Privacy Policy
Privacy Notice
Version 3.4. Last updated 3 October 2026. This notice replaces our previous Privacy & Cookies policy. Information about cookies and similar technologies now sits in our separate Cookie Notice.
1. Who we are
Micrima Limited is the data controller for the personal information described in this notice.
- Company: Micrima Limited, registered in England and Wales, company number 05616345
- Registered office: Two Glass Wharf, Temple Quay, Bristol, BS2 0EL
- Data protection contact: info@micrima.com, or write to: Data Protection, Micrima Limited, Two Glass Wharf, Temple Quay, Bristol, BS2 0EL
- ICO registration number: ZA829420
We make the Mi~Scan® system, which measures the composition of breast tissue, and we run the Know Your Normal service, through which people can book a Mi~Scan appointment at our own sites or at those of our delivery partners, or reserve a place with Mi~Scan® Mobile, our mobile unit. Mi~Scan reports measurements back to you and Mi~Score® can place them in a statistical context. It is not a diagnostic test, it does not look for or detect breast cancer, and it does not replace NHS breast screening or advice from your doctor.
2. Information we collect, and where it comes from
2.1 When you contact us or ask us for something
Depending on which form you use, we collect:
- Know Your Normal guide and Imogen’s emails (sign-up form): your name, email address, your postcode or the location most convenient to you if you give it, and the fact that you asked for Imogen’s emails, including the wording you agreed to and when.
- Know Your Normal guide only: your name, email address, and your postcode or the location most convenient to you if you give it. We send you the guide and nothing else, unless you later ask for Imogen’s emails on our website or by replying to us, in which case we record that request, its wording and when it was made.
- Waitlist: your name, email address, the postcode or town you give us, your mobile number if you choose to give it, and whether you ticked the box asking for Imogen’s emails.
- Callback request: your name, email address, mobile number, the time you would prefer to be called, and whether you ticked the box asking for Imogen’s emails.
- General enquiries: your name, email address and anything you choose to tell us in your message.
- Clinical or scientific papers: your name, email address, organisation and job title.
We also collect these details when you complete a form on Facebook or Instagram, or a form shown alongside a Google search result, rather than on our own website. In those cases the advertising platform passes your answers to us, and also keeps its own copy of what you entered, under its own privacy policy.
2.2 When you look for a location, book an appointment or reserve a place
- Location search: when you search our locations page, we record the first part of the postcode or the town you enter, the site nearest to you and how far away it is. If you reached that page from one of our emails, we record this against your record so that we stop asking you where you are.
- Clinic choice: when you click through to book at a particular site, we record which site you chose.
- Booking: your name, email address, telephone number, appointment date and time, appointment type, the site you booked, and payment information handled by our payment provider.
- Mi~Scan® Mobile reservation: when you reserve a place with our mobile unit through our online shop, we collect your name, email address, mobile number, the address you give at checkout, your order and the deposit you pay. We use the address to plan where the unit visits and to tell you when a visit near you is offered. Your card payment is handled by our payment provider.
- Suitability confirmation: before booking we show you the conditions that would make a Mi~Scan unsuitable, and you confirm that none of them apply. We record only that confirmation. Section 4 explains how we treat it.
2.3 How you found us
When you arrive from an advertisement or a search result, we record information about that visit: the source, campaign, advertisement and form involved, and identifiers that the advertising platforms add to the web address, such as a Google click identifier. This lets us understand which advertising works. Our Cookie Notice explains the technologies involved and how to control them.
2.4 How you interact with our emails
Our emails contain a small image that tells us whether the email was opened, and links that tell us if you clicked them. When you book through a link in one of our emails, the link passes a reference number to our booking system, so that we can connect your booking to your enquiry. We also record replies, delivery failures and unsubscribes. We use this to see which information people find useful, and to give priority to people who appear to want to hear from us. We combine it into an internal score that helps our team decide who to follow up first. No decision about your care, your eligibility or the price you pay is ever made on this basis, and no one is refused a service because of it. You can ask us to stop this at any time, see section 8.
2.5 If we contact you at work, or you contact us for your organisation
We also hold information about people in their professional role.
