erased (Article 32);
• have processing restricted while a dispute is resolved (Article 33);
• receive the data you gave us in a portable, machine-readable form (Article 34);
• object to processing based on our legitimate interests (Article 35);
• object to direct marketing, which we must always honour (Article 36);
• withdraw any consent you have given, at any time, as easily as you gave it (Article 11). Withdrawing does not affect what was done before.

To exercise any of these, email enquiries@archipelagohealth.org. We may ask you to confirm who you are before we release or change anything. We will respond without undue delay and in any event within 4 weeks, free of charge. If a request is unusually complex we may take up to 8 weeks longer, and if so we will tell you why within the first 4 weeks. If we ever refuse a request we will explain our reasons and remind you of your right to complain to the regulator and to seek a remedy from the court.

Complaints

If you think we have handled your data badly, please tell us first and we will try to put it right. You also have the right to complain to the Jersey Data Protection Authority, which operates as the Jersey Office of the Information Commissioner (JOIC):

Do you have to give us your data?

No. Nothing on this site requires it by law or by contract. The only consequence of not filling in a form is that we cannot reply to you or tell you when Longitude is available. You can read every page without giving us anything, and the site works fully with analytics turned off.

Automated decisions

We do not make any automated decisions about you, and we do not profile visitors.

Where the data comes from

Everything described here comes from you: what you type into a form or an email, and the technical information your browser sends with every request. We do not buy data about visitors or enrich enquiries from other sources.

Children

This site is written for adults and for organisations. We do not knowingly collect personal data from anyone under 13, the age at which a person can consent for themselves online under Jersey law. If you think a child has sent us their details, email us and we will delete them.

Security

The site is served only over HTTPS with a strict content security policy, form submissions travel encrypted to our mailbox, and there is no database of visitor data to breach. Access to the mailbox is limited to the people who need it. No system is perfectly secure, but we keep the amount of data we hold as small as the job allows.

Changes to this notice

We will update this notice when what we do changes, for example when Longitude launches and a results process exists. The effective date at the top always shows the current version. If a change affects how we use data you have already given us, we will tell you by email where we can.