Privacy Policy | Inovia Bio

1. Who we are

Inovia Bio Limited ("Inovia Bio", "we", "us", "our") is a TechBio company providing drug development strategy and technology platforms. We are a company registered in England and Wales (company number 13828401) with our registered office at 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.

This Privacy Policy explains how we collect, use, and protect personal data when you visit our website at https://inovia.bio (the "Site"), interact with our marketing content, contact us, or book a call with our team.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the EU General Data Protection Regulation ("EU GDPR"), Inovia Bio Limited is the data controller of the personal data described in this policy.

If you have any questions about this policy or how we handle your data, contact us at william@inovia.bio.

2. Personal data we collect

Information you give us directly

Contact and enquiry forms - when you fill in a form on our Site (for example to get in touch or request information), we collect the details you provide, such as your name, email address, company name, job title, and the content of your message.
Booking a call - when you schedule a call with our team, we collect your name, email address, company, and any information you choose to share about your needs.
Email and other correspondence - if you email us or otherwise contact us, we keep a record of that correspondence.
Marketing subscriptions - if you opt in to receive updates from us, we collect your name and email address.

Information we collect automatically

When you visit our Site, we and our service providers automatically collect certain technical data, including:

IP address and approximate location (country/city level)
Browser type and version, device type, and operating system
Pages visited, time spent on pages, referral source, and navigation paths
Cookie identifiers and similar tracking technologies (see Section 6)

We use Google Tag Manager and analytics tools, and HubSpot's tracking code, to collect this information.

Information from other sources

We may receive limited business contact information from publicly available sources (such as LinkedIn or company websites) or from third-party data providers, where we have a legitimate business reason to contact you.

3. How we use your personal data and our legal bases

Under UK and EU data protection law, we must have a legal basis to process your personal data. We use your data as follows:

Responding to enquiries and scheduling calls (contact details, message content) - legitimate interests in responding to your request, or steps taken prior to entering into a contract.
Providing and improving our Site (technical and usage data) - legitimate interests in operating and improving our Site.
Marketing communications such as newsletters, updates, and event invitations (name, email, company) - consent, or legitimate interests for business-to-business contacts where permitted; you can opt out at any time.
Managing our customer and prospect relationships in our CRM (contact details, interaction history) - legitimate interests in managing our business relationships.
Analytics and measuring marketing effectiveness (technical, usage, and cookie data) - consent where required for cookies, and legitimate interests.
Complying with legal obligations - legal obligation.
Establishing, exercising, or defending legal claims - legitimate interests.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can object to this processing at any time (see Section 9).

4. How we share your personal data

We do not sell your personal data. We share personal data only with:

Service providers - companies that provide services to us, such as HubSpot (CRM, forms, marketing, and website hosting), Google (analytics and tag management), scheduling tools, and email providers. These providers process data on our behalf under contracts that protect your data.
Professional advisers - lawyers, accountants, auditors, and insurers where necessary.
Authorities - courts, regulators, or law enforcement where we are legally required to do so.
Business transfers - if we are involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate safeguards.

5. International transfers

We are based in the United Kingdom, and some of our service providers (including HubSpot and Google) are based in, or store data in, the United States and other countries outside the UK and the European Economic Area (EEA).

Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, such as:

Transfers to countries covered by UK adequacy regulations or an EU adequacy decision (including, where applicable, the EU-US Data Privacy Framework and its UK Extension); or
Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum, where required.

You can contact us at contact@inovia.bio about the safeguards we use.

6. Cookies and tracking technologies

Our Site uses cookies and similar technologies to make the Site work, understand how visitors use it, and support our marketing. These include:

Strictly necessary cookies - required for the Site to function.
Analytics cookies - help us understand how visitors interact with the Site (for example, via Google Analytics, deployed through Google Tag Manager).
Marketing/functionality cookies - including HubSpot cookies that help us recognise returning visitors, connect form submissions to your browsing activity, and measure our marketing.

Where required by law, we will ask for your consent before setting non-essential cookies. You can also control cookies through your browser settings, although disabling some cookies may affect how the Site works.

7. How long we keep your data

We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. In general:

Enquiry and CRM records are retained while we have an active relationship with you or a legitimate business need to keep them, and are reviewed periodically.
Marketing data is retained until you unsubscribe or we determine the data is no longer current.
Analytics data is retained in line with the retention settings of our analytics tools.
We may keep certain records for longer where required by law (for example, for tax or accounting purposes) or to establish or defend legal claims.

8. How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These include access controls, encryption in transit, and the use of reputable service providers with strong security practices. No system is completely secure, but we work to protect your data in line with good industry practice.

9. Your rights (UK and EEA)

If you are in the UK or the EEA, you have the following rights in relation to your personal data:

Access - request a copy of the personal data we hold about you.
Rectification - ask us to correct inaccurate or incomplete data.
Erasure - ask us to delete your data in certain circumstances.
Restriction - ask us to limit how we use your data in certain circumstances.
Portability - receive your data in a structured, commonly used, machine-readable format.
Objection - object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent - where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email us at contact@inovia.bio. We will respond within one month, as required by law. We may need to verify your identity before acting on your request.

You also have the right to complain to a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) - https://ico.org.uk. If you are in the EEA, you can complain to your local data protection authority. We would appreciate the chance to address your concerns first, so please consider contacting us before lodging a complaint.

10. Your rights (United States)

If you are a resident of a US state with a comprehensive privacy law (such as California, Colorado, Connecticut, Virginia, Texas, or others), you may have rights including:

The right to know what personal information we collect, use, and disclose.
The right to access and receive a copy of your personal information.
The right to correct inaccurate personal information.
The right to delete your personal information, subject to certain exceptions.
The right to opt out of the "sale" or "sharing" of personal information and of targeted advertising.
The right not to be discriminated against for exercising your privacy rights.

We do not sell personal information for money. Our use of analytics and marketing cookies may be considered "sharing" or "targeted advertising" under some state laws; you can opt out via our cookie controls or by contacting us.

To exercise any of these rights, email contact@inovia.bio with your name, state of residence, and the nature of your request. You may use an authorised agent where permitted by law; we may ask for proof of authorisation.

11. Children

Our Site and services are directed at businesses and professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Third-party links

Our Site may contain links to third-party websites (such as LinkedIn). We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date above. Significant changes may also be communicated by email or a notice on our Site.

14. Contact us

Inovia Bio Limited
27 Old Gloucester Street
London, WC1N 3AX
United Kingdom

Email: contact@inovia.bio