- Workplace contacts: we email people who work in HR, people, wellbeing or benefits roles about our workplace breast health materials, such as the Know Your Normal Workplace Toolkit. We hold your name, your role, your employer and your work email address. We obtained these from Apollo (Apollo.io), a business contact database, or from a colleague at your organisation who suggested we contact you. Apollo’s privacy policy explains where its information comes from and how to remove yourself from its database. We record which of these emails we have sent you, whether they were opened and whether their links were clicked, your visits to the toolkit page and the materials you download when you arrive from one of those links, any reply you send us, whether you follow the link to book a call, what comes of any conversation we have, and whether you have unsubscribed. The links in these emails carry a reference to your record so that we can make that connection.
- Delivery partner enquiries: your name, email address, your organisation and where it is, the kind of organisation it is, what you tell us about its background and why Mi~Scan would work well there, and your telephone number, role and website if you give them.
We use this information only to deal with you in that role. For workplace contacts we rely on our legitimate interest in telling organisations about materials that are relevant to their work. You can ask us to stop at any time, without giving a reason: use the unsubscribe link in any of these emails, reply to one, or email info@micrima.com, and we will not email you again. Sections 3, 6 and 8 set out our lawful basis, how long we keep this information and your rights.
3. Why we use your information, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Send you the Know Your Normal guide you asked for, answer your enquiry, or make the callback you requested | To give you the thing you asked us for | Steps taken at your request before entering a contract, or our legitimate interest in responding to you |
| Send you our Know Your Normal email series and other marketing about Mi~Scan | To tell you about the service and how to book | Your consent. Where you have previously bought or enquired about a scan, our legitimate interest in telling you about similar services, always with an opt-out |
| Add you to a waitlist and tell you when Mi~Scan reaches your area | To provide the waitlist service you asked for | Steps taken at your request before entering a contract |
| Use your postcode to show you your nearest site, tell you about it in our emails, and route you to the right booking page | To help you find and book an appointment | Steps taken at your request before entering a contract |
| Take and administer your booking, and take payment | To provide the appointment | Performance of our contract with you |
| Take your Mi~Scan Mobile reservation and deposit, plan where the mobile unit visits, tell you when a visit near you is offered, and refund your deposit if no visit is offered | To provide the visit you reserved | Performance of our contract with you |
| Check that a Mi~Scan is suitable and safe for you | Your safety and the quality of the scan | See section 4 |
| Measure which advertising works, using information stored on or read from your device | To spend our advertising budget well | Your consent, given through the cookie banner and withdrawable at any time |
| Tell Meta, from our systems rather than your browser, when someone who came from a Meta advertisement reaches a booking milestone | To know which advertisements produce real bookings rather than just enquiries | Our legitimate interest in measuring our own advertising. You can object at any time and we will stop — see section 5.2 |
| Track email opens and clicks and prioritise follow-up | To make our communications relevant and to follow up sensibly | Your consent, together with our legitimate interest in running our service efficiently |
| Email people in HR, people, wellbeing and benefits roles about our workplace materials, record how those emails and materials are used, and follow up with those who respond | To tell organisations about materials relevant to their work | Our legitimate interest in making our services known to organisations. You can object at any time and we will stop, see section 2.5 |
| Consider and answer an enquiry about becoming a delivery partner | To respond to the organisation that approached us | Steps taken at your request before entering a contract, or our legitimate interest in responding to you |
| Keep records of who has asked not to be contacted | To make sure we honour your choice | Our legal obligation |
| Keep financial and appointment records | Tax and accounting requirements, and so that we can answer questions about your appointment afterwards | Our legal obligation, and our legitimate interest in standing behind our own service |
| Keep our systems secure and investigate problems | Security and service quality | Our legitimate interest in protecting our systems and the people who use our service |
Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object at any time, see section 8. Where we rely on consent, you can withdraw it at any time, and withdrawing it does not affect anything we did before you withdrew it.
4. Suitability confirmation, and your measurements
Mi~Scan is a measurement service, not a diagnostic one. We do not diagnose, and we do not look for disease. Even so, some of what we handle is treated by data protection law as information about your health, and we give it the extra protection the law requires.
