Privacy and Data Protection Policy

Key Summary — How Clanics Handles Data and Independent Controller Notice

1. Who We Are: Clanics (clanics.com) is a passive public online listing directory and messaging conduit, and Clara is our automated AI discovery and onboarding software tool, both owned and operated by Glanis Ltd (registered in England and Wales). Glanis Ltd is the Data Controller solely for operating the Clanics platform's own account, directory, and technical infrastructure.

2. Clinics Are Separate Independent Data Controllers (Zero Glanis Liability): When a Client submits an enquiry, message, photo, or PDF document to a Clinic, or when a Clinic communicates with a Client, that Clinic receives and processes the data as a wholly separate, independent Data Controller in its own right. Glanis Ltd is never a joint controller with any Clinic, does not verify Clinics or Clients, and (together with Clanics, Clara, and our founder, directors, officers, shareholders, employees, contractors, affiliates, and agents) accepts zero responsibility and zero liability for how any Clinic stores, uses, secures, transfers, or handles data anywhere in the world.

3. Unified Global Policy (B2C and B2B): This single Privacy and Data Protection Policy governs both Clients (B2C patients, enquirers, reviewers, and visitors) and Clinics (B2B healthcare providers, practitioners, owners, and staff) worldwide, and forms an integral part of our Terms of Service:

• 1. Introduction and Data Controller Identity (Glanis Ltd / Clanics)
• 2. Unified Scope — Who This Policy Applies To (B2C Clients and B2B Clinics)
• 3. Categories of Personal and Business Data We Collect
• 4. Voluntary Special Category (Health) Data and Explicit Consent (Article 9 GDPR)
• 5. Our Lawful Bases for Processing (Articles 6 and 9 UK/EU GDPR)
• 6. How We Use Personal Data
• 7. Clara AI Processing and Our AI Sub-Processor (Google Gemini)
• 8. Data Sharing, Sub-Processors and Independent Clinic Controllers
• 9. EU/UK Infrastructure and International Data Transfers (Including Cross-Border Clinic Enquiries)
• 10. Automated Content Screening and Review Moderation (Article 22 GDPR)
• 11. Cookies, Browser Storage and PECR Compliance
• 12. Data Retention, Self-Service Deletion and Anonymisation
• 13. Data Security and Transmission Risk Disclaimer
• 14. Children's Data (Strictly 18+ Only)
• 15. Marketing Communications
• 16. Your Data Protection Rights (UK, EU/EEA and Global Users)
• 17. Changes to This Privacy Policy
• 18. Contact Details and Supervisory Authority Complaints

1. Introduction and Data Controller Identity (Glanis Ltd / Clanics)

This Privacy and Data Protection Policy ("Privacy Policy") explains how Glanis Ltd ("Glanis Ltd", "Clanics", "Company", "we", "us", or "our") collects, uses, stores, discloses, and protects personal data across the Clanics website (clanics.com), web applications, Clinic portal, messaging tools, and automated AI assistant Clara (collectively, the "Platform").

For the purposes of the UK General Data Protection Regulation ("UK GDPR"), the UK Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 ("PECR"), and (where applicable to individuals in the European Economic Area) the EU General Data Protection Regulation ("EU GDPR"), Glanis Ltd, a company registered in England and Wales under company number 13444991, with its registered office at 13 Hanover Square, London, England, W1S 1HN, VAT Registration No. GB514142531, is the independent Data Controller solely in respect of personal data processed to operate the Platform's own accounts, directory listings, search, and technical messaging conduit.

Global access, UK baseline standard. Clanics is operated from England and Wales and accessed by Clients and Clinics worldwide. Regardless of where you are located globally, Glanis Ltd acts as a UK-based Data Controller applying the UK GDPR as our baseline data-protection standard, while honouring mandatory local statutory rights where required by law (see Sections 9 and 16). This Privacy Policy serves as our statutory transparency notice under Articles 13 and 14 of the UK GDPR and EU GDPR.

2. Unified Scope — Who This Policy Applies To (B2C Clients and B2B Clinics)

This unified Privacy Policy governs all personal data processed on the Platform across both consumer and business users:

• Part A — B2C Users ("Clients" / "Patients" / "Visitors"): Individuals who browse directory listings, chat with Clara, save a clinic shortlist, create a Client account, send enquiries or messages (including optional image or PDF attachments) to Clinics, or publish reviews.
• Part B — B2B Users ("Clinics" / "Practitioners" / "Team Members"): Clinic owners, sole practitioners, doctors, dentists, administrators, receptionists, and staff members who register a Clinic via Clara, claim an existing directory profile, manage a Clinic account, reply to enquiries or reviews, or subscribe to a paid plan or Boost.

