Privacy that reflects the sensitivity of harm reduction data.

neo360 Limited is registered in England and Wales under company number 06686993. For information provided directly to neo360 through enquiries, support, contractual discussions or other business interactions, neo360 will normally determine why and how that information is used.

Because neo360 is deployed internationally, controller, processor and privacy-right arrangements can differ by jurisdiction. The applicable customer agreement and local privacy notice take precedence for deployment-specific processing.

Configurable anonymity

Some neo360 workflows are specifically designed so customers can determine how much identifying information is required. For example, needle exchange functionality can be configured to be as anonymous as the service requires. The appropriate data set should be determined by the service, commissioner, local policy and applicable law.

Lawful bases

Depending on the context, processing may rely on performance of a contract, steps requested before entering a contract, compliance with a legal obligation, legitimate interests, consent or another lawful basis available under the applicable data-protection law. Where special-category health information is processed, an additional legal condition must also apply. In commissioned deployments, the relevant controller determines and documents the appropriate legal bases.

neo360 does not sell personal information. Information may need to be made available to authorised customer users, contracted technology or support providers, professional advisers, regulators or public authorities where this is necessary, contractually authorised or required by law. Where suppliers process personal information on our behalf, appropriate contractual and security controls should apply.

Security measures

• Controlled user access and permission management.
• Encryption for data transferred between supported devices, services and hosting environments.
• Logging, monitoring and auditability appropriate to the service.
• Backup, continuity and recovery arrangements.
• Security, vulnerability and change-management processes.
• Contractual controls over authorised processors and support access.

Security controls are reviewed and applied according to the relevant deployment, contractual requirements and risk profile. No internet-connected service can guarantee absolute security, but neo360 applies appropriate technical and organisational measures intended to reduce risk and protect information.

Retention periods can differ depending on the type of information, the relevant customer contract, statutory requirements, clinical or service-record requirements, audit needs, limitation periods and the purpose for which the information was collected.

For customer-controlled service-user information, retention and deletion requirements should be agreed with and directed by the relevant controller. For neo360's own business records, we retain information only for as long as reasonably required for the purpose, legal obligations, dispute management and legitimate business administration, then securely delete or anonymise it where appropriate.

If your request relates to information recorded by a harm-reduction service or commissioner using neo360, that organisation may be the appropriate controller to contact. neo360 will support its customers in responding to rights requests where required by contract and law.

The neo360 website may process basic technical information needed for operation, security and performance. Any optional analytics, advertising or similar technologies should be described clearly and, where the applicable law requires it, activated only after an appropriate choice or consent.

Where the website links to another organisation's website or service, that organisation's privacy practices apply once you leave neo360's site. This policy does not control how independent third parties process information on their own services.

We may update this policy from time to time. Material changes should be communicated where required, and the current version should show its effective date. Deployment-specific privacy notices may also be updated by the relevant customer or controller.