4.1 When you book
Before your appointment we show you the conditions that would make a Mi~Scan unsuitable, for example implants, pacemakers, recent biopsies, pregnancy or breastfeeding. You confirm that none of them apply to you. We record only that confirmation. We do not ask which condition applies to anyone, and we do not hold that.
We ask for your explicit consent to record the confirmation, separately from anything to do with marketing, and we tell you plainly what you are agreeing to. You can withdraw it at any time by emailing info@micrima.com, though we may then be unable to carry out the appointment. Booking a Mi~Scan is entirely optional and you are never asked to agree to more than the appointment itself needs.
4.2 Your measurements
The measurements taken at your appointment, and any statistical information derived from them through Mi~Score®, are handled in a separate system that we keep deliberately apart from everything described in this notice. That system has its own terms, which are shown to you when you first use it and which explain how your measurements are held and used. Nothing in this notice changes those terms.
4.3 Limits that apply throughout
- Your measurements are not copied into the systems we use for enquiries, bookings or marketing. Those systems hold only the fact that an appointment was booked, where, when and what it cost.
- Access is restricted to the people who need it to deliver or oversee your appointment, and everyone with access is bound by a written duty of confidentiality.
- We do not use it for marketing and we do not use it to build advertising audiences.
- We do not send it to Meta, Google or any other advertising platform. Nothing we send to an advertising platform describes your health, your results or your answers.
- We do not copy free-text health information into our marketing records.
Asking for our guide, joining the waitlist or enquiring about a scan is not a record of any medical condition, and we do not treat it as one.
5. Who we share your information with
5.1 Delivery partners
Mi~Scan appointments are available at Micrima sites and at sites operated by our delivery partners. Where you choose, book at, or ask to be told about a partner site, we share with that partner the information they need to contact you and to provide your appointment, typically your name, contact details, chosen location, appointment details and any suitability information relevant to carrying out your scan safely.
We share this only with the partner or partners relevant to the location you have chosen or asked about. We do not share your information with partners covering other areas, and we do not sell your information or provide it to anyone for their own marketing. Each partner is bound by a written agreement covering how they may use your information, and each is responsible to you for their own use of it. Where a partner operates a site under its own brand, we will make clear who you are dealing with.
5.2 Advertising platforms
We advertise on Meta (Facebook and Instagram) and on Google.
- Meta. When someone who came to us from a Meta advertisement reaches a milestone, for example booking an appointment, we send Meta a record of that milestone together with an identifier for the original enquiry and a scrambled (hashed) version of the email address, so that Meta can tell us which advertisements produce real bookings and show our advertisements to the right people. We send Meta neutrally named events only. We never send Meta the subject of your enquiry, your answers to the suitability questions, or any other health information.
- Google. We use Google Analytics and Google Ads to understand how our website is used and how our advertising performs. Our Cookie Notice sets out what is used and how to control it.
Meta and Google decide for themselves how they use information they receive in this way, and act as controllers in their own right for that use.
The milestone reporting described above happens between our systems and Meta’s, not in your browser, so blocking cookies does not stop it. We rely on our legitimate interest in understanding which of our advertisements produce genuine bookings. You can object at any time. Email info@micrima.com and we will stop sending information about you to Meta — you do not need to give a reason, and it does not affect your appointment or anything else we do for you. If you unsubscribe from our emails we treat that as an objection to this as well, and stop automatically.
What we send Meta covers only people who first contacted us through a Facebook or Instagram form, where Meta already holds the details concerned. We send nothing to Meta about anyone who reached us any other way.
5.3 Our service providers
The following organisations process personal information on our behalf, under contract and on our instructions:
| Provider | What they do for us |
|---|---|
| Squarespace | Website hosting, website forms and our online shop, where Mi~Scan Mobile reservations are made |
| Salesforce | Our record of enquiries, bookings and communications |
| Zapier | Moving information between our systems |
| Acuity Scheduling | Appointment booking and suitability questions |
| Square | Card payments for appointments |
| Squarespace Payments, with Stripe as its card processor | Card payments for reservations made in our online shop |
| Microsoft | Email, office systems and the page on which a workplace contact can book a call with us |
| Website analytics and advertising measurement | |
| Postcodes.io | Converting a postcode or town into a location, to find your nearest site |
| Cookiebot (Usercentrics) | Presenting the cookie banner and keeping a record of the cookie choice you make |
| Xero | Accounting and invoicing records |
The card payment providers also use payment information for their own purposes, such as preventing fraud and meeting their own legal obligations, as their privacy policies describe. You enter your card details with them directly, and we do not receive or store your full card number.