Crucial distinction — Clinics act as separate Independent Data Controllers: Whenever a Client sends an enquiry, message, photo, or PDF document to a Clinic through the Platform, that Clinic receives and processes that data as an independent Data Controller in its own right. Glanis Ltd is not a joint controller with any Clinic and has zero control over, and zero responsibility or liability for, any Clinic's independent data handling, storage, clinical record-keeping, security, or onward sharing (see Section 8).

3. Categories of Personal and Business Data We Collect

Depending on whether you use the Platform as a Visitor, a Client (B2C), or a Clinic user (B2B), we may collect and process the following categories of data:

• Client Account Data (B2C): Your name, email address, confirmation that you are aged 18 or over, account creation and consent timestamps, terms version accepted, email notification preferences, marketing consent status, and saved clinic shortlist (including any private shortlist notes you write).
• Clinic and Team Account Data (B2B): The full name, work email address, role (Primary Admin, Admin, or Staff), sign-in/activity timestamps, and terms acceptance records of Clinic team members, together with the Clinic's business profile details (clinic name, physical address, city, postcode, country, phone number, website domain, opening hours, languages, offered services, indicative "from" prices, and uploaded clinic photographs).
• Enquiry, Messaging and Attachment Data (B2C and B2B): The text of enquiries and messages exchanged between Clients and Clinics, the selected treatment/service category, read/unread status, booking status markers set by the Clinic, and any files voluntarily attached to a message (strictly validated JPEG, PNG, WebP, or GIF images and PDF documents up to the Platform's size limits).
• Reviews and Clinic Replies (B2C and B2B): Star ratings, review text, reviewed treatments, display name/initials, review terms acceptance metadata (timestamp, IP address, and user-agent recorded to evidence authenticity under the Digital Markets, Competition and Consumers Act 2024), and public replies posted by the Clinic.
• Clara AI Chat Inputs (B2C and B2B): Text or voice-to-text queries typed into the Clara search chat (on the home page) or the Clara clinic-onboarding chat (on /register-clinic) during your active session (see Section 7).
• B2B Subscription and Stripe Billing Data (Clinics only): Subscription plan tier, billing cycle (monthly/annual), trial dates, Boost purchase history, Stripe customer/subscription identifiers, invoices, and non-sensitive card display metadata (card brand, last 4 digits, and expiry date). Full payment card numbers and CVV security codes are processed directly by Stripe under PCI-DSS standards and are never seen or stored by Glanis Ltd.
• Technical, Security and Usage Data: IP address, approximate city/region/country derived from your connection, browser type and version, operating system, device viewport, referring URL, session tokens, rate-limiting counters, and security audit logs.
• Support and Contact Data: Name, email address, subject category, and message content when you submit a message via /contact, report content, or email our support or privacy teams.

Publicly Sourced Clinic Directory Data (Article 14 UK/EU GDPR Notice): To populate and maintain our public directory, we compile publicly available business information about clinics (such as business name, address, city, country, telephone number, website URL, opening hours, and aggregate public rating counts) from third-party public sources, principally Google Maps / Google Places APIs. As stated in our Terms of Service, we do not verify this data and display it strictly "as is". Where any such business listing contains the personal data of an identifiable sole practitioner or individual, our lawful basis under Article 6(1)(f) UK/EU GDPR is our legitimate interest in operating a comprehensive public healthcare directory. Any clinic owner or practitioner may claim, update, rectify, or request the removal of their listing at any time free of charge via our contact form.

4. Voluntary Special Category (Health) Data and Explicit Consent (Article 9 GDPR)

Under Article 9 of the UK GDPR and EU GDPR, personal data revealing information about your physical or mental health, medical conditions, or clinical treatments constitutes Special Category Data.

