// LEGAL · PRIVACY

How we handle your information.

Last updated: 8 October 2026

This notice explains how Ortent Advisory Ltd ("we", "us", "Ortent") collects and uses personal data when you interact with our website, subscribe to our writing, or engage us for advisory services. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Ortent Advisory Ltd is the data controller responsible for your personal data. We are a company registered in England and Wales, company number 17176275, with its registered office at 14/2E Docklands Business Centre, 10-16 Tiller Road, London E14 8PX.

If you have any questions about this notice or wish to exercise any of your rights, contact us at legal@ortent.co.

2. What we collect and why

Website contact

If you use the contact form, we receive your name, email address, company (if you give it), the topic you pick and your message. The form is hosted by Netlify, Inc., which stores each submission in our account and emails it to our Google Workspace inbox. We use what you send to reply and, where relevant, to discuss a potential engagement. If you email us directly, we receive your name, email address and the contents of your message, and use them the same way. Our lawful basis is legitimate interest (responding to enquiries) and, where an engagement follows, performance of a contract.

If you use the report form on the Life Sciences Radar, we receive the company and theme you pick, the link and description you give us, your stated relationship to the company and, if you choose to give it, your email address. The form is hosted by Netlify, Inc., which stores each submission in our account and emails it to our Google Workspace inbox. We use what you send to check the report against the radar's rules and, if you gave an email address, to ask you about it. We never publish your email address or say who sent a report. We delete reports 12 months after the quarterly refresh that considered them. Our lawful basis is legitimate interest (keeping the radar accurate).

Spam protection on the contact form

The contact form uses Google reCAPTCHA to check that a person, not an automated program, is sending it. reCAPTCHA collects information about your device and how you interact with the page and sends it to Google, which processes it under its own privacy policy and terms. Our lawful basis is legitimate interest (keeping the form free of spam and abuse).

Newsletter subscriptions

If you subscribe to our field notes, your email address is collected and processed by Substack Inc., which operates the platform we use to publish and distribute the newsletter. Substack acts as an independent controller of subscriber data for its own platform purposes, and as a processor on our behalf for delivering the newsletter to you. You can review Substack's privacy notice at substack.com/privacy. Our lawful basis is consent, which you give by submitting the form. You can unsubscribe from every email we send.

Client engagements

When we work with a client, we hold the contact details and correspondence needed to deliver the engagement, along with any documents and information shared with us during the work. Our lawful basis is performance of a contract and, where applicable, legitimate interest or legal obligation.

Website analytics

Ortent uses two analytics services on its website. Netlify provides server-side traffic analytics derived from CDN logs. Netlify sets no cookies, processes no personal data, and retains aggregate visit counts for 30 days. Microsoft Clarity provides anonymised session replays and heatmaps so we can understand how the site is used and improve it. Clarity sets cookies, masks form fields and other personal data by default, and does not sell or share data with third parties. Its retention is 13 months. We do not run Google Analytics or any advertising trackers. The specific cookies set are listed on the cookies page. The lawful basis for both services is legitimate interest (improving the website).

3. How we share your data

We do not sell personal data. We share data only with:

  • Service providers acting on our instructions (for example, Substack for the newsletter, Google Workspace for email, Netlify for website hosting and contact form submissions, Google reCAPTCHA for spam checks on the contact form, and our accountants).
  • Professional advisers where necessary (for example, legal or tax counsel).
  • Authorities where we are required to by law.

4. International transfers

Some of our service providers are located outside the UK, including in the United States. Where we transfer personal data outside the UK, we rely on approved safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.

5. How long we keep data

We keep personal data only as long as we need it for the purpose it was collected, or as required by law. Enquiry emails and contact form submissions are kept for up to 24 months. Client engagement records are kept for 6 years after the end of the engagement for tax and professional purposes. Newsletter subscriptions are kept until you unsubscribe.

6. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Ask us to correct inaccurate or incomplete data.
  • Ask us to delete data, subject to any legal retention requirements.
  • Restrict or object to processing in certain circumstances.
  • Withdraw consent at any time where we rely on consent.
  • Ask for a copy of your data in a portable format.

To exercise any of these rights, email legal@ortent.co. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to address any concerns first.

7. Changes to this notice

We will update this notice from time to time. Material changes will be noted at the top of the page.