We may also share your information with our professional advisers, or where we are required to do so by law or by a regulator.
5.4 Where your information is held
Some of these providers are based outside the United Kingdom, or store information outside it, principally in the United States and the European Economic Area. Where information leaves the UK, we rely on the UK's adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with additional safeguards where needed. You can ask us for details of the safeguards that apply.
6. How long we keep your information
| Information | How long |
|---|---|
| Enquiry and marketing records where you have not booked | 24 months after we last heard from you, then deleted or anonymised |
| Workplace contact and delivery partner enquiry records (section 2.5), where no working relationship follows | 24 months after our last contact with you, then deleted or anonymised |
| Email opens, clicks and follow-up priority information, including workplace toolkit visits and downloads | 12 months |
| Record of your marketing choices and what you agreed to | While we rely on it, and 6 years afterwards, in a restricted archive |
| Record that you asked not to be contacted | Indefinitely, kept to the minimum needed to honour your choice |
| Booking, reservation, payment and financial records | As required by tax and accounting law, normally 6 years |
| Your suitability confirmation | Kept with your booking record, under the same period as bookings above |
| Your measurements and Mi~Score® output | Held in the separate system described at section 4.2, under the retention terms shown to you there |
7. Marketing, and how to stop it
Imogen’s Know Your Normal emails go to people who have asked for them: an opening series over the first few weeks (your nearest location and how to book, what happens at an appointment, what it costs and the science), then, less often, emails about Mi~Scan®, Mi~Score®, breast density and knowing your normal, and news such as a new location near you. Once you have booked, we may also remind you when a repeat scan is due. We keep sending them for as long as you want them; if you have not booked, we stop 24 months after we last heard from you (section 6). We also send them, on the basis described in section 3, to people who have enquired about or booked a scan with us, who can opt out at any time. When you ask for the emails, we record what you agreed to and when.
You can stop marketing emails at any time by clicking Unsubscribe at the bottom of any email, by replying to any of our emails and asking us to stop, or by emailing info@micrima.com. We act on this promptly and keep a minimal record so that we do not contact you again by mistake.
Emails we send to people in their professional role (section 2.5) are a separate series from the Know Your Normal emails described above. Each carries its own unsubscribe link, and you can also stop them by replying to one or by emailing info@micrima.com.
If you ask us not to telephone you, we record that and screen against it. A callback you request is a one-off call you have asked for, and we do not treat it as permission to call you again about anything else.
8. Your rights
You have the right to:
- Be informed about how we use your information, this notice.
- Access a copy of the information we hold about you.
- Rectification, have inaccurate information corrected.
- Erasure, have your information deleted, in certain circumstances.
- Restrict processing, ask us to pause our use of your information, in certain circumstances.
- Object to processing based on legitimate interests. You can object to direct marketing at any time and we must stop.
- Data portability, receive certain information in a portable format.
- Withdraw consent at any time, where we rely on consent.
- Not be subject to decisions made solely by automated means that have a legal or similarly significant effect. We do not make such decisions.
To exercise any of these, email info@micrima.com. We will respond within one month. If your request is complex we may need longer, and we will tell you if so. There is normally no charge.
9. Complaints
If you are unhappy with how we have handled your information, please tell us first at info@micrima.com. We will acknowledge your complaint within 30 days and tell you what we are doing about it.
You also have the right to complain to the Information Commissioner's Office at any time, and you do not have to come to us first.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · 0303 123 1113 · ico.org.uk
10. Changes to this notice
We keep this notice under review and publish any updates on this page. Where a change materially affects how we use your information, we will tell you. This notice was last updated on 3 October 2026.