• No obligation to disclose medical records: Clanics is a public directory and does not require you to upload medical records or detailed clinical histories. Any health-related information, treatment interest, photograph, scan, or PDF document you choose to include in an enquiry or message is provided 100% voluntarily at your own sole discretion and risk, with zero responsibility or liability on Glanis Ltd, Clanics, Clara, or our founder, directors, officers, shareholders, employees, contractors, affiliates, and agents for how any contacted Clinic handles that information.
• Explicit Consent (Article 9(2)(a) UK/EU GDPR): When creating a Client account, you are asked to tick a dedicated checkbox providing your explicit, freely given, specific, and informed consent under Article 9(2)(a) UK/EU GDPR for Glanis Ltd to process, store, and transmit your health-related enquiry details and voluntary attachments solely to operate your account and deliver your messages to the specific Clinic(s) you choose to contact.
• Data minimisation warning: You should share only the minimum information necessary to make an initial enquiry. Do not enter national identity numbers, passport numbers, bank or payment card details, or confidential medical records into the Clara chat or initial enquiries.
• Right to withdraw explicit consent: You may withdraw your Article 9 explicit consent at any time by deleting your account in /profile or via our contact form. Because the core function of a Client account is facilitating health/treatment enquiries with Clinics, withdrawing this consent requires closing and deleting your Client account. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, nor does it delete records already received by a Clinic acting as an independent Data Controller (which you must contact directly).

5. Our Lawful Bases for Processing (Articles 6 and 9 UK/EU GDPR)

We process personal data only where we have a valid lawful basis under Article 6 (and, for Special Category health data, Article 9) of the UK GDPR and EU GDPR:

• Performance of a Contract (Article 6(1)(b)): To register and authenticate Client and Clinic accounts, transmit enquiries and messages between Clients and their chosen Clinics, publish reviews, and administer B2B Clinic subscriptions and Boosts under our Terms of Service.
• Explicit Consent / Consent (Article 9(2)(a) and Article 6(1)(a)): To process Special Category health data contained in Client enquiries and messages, and (where separately opted into) to send optional marketing emails.
• Legitimate Interests (Article 6(1)(f)): To compile and maintain accurate public directory listings, power search and discovery, prevent fraud, spam, and abuse, enforce our Terms of Service, moderate User-Generated Content, generate de-identified aggregate platform statistics and Market Intelligence benchmarks, and protect the security and integrity of the Platform (where our legitimate interests are not overridden by your fundamental rights).
• Legal Obligation (Article 6(1)(c)): To comply with mandatory UK legal, tax, accounting (HMRC), regulatory, and law-enforcement obligations, including the UK Online Safety Act 2023 and the Digital Markets, Competition and Consumers Act 2024.
• Establishment, Exercise or Defence of Legal Claims (Article 9(2)(f) and Article 6(1)(f)): To retain necessary audit, consent, and communication records required to defend Glanis Ltd against legal claims or regulatory inquiries within statutory limitation periods.

6. How We Use Personal Data

We use the personal data we collect strictly to:

• Create, authenticate (via passwordless one-time email codes), and manage Client and Clinic accounts;
• Operate Clara and the directory search engine to match treatment and location queries against listed Clinics;
• Deliver enquiries, messages, and voluntary image/PDF attachments between a Client and the specific Clinic(s) the Client selects, and send delayed email notifications of unread replies;
• Publish, display, and moderate Client reviews and Clinic responses;
• Process B2B Clinic subscriptions, free trials, invoices, and Boost placements via Stripe;
• Compute aggregated, anonymised statistical benchmarks for our B2B Market Intelligence features (which use published clinic service/price listings and aggregate search counts, and never disclose private Client messages or personal identities);
• Maintain Platform security, detect and block malicious uploads or automated scraping, and enforce our Terms of Service; and
• Comply with applicable UK law and respond to lawful requests from courts, regulators, or law-enforcement agencies.

We never sell your personal data to third parties or advertisers.

7. Clara AI Processing and Our AI Sub-Processor (Google Gemini)

• How Clara processes inputs: Clara combines deterministic software matching rules operated by Glanis Ltd with enterprise API calls to our artificial-intelligence sub-processor, Google LLC (Google Gemini API), to interpret natural-language treatment and location queries and assist with clinic onboarding.
• No training on your data: Under our paid enterprise/API data-processing terms with Google, text transmitted to the Google Gemini API is processed solely to return the requested structured interpretation to us and is not used by Google to train its public generative AI models.
• No persistent profiling and data minimisation: Clara is engineered never to ask Clients for full medical histories, national ID numbers, or financial credentials. Please do not type sensitive personal or medical history into the Clara chat box.

