Privacy Notice

We are OpalMedica Ltd (“OpalMedica”, “we,” “our,” “us”) based at C/O Edwards Veeder (Uk) Limited Ground Floor, 4 Broadgate, Broadway Business Park, Chadderton, Oldham, Lancashire, United Kingdom, OL9 9XA.

This privacy notice (“Notice”) will help you understand how OpalMedica collects, uses, discloses, and protects your personal data when you interact with the My Rare Journey platform available at https://www.myrarejourney.com/ (our “Services”).

You can contact our Data Protection Officer at support@opalmedica.co.uk if you have any concerns or wish to exercise your rights described in this Notice.

Your Rights

Depending on where you live, you may have certain rights under applicable privacy and data protection laws. We respect these rights and provide ways for you to exercise them, subject to any legal limitations or exceptions. If you are located in the European Economic Area (EEA) or United Kingdom (UK), you have the following rights regarding your personal data:

• Your right of access. You have the right to ask us for copies of your personal data.
• Your right to rectification. You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure. You have the right to ask us to erase your personal data in certain circumstances.
• Your right to restriction of processing. You have the right to ask us to restrict the processing of your personal data in certain circumstances.
• Your right to object to processing. You have the right to object to the processing of your personal data in certain circumstances.
• Your right to data portability. You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.

If you are dissatisfied with our response you also have the right to lodge a complaint with the Data Protection Authority. This can be done at https://ico.org.uk/concerns/

How we Collect your Data

We may collect a variety of information from or about you or your devices from various sources, as described below.

Account Information. When you sign up for an account, we ask you for your e-mail address, username, profile picture, and your connection to rare disease.

Share Your Story. If you choose to share your story with our community, we will ask you for information such as the disease your story is about, your date of birth, sex assigned at birth, ethnicity, country of residence, and information about your diagnosis.

Community. When you share a story, ask a question, or offer support with our community, we will collect any information you choose to provide. Please note that any information you choose to share with the community will be available to all users of the Services and it is possible that users may share your information outside of the Services. Therefore, please do not share any information that you intend to keep confidential.

Communications. If you contact us directly, we may receive additional information about you, such as your name, email address, the contents of a message or attachments that you may send to us, and other information you choose to provide. When we send you emails, we may use embedded pixels or other technologies to track information about your receipt and interaction with our emails, such as whether and when you open them, whether you access any links included in our emails, how long you read our emails, whether you forward our emails and to whom, your Location Information (described below), and your Device Information (described below).

Contact Forms. If you complete one of our contact forms, we may collect information such as your name, email address, subject of the inquiry, and any other information you choose to provide.

We collect and store any content that you create, post, send, and share to our Services. This content includes any comments you post, emails and other communications that you send to us, and information you provide by responding to surveys or submitting a form. We also track how you engage with messages you receive in connection with our Services, such as notifications to complete an onboarding or learning activity.

When you visit our website, we may also capture details of your visits such as pages viewed and the resources that you access. Such information includes traffic data, location data (such as your IP address) and other communication data.

When you access or use our Services, we collect and store certain usage data. This includes the types of content you view or engage with, the frequency and duration of your activities, the scores you achieve in games/activities and your progression through the content.

We collect information about the people and groups you are connected to through the Services and how you interact with them, such as the people you communicate with the most.

Other users of our Services may provide information about you when they create or share content through our Services. For example, you may be mentioned by someone else on the forum/message board.

We collect information from or about the computers, phones, or other devices where you install or access our Services. We may associate the information we collect from your different devices, which helps us provide consistent services across your devices. Some examples of the device information we may collect include:

• Attributes such as the operating system, hardware version, device settings, file and software names and types, battery and signal strength, and device identifiers.
• Connection information such as the name of your mobile operator or ISP, browser type, language and time zone, mobile phone number and IP address.

We constantly strive to improve our Services and often introduce new features that may require the collection of new information. If we collect materially different personal data or materially change how we use your data, we will notify you and may also modify this Privacy Notice.

How we Process your Data

We may license anonymised datasets containing your data for the purposes of rare disease research, where you have consented for us to do so.

We operate internationally and may transfer personal data to other countries, where our servers and third-party service providers are located.

Data will be processed in either the UK, EEA/EU data centres or on US based servers. We may also process your data in countries outside the UK or European Union from time to time in other aspects of our business.

Further to Section 119A of the Data Protection Act 2018 and noting Case C-311/18 in the European Court of Justice, if your data is transferred or processed outside of the UK or EEA, we ensure the safeguards of International Data Transfer Agreements (IDTAs) or Addendums are enforced. Where this is not possible, we ensure that European Standard Contractual Clauses are entered. For data transfer between the USA, we may rely on the Data Privacy Framework or the UK Extension Data Bridge.

Wherever your personal data is transferred, stored or processed by us, we will take reasonable steps to safeguard its privacy. If you have a complaint about our privacy compliance, please contact us at support@opalmedica.co.uk.

