Privacy Policy

• Physicore Limited is the data controller for personal data described in this policy.
• We process personal data from four groups: website visitors and business contacts; applicants and contributors to our Fieldforce workforce; employees and visitors at partner operating environments where real-world data is captured; and individuals whose image, voice or activity is incidentally recorded during capture.
• Real-world capture at partner sites is conducted under written commercial agreements with the site operator. Notices, consent mechanisms and minimisation controls are applied at point of capture, and identifiable footage is blurred, masked or removed before any dataset is licensed where consent or another lawful basis is not in place.
• We license curated datasets to AI and robotics research customers. Customers receive datasets only under licence terms that bind their use, restrict re-identification and require equivalent protections.
• We transfer personal data between the United Kingdom, the United States and other jurisdictions using the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, and adequacy decisions where available.
• You have rights over your personal data, set out in sections 11 and 12. To exercise them, contact partnerships@physicore.ai.

The controller of personal data described in this policy is Physicore Limited, a company incorporated in England and Wales, with its registered office at 1 Kingdom Street, London W2 6BD, United Kingdom ('Physicore', 'we', 'us', 'our'). Physicore also operates from 200 Page Mill Road, Palo Alto, CA 94306, United States.

For privacy queries, requests to exercise rights, or to contact our data protection point of contact, write to partnerships@physicore.ai or to the registered office marked for the attention of the Data Protection Lead. Where we appoint a UK or EU representative, their contact details will be published here.

This policy applies to personal data we process in connection with:

• visitors to www.physicore.ai and any subdomains we operate (the 'Site');
• business contacts and prospective partners or customers who enquire about, negotiate or enter into agreements with us;
• applicants to, and members of, the Fieldforce contributor workforce;
• operators of physical environments who grant Physicore access to capture real-world data (the 'Partner Sites') and individuals identifiable from data captured at those sites;
• research and commercial customers that license datasets, validation services or related materials from Physicore.

This policy does not apply to processing carried out by our customers under their own licences, by our partners under their own controllership, or by third party services that you access independently of the Site.

The categories of personal data we process depend on how you interact with us.

3.1 Website visitors and business contacts

• identifiers and contact details (name, business email, telephone, employer, role);
• content of correspondence and enquiry forms, including any information you choose to provide;
• device and connection data (IP address, user agent, referrer, language, approximate location derived from IP);
• cookie and analytics data as described in our Cookie Policy at /cookies.

3.2 Fieldforce applicants and contributors

• identifiers, contact details and right to work or engage information required by law;
• skills, experience and references provided in your application;
• contracting information, including tax identifiers, payment details and country of engagement;
• training records, capture assignments completed, equipment issued, and quality metrics tied to your contributions;
• where you appear in capture footage as a contributor, your own image, voice or hand and body movement data forming part of the captured dataset.

3.3 Partner Site personnel and visitors

• business contact details of partner staff with whom we coordinate access;
• images, video, audio and depth or sensor recordings of individuals present at the Partner Site during capture, including employees of the operator, contractors and members of the public;
• contextual data tied to that footage, including location within the site, time of capture, task being performed and equipment in use.

3.4 Customers (licensees of datasets and validation services)

• identifiers and contact details of authorised users at the customer organisation;
• access, authentication and audit logs related to the licensed materials;
• commercial information necessary to administer the licence.

Under the UK GDPR and the EU GDPR, we rely on the following lawful bases:

• Consent (Article 6(1)(a)) for non-essential cookies, optional marketing, and, where relied on, for capture of identifiable personal data at Partner Sites where no other basis applies.
• Contract (Article 6(1)(b)) for administering contributor engagements, partner agreements, customer licences and the services you request from us.
• Legal obligation (Article 6(1)(c)) to comply with tax, accounting, anti-money-laundering, health and safety, and equivalent regulatory duties.
• Legitimate interests (Article 6(1)(f)) for operating, securing and improving the Site; managing prospective business relationships; producing, curating and licensing real-world datasets; preventing fraud and misuse; and pursuing or defending legal claims. We have carried out a balancing assessment for each legitimate interests purpose and a summary is available on request to partnerships@physicore.ai.

Real-world capture at Partner Sites may incidentally include identifiable footage of individuals, and in some configurations may include data capable of uniquely identifying a person (for example, full-face video or voice recordings). We treat this category of data with heightened controls:

• Site-level governance. Each Partner Site engagement is established under a written agreement that records the scope of capture, the permitted purposes, the consent and notice obligations of the operator, and the technical controls applied at point of capture.
• Notice and consent at point of capture. The operator is contractually required to display visible notices, brief affected personnel, and where applicable obtain explicit consent before capture begins. Capture is suspended where consent is refused or withdrawn.
• Data minimisation. We capture only what is required for the specified purpose. Where the purpose can be achieved with non-identifying data, identifying features are not collected.
• De-identification before licensing. Faces, identifiable tattoos, badges, screens and other identifiers are blurred, masked or removed before any dataset is delivered to a licensee, unless explicit, specific consent has been obtained or another condition under Article 9(2) UK GDPR and Schedule 1 Data Protection Act 2018 applies.
• No biometric identification. We do not use captured data to uniquely identify natural persons. Datasets are licensed on terms that prohibit re-identification, biometric matching against external databases, and use to take decisions producing legal or similarly significant effects on individuals.
• Sensitive environments. In environments such as hospitals or clinical settings, capture is conducted only where the operator confirms the lawful basis and any sector-specific safeguards (for example, the common law duty of confidence in healthcare) are in place.