8. Data Sharing, Sub-Processors and Independent Clinic Controllers

We share personal data only in the strictly limited circumstances set out below:

• 1. Clinics You Choose to Contact (Independent Data Controllers): When you submit an enquiry or send a message (or attachment) to a Clinic on the Platform, we make available to that Clinic's authorised portal users: your name, your approximate city (derived from your connection), the treatment(s) selected, and the content of your message and any images/PDFs you attach. All replies take place inside Clanics messaging, and we do not share your email address with the Clinic (unless you voluntarily type your email address or phone number into the body of your message). Once a Clinic receives your enquiry or message, that Clinic acts as a separate, independent Data Controller for its copy of that data. Glanis Ltd does not control, audit, or supervise any Clinic's data practices and accepts zero responsibility or liability for what any Clinic does with the data you send it.
• 2. Infrastructure Sub-Processors (Article 28 UK GDPR): We use reputable third-party technology providers who process data strictly on our instructions under Article 28 data-processing agreements:
  • Cloud Hosting and PostgreSQL Database (EU Region — Frankfurt, Germany): hosts our core application server and encrypted relational database within the European Union;
  • Cloudflare, Inc. (Cloudflare R2 — EU Jurisdiction): provides European Union object storage for clinic photographs and message attachments, as well as edge security and TLS delivery;
  • Stripe, Inc. / Stripe Payments UK Ltd: processes all B2B Clinic subscription and Boost payments, billing portals, and VAT invoices;
  • Google LLC: provides the Google Gemini API (for Clara natural-language parsing) and Google Maps / Places APIs (for public clinic directory lookup and optional Google Business Profile syncing); and
  • Transactional Email Provider (SMTP): delivers one-time sign-in codes, email-change links, team invitations, and unread-message alerts.
  We may update or replace sub-processors as our infrastructure evolves. A current list of sub-processors is available upon request via our contact form.
• 3. Public Directory Visitors: If you are a Clinic, your published business profile, services, indicative prices, photos, ratings, and review replies are publicly visible on the Platform. If you are a Client who submits a review, your chosen display name/initials, star rating, reviewed service, and review text are publicly visible on the relevant Clinic's profile.
• 4. Legal, Regulatory and Corporate Disclosures: We may disclose personal data where required by law, court order, subpoena, or regulatory authority (such as the ICO, CQC, MHRA, HMRC, or police), to enforce our Terms of Service, to contest a payment chargeback with Stripe/banks, to protect the safety or rights of Glanis Ltd or others, or in connection with a corporate merger, acquisition, financing, or sale of assets.

9. EU/UK Infrastructure and International Data Transfers (Including Cross-Border Clinic Enquiries)

1. Core EU and UK Hosting Infrastructure: Clanics is operated by Glanis Ltd from the United Kingdom, and our primary PostgreSQL database and Cloudflare R2 object storage bucket are configured and hosted in the European Union (Frankfurt / EU Jurisdiction). Transfers of personal data between the United Kingdom and the European Economic Area (EEA) are protected by mutual UK-EU adequacy regulations.

2. Global Sub-Processors and Safeguards: Some of our technology sub-processors (such as Google and Stripe) operate global infrastructure that may process limited data in the United States or other jurisdictions outside the UK and EEA. Where we transfer personal data to a sub-processor outside the UK/EEA, we ensure an approved statutory transfer mechanism is in place under Chapter V of the UK GDPR / EU GDPR — such as the UK-US Data Bridge / EU-US Data Privacy Framework, the UK International Data Transfer Agreement (IDTA), or the European Commission Standard Contractual Clauses (SCCs) with the UK Addendum.

3. Cross-Border Enquiries to International Clinics (Article 49(1)(a) and (b) UK/EU GDPR — Medical Tourism Notice): Clanics lists Clinics located in many countries around the world, including jurisdictions outside the United Kingdom and the European Economic Area (for example, Türkiye, the Middle East, Asia, and the Americas) that have not received a data-protection adequacy decision from the UK Government or the European Commission. Local laws in those countries may not provide the same level of data protection or supervisory oversight as UK or EU law.