Please note that the countries where we operate may have privacy and data protection laws that differ from, and are potentially less protective than, the laws of your country. You agree to this risk when you create a My Rare Journey account, irrespective of which country you live in. If you later wish to withdraw your consent, you can delete your My Rare Journey account as described in the “Deleting your Account” section.

What we use your Data for

Our mission is to provide a community for people with rare diseases, facilitate sharing of rare disease diagnostic journeys, and use this information to develop tools to help earlier detection of rare diseases in clinical practice.

With these objectives in mind, we use the personal data we collect about you to:

• Provide and personalise our Services. We use your personal data to provide the Services, including to create and manage your account, and personalise our Services by using information about how you interact with them. For example, we may use your survey results to provide you with relevant follow-up surveys.
• Communicate with you. We communicate with you about our Services and let you know about any changes to our policies and terms. We also use your information to respond to your enquiries, to provide you with updates and other information relating to our Services, provide information that you request, and otherwise provide customer support.
• Improve our Services. We conduct surveys and research to test, evaluate, and improve existing products and services, or develop new ones. We may also conduct audits and troubleshooting activities. We also use your personal data to understand and analyze how you use our Services and develop new products, services, features, and functionality;
• Promote safety and security. We help verify accounts and activities to promote safety and security on and off of our Services. This includes enforcing our Terms of Use and other legal terms and policies, finding and preventing fraud and abuse, responding to trust and safety issues that may arise, or as otherwise may be required by applicable laws and regulations or requested by any judicial process or governmental agency.
• Aggregate insights. We use your data to produce and share aggregated insights that do not identify you. For example, we may use your data to generate statistics about our users, or to publish demographics for a Service or learning and behavioural insights.
• Clinical decision aid development. We may anonymise your data and use it to help develop clinical decision aid tools for use by primary care physicians.
• Rare disease research. We may license your anonymised data to third parties for the purposes of rare disease research.
• New purposes. We may use your personal data for other purposes for which we provide specific notice at the time the information is collected.

Legal Basis for Processing your Data

Your data is only processed based on a defined legal basis. These are:

• Consent. By using our service you are consenting. You have consented to the use of your personal data in a particular way. When you consent, you can change your mind at any time by contacting us at support@opalmedica.co.uk.
• Performance of a contract. We need your personal data to provide you with services and products requested by you, or to respond to your enquiries. In other words, so we can perform our contract with you, like the Terms of Use.
• Legal obligation. We have a legal obligation to use your personal data, such as to comply with applicable tax and other government regulations or to comply with a court order or binding law enforcement request.

Legitimate interests

We have a legitimate interest in using your personal data in the following cases:

• To operate the OpalMedica business and provide you with tailored communications to assist you in better using OpalMedica Services. This may include advertising; however, you may opt out of receiving advertising communications at any time by contacting us at support@opalmedica.co.uk or by following the unsubscribe instructions in any such communications.
• To analyse and improve the safety and security of our Services. We do this as it is necessary to pursue our legitimate interests in ensuring OpalMedica services are secure, such as by implementing and enhancing security measures and protections and protecting against fraud, spam and abuse.
• To provide and improve our Services, including any personalised services. We do this as it is necessary to pursue our legitimate interests of providing an innovative and tailored offering to our users on a sustained basis.
• To anonymise and subsequently use anonymised information.

Protecting you and others. To protect your vital interests, or those of others.

Lawful Basis

The legal basis that OpalMedica will use/process user data will typically be:

• GDPR Article 6(1)(a): the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
• GDPR Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• GDPR Article 6(1)(f): processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

You have the right to withdraw your consent at any time. Should you choose to do so, please contact us at support@opalmedica.co.uk.

Special Category Personal Data Conditions

To enable OpalMedica to process your special category of personal data (sensitive personal data in the US), we will use one of the following conditions:

• GDPR Article 9(2)(a): Explicit Consent
• GDPR Article 9(2)(c): Vital Interests
• GDPR Article 9(2)(e): Made public by the data subject

If we request your explicit consent, we will ask you to complete a form, which specifies the nature/type of special category of data used and your explicit consent will be separate from any other consent we are seeking.

Your explicit consent will be freely given and specific and you can withdraw your explicit consent at any time. Should you choose to do so, please contact us at support@opalmedica.co.uk.

Who we Share your Data with

We share personal data in the following ways:

We may disclose your personal data to law enforcement, regulatory and other government agencies and to professional bodies and other third parties, as required by and/or in accordance with applicable law or regulation including but not limited to prevention of fraud or minimising credit risk.

We may license your anonymised data to third parties for the purposes of rare disease research, with your explicit consent.

People you share and communicate with

Any content you share and communicate using our products and services will be visible to friends or connections connected to you through the My Rare Journey social network/forum/message board. In some cases, people you share and communicate with may download or re-share this content with others on and off our Services. We are not responsible for the other users’ use of available information, so you should carefully consider whether and what to post or how you identify yourself on the Services.

People that see content others share about you

Other people may use our Services to share content about you with the audience they choose. If you have concerns with someone’s post, you can report them by emailing us at support@opalmedica.co.uk.

