Record of Data Processing Activities

Data Controller

Name: Neurocheckpro Limited Address: 3rd Floor, 86–90 Paul Street, London EC2A 4NE Website: www.neurocheckpro.com Contact: support@neurocheckpro.com

Categories of Data Subjects

We collect personal data from the following categories of data subjects:

• Our customers and patients; • Our vendors and suppliers; • Our employees, contractors, self-employed staff, and job applicants.

Categories of Personal Data

We collect and process the following categories of personal data:

• Health Information: medical history, current medication, conditions, details of medical professionals, and related clinical information;

• Client Contact Information: names, email addresses, phone numbers, and addresses;

• Third Party Contact Information: names, email addresses, phone numbers, addresses, job titles, and roles;

• Communication Information: records of correspondence and information provided when reporting problems or complaints;

• Service Information: information about personal circumstances relevant to service delivery;

• Marketing Information: names, email addresses, phone numbers, and addresses held for marketing purposes;

• Employment Information: personal contact details, date of birth, gender, National Insurance number, bank account details, salary and benefits, recruitment information, employment records, and performance information.

Purposes and Legal Basis for Processing

We process personal data for the following purposes:

• Setting up and managing client relationships: Client Contact Information and Communication Information; lawful basis: performance of a contract, legitimate interests;

• Communicating with clients to provide services: Contact, Communication, Service, and Health Information; lawful basis: performance of a contract, legitimate interests, and consent;

• Providing clinical assessment and diagnostic services: Contact, Communication, Service, and Health Information; lawful basis: performance of a contract, legitimate interests, and consent;

• Communicating with suppliers and third parties: Third Party Contact, Communication, and Health Information; lawful basis: performance of a contract, legitimate interests, and consent;

• Marketing our services: Client Contact and Marketing Information; lawful basis: legitimate interests.

Data Retention

• Tax and customs records: 8 years from the end of the relevant year;

• Contract-related personal data: 7 years from the end of the contract or date of last use;

• Marketing records: 3 years from the date of last interaction.

All categories of personal data are reviewed regularly. Data that is no longer relevant or accurate is corrected or deleted.