When you choose to submit an enquiry, message, or attachment to a Clinic located outside the UK/EEA, you expressly acknowledge and agree that:

• (a) the cross-border transmission of your enquiry, messages, and attachments to that international Clinic takes place at your own explicit request and direction;
• (b) the transfer is lawfully carried out under the statutory derogations in Article 49(1)(b) UK/EU GDPR (transfer necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject's request) and Article 49(1)(a) UK/EU GDPR (your explicit consent given after being informed of the possible risks of such transfers due to the absence of an adequacy decision and appropriate safeguards); and
• (c) once the international Clinic receives your data, that Clinic is an independent Data Controller subject to its own local laws, and Glanis Ltd has zero responsibility and zero liability for the Clinic's cross-border data processing, storage, or security.

10. Automated Content Screening and Review Moderation (Article 22 GDPR)

We use automated software filters (including word blocklists, profanity detection, contact-detail redaction, and file-signature validation) to screen reviews, clinic edits, and uploaded attachments for prohibited, unsafe, or unlawful content. Where an automated filter flags a review or profile edit, it may be held in a moderation queue or rejected. Neither this automated content screening nor Clara's directory search filtering constitutes a decision based solely on automated processing that produces legal effects or similarly significant effects concerning you within the meaning of Article 22 of the UK GDPR or EU GDPR. You may always request human review of a moderated review or listing decision via our contact form.

11. Cookies, Browser Storage and PECR Compliance

Under Regulation 6 of the UK Privacy and Electronic Communications Regulations 2003 ("PECR") and Article 5(3) of the EU ePrivacy Directive, cookies and local storage that are strictly necessary to provide an online service explicitly requested by the user do not require prior opt-in consent. Clanics sets only strictly necessary authentication and security cookies:

• clanics_token — HttpOnly, Secure session cookie holding your signed-in authentication token (expires after up to 7 days). Not readable by client-side JavaScript.
• clanics_user_type — Indicates whether the current session is a Client or Clinic account so the interface renders the appropriate navigation (expires after up to 7 days).
• clanics_signup_pending / clanics_clinic_signup_pending — Short-lived HttpOnly cookie (15 minutes) used solely during initial registration between verifying your one-time email code and completing the final name/terms step.

In addition, your browser's local/session storage temporarily holds strictly functional UI state on your own device (such as your active Clara conversation in the current tab for up to 2 hours, and dismissed UI hints). We do NOT use any third-party advertising cookies, retargeting pixels, cross-site trackers, or behavioural profiling cookies. You can clear cookies at any time in your browser settings, though removing clanics_token will sign you out.

12. Data Retention, Self-Service Deletion and Anonymisation

We retain personal data only for as long as necessary to fulfil the purposes set out in this Privacy Policy and to comply with English legal and tax obligations:

• Enquiries, Messages and Attachments: Retained for up to six (6) years from the date of the last activity in the conversation thread (aligned with the statutory limitation period for contract and tort claims under the UK Limitation Act 1980), unless deleted earlier upon account erasure. When a Client archives or removes a conversation from their own inbox view, it is hidden from the Client's view (soft-deleted) while remaining accessible to the Clinic for its own regulatory and clinical record-keeping duties.
• Clara Chat Sessions and De-Identified Phrase Cache: Your active Clara conversation is kept in transient session state for up to 2 hours and is not stored as a permanent identifiable chat transcript linked to your account (save for short-lived security and rate-limit logs). To reduce redundant AI API calls, Clara caches short, de-identified search phrases and their parsed treatment/location meaning (never storing messages containing numbers, email addresses, or user IDs) for up to 90 days from last use.
• Published Reviews on Account Deletion: Reviews remain published while your account is active (and may be edited by you within 30 days of publication or deleted by you at any time via /profile/reviews). If you delete your Client account without first deleting your reviews, your published reviews are permanently anonymised (the link to your user ID and identity is severed) so that directory ratings remain accurate without retaining your personal identity.
• Self-Service Account Deletion (Clients and Clinics):
  • Clients can permanently delete their account at any time in one click via /profile ("Delete account permanently"). This immediately erases your user record, credentials, shortlist, and messages/attachments from our active systems, clears your session cookie, and records only a minimal, non-reversible cryptographic hash and timestamp in our deletion audit table to prove compliance with Article 17 UK/EU GDPR.
  • Clinics (via their Primary Admin) can permanently delete their Clinic via /admin/clinic/danger ("Delete clinic permanently"), which cancels any active subscription at Stripe and permanently deletes the Clinic profile, photos, services, team accounts, and enquiries from our active systems.
• B2B Tax and Billing Records (Clinics): In accordance with UK HMRC tax and statutory accounting laws, Clinic subscription invoice records and payment audit logs are retained for six (6) years plus the current financial year.