Vendors and Service Providers

We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services.

Sharing with third-party partners and organisations

We occasionally work with third party companies. For example, anonymised data (data with all user identifiable information removed) may be licensed to research organisations for the purposes of conducting approved rare disease research. We do not share information that personally identifies you with advertising, measurement or analytics partners unless you give us permission, or if we have aggregated the information so that it does not personally identify you.

As Required By Law and Similar Disclosures

We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

Merger, Sale, or Other Asset Transfers

We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Notice in effect at the time the applicable information was collected.

Consent

We may also disclose your information with your permission.

Data Retention

We will retain your personal data for a time period required or allowed by applicable regulations or laws and as needed to fulfill our business purposes, including providing our Services, complying with our legal obligations, resolving disputes, and enforcing our agreements, or for other purposes described in this Notice. Our retention of information is based on many factors such as your relationship with us, the nature of the information, compliance with our legal obligations, and defending or resolving actual or anticipated legal claims.

Deleting your Account

You can close your account at any time. When you close your account, you will no longer be able to access it. Things you have posted and accumulated, such as your status updates, personalised avatars, badges and achievements, will be deleted. Keep in mind information that others have shared about you is not part of your account and will not be removed when you close your account. Similarly, anonymised survey responses that have been used to develop clinical decision aids or licensed to third parties for research purposes will not be deleted.

If you request, we will delete or anonymise your personal data so that it no longer identifies you, unless we are legally allowed or required to maintain certain personal data, including situations such as the following:

• If there is an unresolved issue relating to your account, such as an unresolved claim or dispute we will retain the necessary personal data until the issue is resolved.
• Where we are required to retain the personal data for our legal, tax, audit, and accounting obligations, we will retain the necessary personal data for the period required by applicable law.
• Where necessary for our legitimate business interests such as fraud prevention or to maintain the security of our users.

Please note that, for technical reasons, there might be a delay in deleting your personal data from our systems when you ask us to delete it. However, we will process your request as quickly as possible.

To ensure transparency and ease of exercise of your rights, we have streamlined our internal processes. For any requests or enquiries regarding your personal data, please reach out to us via the contact details provided in this Notice. We are committed to addressing your requests without undue delay and in any event within one month of receipt, subject to any applicable legal requirements and exceptions.

Data Permissions

Every marketing email sent from us allows you to opt out of receiving emails from us, except for the purposes of fulfilling any contractual arrangements.

You can also contact us at the email address above and request to opt out, view, export or delete your data.

If you request for your data to be deleted, your name and email address will be added to an exceptions list and all other data removed to the extent possible.

If you ask for us to send information to a relative or friend, you warrant you have the consent from them to share their data with us.

How we Protect Information we Collect

While no service is completely secure, we are dedicated to keeping personal data safe. We maintain administrative, technical and physical safeguards that are intended to appropriately protect against accidental or unlawful destruction, accidental loss, unauthorised alteration, unauthorised disclosure or access, misuse and any other unlawful form of processing of the personal data in our possession. We employ security measures such as using firewalls to protect against intruders, building redundancies throughout our network (so that if one server goes down, another can cover for it) and testing for and protecting against network vulnerabilities. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

Legal Compliance

We seek to uphold our legal obligations as covered by the Data Protection Act 2018, Data Use and Access Act 2025 (DUAA) and the General Data Protection Regulation 2016. Our Data Protection Authority is designated as the Information Commission (IC) formally the Information Commissioner’s Office (ICO).

Where you are located in the United States, your use of the Platform may also be governed by applicable US federal and state privacy laws.

We retain the right to update this notice at any time. We will always document any changes and will publish the latest version on the Services website. The revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal data previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

Cookies

The Platform uses only essential cookies required for authentication and session management. We do not use advertising cookies, analytics cookies, or third-party tracking cookies. Our session cookie (__session) is httpOnly, secure, and set with a 7-day expiry.

Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Notice does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

Children

The Services are not directed at children. We do not knowingly collect personal data from anyone under the age of 18. Parents or guardians may use the Services on behalf of children (e.g. to complete a survey on the child’s behalf). If you learn that a minor has provided us with personal data in violation of this Notice, then you may alert us at https://ico.org.uk/concerns/.

Licensing of Anonymised Data

We may license aggregated anonymised data to third parties for the purposes of rare disease research, with your explicit consent.

We will always seek your explicit consent before your data is included in any licensed dataset, and you may withdraw that consent at any time without affecting your access to the Platform.

You have the right to opt out of the licensing of your data at any time, regardless of whether you have previously provided consent. To opt out, please contact us at support@opalmedica.co.uk.

Please note that anonymised data that has already been licensed to a third party prior to your opt-out request may not be capable of retrieval, as it will no longer be identifiable as yours.

Contact

For data protection enquiries or to exercise your rights, contact our Data Protection Officer at support@opalmedica.co.uk.

For general enquiries or to report issues, contact us at support@opalmedica.co.uk.