• operating, securing and improving the Site, including analytics measured against our legitimate interests;
• responding to enquiries, negotiating and administering partner, customer and contributor relationships;
• recruiting, onboarding, training, deploying and paying contributors in the Fieldforce;
• planning, conducting and supervising capture sessions at Partner Sites;
• curating, annotating, quality-assuring and structuring captured data into proprietary datasets ('Bedrock');
• licensing those datasets and providing real-world testing and validation services ('The Standard');
• complying with legal, regulatory and contractual obligations;
• establishing, exercising or defending legal claims.

We share personal data only where necessary and under appropriate safeguards. Recipients fall into the following categories:

• Customers and licensees of datasets and validation services, who receive de-identified datasets and limited supporting information under written licence terms that restrict purpose, prohibit re-identification, require deletion at end of term, and pass through equivalent obligations.
• Partner Site operators, with whom we exchange operational information needed to plan and conduct capture, under written agreements that allocate controllership and processing responsibilities for the personal data involved.
• Processors acting on our documented instructions, including cloud infrastructure, secure storage, annotation tooling, payroll, contractor management and identity verification providers. Each processor is engaged under a written agreement meeting Article 28 UK GDPR.
• Professional advisers (legal, audit, tax, insurance) bound by duties of confidence.
• Public authorities and law enforcement, where required by law, court order or to protect rights, property or safety.
• Acquirers in the event of a reorganisation, merger, sale or transfer of all or part of the business, subject to confidentiality undertakings.

We do not sell personal data and do not share personal data for cross-context behavioural advertising.

Physicore operates internationally. Personal data may be transferred to, stored in, or accessed from the United Kingdom, the United States, member states of the European Economic Area, and other jurisdictions where our processors or customers operate.

Where personal data is transferred outside the United Kingdom or the European Economic Area to a country not subject to an adequacy decision, we rely on one or more of the following mechanisms:

• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses;
• the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), in the appropriate module;
• the UK Extension to the EU-US Data Privacy Framework where the recipient is self-certified.

We carry out a transfer risk assessment for each transfer mechanism and apply supplementary measures (including encryption in transit and at rest, pseudonymisation and access controls) where the assessment requires them. A copy of the relevant safeguards is available on request to partnerships@physicore.ai.

We retain personal data only for as long as necessary for the purposes set out in this policy. Indicative retention periods are:

• website analytics and server logs: up to 13 months;
• business enquiry correspondence: 24 months from last contact, then deleted or anonymised;
• contributor application data (unsuccessful): 12 months from decision;
• contributor engagement records: duration of engagement plus 7 years for tax, contractual and audit purposes;
• partner agreement records: duration of agreement plus 7 years;
• licensed dataset audit and access logs: duration of the licence plus 6 years;
• raw capture footage containing identifiable individuals: deleted or de-identified within the period agreed with the Partner Site, and in any event no longer than required to produce and validate the licensed dataset.

Where we are required to retain data for longer to comply with legal or regulatory obligations, we will do so for the minimum period required.

We maintain a written information security programme aligned with recognised standards. Controls include role-based access, principle of least privilege, multi-factor authentication for administrative access, encryption of data in transit (TLS 1.2 or higher) and at rest, segregated environments for raw capture data and licensed datasets, secure software development practices, vendor risk management, vulnerability scanning, logging and monitoring, and a documented incident response plan including breach notification timelines that meet Article 33 and Article 34 UK GDPR.

Subject to applicable law, you have the right to:

• request access to your personal data and a copy of it;
• request rectification of inaccurate or incomplete data;
• request erasure of personal data in defined circumstances;
• request restriction of processing;
• object to processing carried out on the basis of legitimate interests, including profiling;
• request portability of personal data you provided to us on the basis of consent or contract;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not carry out such processing).

To exercise any of these rights, contact partnerships@physicore.ai. We may need to verify your identity before responding. We will respond within one month, extendable by up to a further two months for complex requests, in accordance with Article 12 UK GDPR.

If you are a resident of California, Virginia, Colorado, Connecticut, Utah or any other US state granting equivalent rights, you may have the right to know what personal information we process about you, to request deletion or correction, to opt out of the sale or sharing of personal information, and to limit the use and disclosure of sensitive personal information.

Do Not Sell or Share My Personal Information. Physicore does not sell personal information and does not share personal information for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act.

To exercise a US state privacy right, contact partnerships@physicore.ai. We will not discriminate against you for exercising any right. You may authorise an agent to act on your behalf; we will require proof of authorisation.

The Site and our services are directed at business users. We do not knowingly process personal data of children under the age of 16. If you believe that a child's personal data has been processed in connection with our activities, contact partnerships@physicore.ai and we will take prompt steps to investigate and, where appropriate, delete the data.

If you have a concern about how we process your personal data, please contact partnerships@physicore.ai so we can address it. You also have the right to lodge a complaint with a supervisory authority:

• in the United Kingdom, the Information Commissioner's Office (ico.org.uk);
• in the European Economic Area, the supervisory authority of your member state of residence, place of work, or place of the alleged infringement;
• in the United States, the applicable state attorney general or the California Privacy Protection Agency where relevant.

We may update this policy from time to time. The 'Last updated' date at the top of this page indicates when the most recent changes took effect. Where the changes are material, we will take reasonable steps to notify you, for example by a notice on the Site or by email where we hold your contact details.