13. Data Security and Transmission Risk Disclaimer

We implement robust technical and organisational security measures in accordance with Article 32 of the UK GDPR and EU GDPR — including TLS/HTTPS encryption in transit, EU-hosted database and Cloudflare R2 storage, strict file-magic-byte verification on uploads (blocking executable or script-bearing files), HttpOnly session cookies, passwordless one-time code authentication, and strict API rate-limiting.

Transmission at your own risk: Notwithstanding our security measures, no method of transmission over the public internet or electronic storage is 100% impenetrable. To the fullest extent permitted by law (and subject always to non-excludable statutory obligations), you transmit data to and through the Platform at your own risk, and you are solely responsible for keeping your email account and devices secure. In the event of a personal-data breach affecting our systems that is likely to result in a risk to individuals' rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours and affected data subjects where required by law.

14. Children's Data (Strictly 18+ Only)

The Platform is strictly for adults aged 18 and over. We do not knowingly collect, solicit, or process personal data from anyone under 18 years of age. If we discover or are notified that a person under 18 has created an account or submitted personal data, we will promptly delete that account and data. If you believe a minor has submitted data to Clanics, please notify us immediately via our contact form.

15. Marketing Communications

We do not send unsolicited marketing emails. Your Client profile (/profile) records whether you have opted in to receive optional tips and offers from Clanics; you can toggle that preference off at any time in your profile or via the unsubscribe link in any marketing email. Withdrawing marketing consent never affects essential service and transactional emails (such as one-time sign-in codes, email-change confirmations, or unread-message notifications).

16. Your Data Protection Rights (UK, EU/EEA and Global Users)

Under the UK GDPR, the Data Protection Act 2018, the EU GDPR (where applicable), and equivalent international data-protection laws, you have the following rights (subject to statutory conditions and exemptions):

• Right of Access (Article 15 — Subject Access Request): Request confirmation of whether we process your personal data and receive a copy of the personal data we hold about you.
• Right to Rectification (Article 16): Correct inaccurate or incomplete personal data (which you can also do directly at any time in /profile or /admin/clinic).
• Right to Erasure / "Right to be Forgotten" (Article 17): Delete your account and personal data immediately using our self-service deletion buttons or by contacting us, subject only to mandatory legal retention obligations.
• Right to Restriction of Processing (Article 18): Request that we restrict the processing of your personal data in specific statutory circumstances.
• Right to Data Portability (Article 20): Receive the personal data you have provided to us in a structured, commonly used, machine-readable format (JSON).
• Right to Object (Article 21): Object at any time to processing based on our legitimate interests (Article 6(1)(f)) or to direct marketing.
• Right to Withdraw Consent: Where we rely on your consent (including explicit consent under Article 9(2)(a)), withdraw that consent at any time without affecting prior lawful processing.

How to exercise your rights: You can exercise many rights immediately via your account settings (/profile or /admin/clinic), or by contacting our Data Protection team via our contact form. We will respond within one (1) calendar month (extendable by up to two further months for complex requests as permitted by statute) and may verify your identity via your registered email address before disclosing or erasing data.

Requests relating to a Clinic's copy of your data: Because each Clinic is a separate, independent Data Controller for enquiries and messages it receives (Section 8), if you wish to exercise data-protection rights over clinical or enquiry records held by a specific Clinic, you must contact that Clinic directly.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, regulatory, or operational changes. Whenever we update it, we will publish the revised text on /privacy and update the "Last updated" date and version number at the top of the page. Where changes are material, we will also notify registered users via an in-app banner or email.

18. Contact Details and Supervisory Authority Complaints

If you have any questions, requests, or concerns about this Privacy Policy or how Glanis Ltd handles personal data, please contact us first:

• Data Controller: Glanis Ltd (trading as Clanics), Company No. 13444991, Registered in England and Wales — Registered Office: 13 Hanover Square, London, England, W1S 1HN
• Privacy and Data Protection Enquiries: Contact form (/contact)
• General Support Enquiries: Contact form (/contact)

Right to complain to a Supervisory Authority: You have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by telephone on 0303 123 1113. If you reside in the European Economic Area (EEA) or another jurisdiction with a national data-protection authority, you may also have the right to lodge a complaint with your local supervisory authority. We always welcome the opportunity to resolve any concern with you directly first.