Outreach privacy notice

Version outreach-privacy-2026-10-23, in effect from 23 October 2026.

This notice is the information UK GDPR Article 14 says we must give you when we hold personal data about you that we did not collect from you. It is written for the person who has received, or may receive, an email from us about ProofPack.

Where things stand on 14 October 2026. We have sent outreach email since 12 October 2026: the first sending run was at 10:30 that day, and first emails have gone out in the sending runs since. On 8 October 2026 we collected the work contact details of the people and company inboxes we write to: 71 email addresses at 53 companies, 27 of them a named person’s, each with the web address of the page it was read from. We also hold 8 addresses we set aside that day and will not write to. “Where we keep it” says where these details are. We do not send any until the safeguards listed at the end of our legitimate interests assessment are in place, including the stop link and the hourly reading of replies described below.

From 12 October 2026 the list also grows by itself. From 12 October 2026 our software also finds new contacts by itself, once a day, without a person or an AI assistant reading the page. “Contacts our software collects by itself” below says how, and where it stops. The first sending run was at 10:30 on 12 October 2026. From 14 October 2026 the software also finds companies to write to in two US public databases of small-business research awards, and establishes a company’s country from the FDA’s own records when the FDA’s list does not give it; “Where it comes from” and “Contacts our software collects by itself” say how.

Who we are

The controller is Global Phoenix Solutions Ltd, a company registered in England and Wales, number 14855822. Registered office: Ground Floor Flat, 259 Chichester Road, Bognor Regis, West Sussex, PO21 5AH, United Kingdom.

Contact for anything in this notice: Joshua Sandhu, director, joshua.sandhu@globalphoenix.co.uk. We have not appointed a data protection officer; the director handles data protection himself.

What we hold about you

• Your name and job title.
• Your work email address, the web address of the page we read it from, and whether it is a shared inbox such as info@.
• The country we recorded for you.
• Your employer’s name, country and web domain, the web address of the record on a public authority’s website, such as a company register, that we read to check that your employer is a company, and the group of companies it belongs to, if it belongs to one.
• Where the FDA’s list gives no country for your employer, the country our software found in the FDA’s own records, and the web address of the openFDA record it was read from.
• One sentence about your employer from a public regulatory record, and the short name of the device it names: for example, a named device from your company, the number of its FDA 510(k) record and the date of the FDA’s decision on it. This is the sentence that appears in the email we send you.
• For a company we know from a US federal small-business research award rather than from an FDA record: one sentence from the award record, which names the company, the agency (NIH or NSF), the award number, the award’s title and the award’s fiscal year (NIH) or start date (NSF), and the short name taken from that title. This is the sentence that appears in the email we send you.
• The role group we put you in, one of regulatory, engineering or leadership, which decides the wording of the first email.
• The dates that manage the record: when it was loaded into our outreach database, the last activity on it, and when it is due for deletion.
• The messages we sent you, the dates, which fixed wording of the first email you were sent, and any reply you sent, including whether you asked us to stop.

We hold nothing about your private life, nothing from social media, and no financial data. We do not hold a photograph of you.

Where it comes from

Publicly accessible sources only:

• Two FDA lists tell us which companies to write to: the FDA’s 510(k) database, read through openFDA, and the FDA’s list of AI-enabled medical devices. A 510(k) record in the database names your company and its device, and also names the person the record gives as your company’s contact for that submission, who may be you. Our collector reads that name with the rest of the record and does not store it. We collect from no MHRA or EUDAMED record.
• From 14 October 2026, two further public records tell us which companies to write to: the National Institutes of Health’s RePORTER database and the National Science Foundation’s Awards database, which list the small-business research awards (SBIR and STTR) the two agencies have made. Once a day our software reads the awards of the last two years to companies in the United States, and keeps an award only if its title or abstract names artificial intelligence, machine learning or a related term (an index term in NIH’s record is not enough), the award’s title, abstract or index terms name a medical product such as a diagnostic, a device, imaging, screening or monitoring, and its title or abstract names a clinical setting. It does not keep an award whose title or abstract describes drug discovery or development, a therapeutic, a vaccine, an antibody, gene or cell therapy, agriculture, veterinary or defence work. For each award it keeps, it records the company’s name, city and state, the award’s number, title, dates and public web address, and the words that matched. For an NSF award the record also gives the principal investigator’s name and business email address, which the software uses only as “Contacts our software collects by itself” sets out.
• From 14 October 2026, when the FDA’s list of AI-enabled medical devices gives no country for a company, our software looks for it in the FDA’s own records, read through openFDA: the 510(k) record of the company’s clearance; the FDA’s premarket approval (PMA) record, where a US state gives the United States; or the FDA’s establishment registration record, when every establishment registered under the company’s name gives the same country. When the records disagree, or a record under the same company name shows Germany, Austria, Denmark, Switzerland or Liechtenstein beside another country, the country stays unknown and the company is excluded. The software stores the country with the web address of the openFDA record it was read from, and never replaces a country already recorded. It stores no person’s details for this.
• Your work address, and your name and role, come from your company’s own website, where they are published for professional contact, or from a public regulatory record: the 510(k) summary the FDA publishes for your company’s device, which names a contact person for the submission with a work address. On 8 October 2026 every named person on our list came from such a summary.
• Official company registers, such as Companies House in the United Kingdom and the Danish register (CVR), and for some US companies a state’s business records or the company’s filings with the US Securities and Exchange Commission. We read them to check that your employer is a company, and, for a Danish company, whether it has asked not to receive marketing.

Our director collected these details on 8 October 2026, with Claude, Anthropic’s AI assistant, reading the pages and records for him. We never guess an email address from a name. If your company publishes no address for the role, we do not write to it. We do not buy lists. Every address we hold carries the web address of the page it was read from, and our software refuses to store an address without one.

Contacts our software collects by itself

From 12 October 2026 our software also finds new contacts by itself, once a day, without a person or an AI assistant reading the page. The director’s collection of 8 October 2026, described above, was done differently and is not repeated.

How. For a company on one of the two FDA lists above whose newest 510(k) clearance was decided in the last twelve months, the software downloads the 510(k) summary the FDA publishes for that clearance and reads the contact person the summary names for the submission, with the work address printed there. It stores the name, the job title if one is printed, the work address, and the web address of the FDA’s PDF as the address’s source. It guesses no address and does not complete one: it takes an address only when it appears in full in the text of the PDF, and drops one that a line break, a hyphen or an apostrophe has cut.

Where it stops.

• It looks only at companies on the two FDA lists and, from 14 October 2026, at companies that hold a small-business research award as described below and are on neither list. It does not search the web for people: the only website it reads is the company’s own, and only for a shared company inbox, as set out below.
• It keeps at most one contact for a company.
• It never keeps a regulatory submission consultant: it keeps an address only if it is on the company’s own web domain, so a summary whose contact writes from a consultancy’s domain gives us no contact.
• It applies the same checks as for every contact, set out under “Our lawful basis”: it refuses a free-mail address, refuses Germany and Austria, and holds a Danish company back until we have checked the Danish register by hand.
• It keeps a contact for writing to only when it has evidence that the employer is a body corporate, and, for a company on an FDA list, it takes that evidence in only two ways. If the employer is a United Kingdom company with an active entry at Companies House, the evidence is that entry, and the software stores its web address. Otherwise, a company is treated as a body corporate when the applicant’s name on the FDA’s 510(k) record for the clearance ends in a recognised legal form, such as Inc., LLC, Corp., Ltd., GmbH, S.A., B.V. or A/S, and the software stores the web address of that FDA record as the evidence. This second way is a reading of the name the applicant gave the FDA and not of a company register, and the software does not check that the company named is still trading. A company whose applicant name ends in no such legal form is treated as an organisation whose status is not established: the software keeps no contact for it, and it receives no email. For a company known from an award, the evidence is a legal-form suffix such as Inc or LLC on the organisation name in the award record, with the award’s public web address as the evidence address. That too is a reading of a name and not of a company register; a company whose name in the award record ends in no such legal form is treated in the same way, and receives no email.

What it writes down. For each company it looks at, the software keeps a short record on the computer: the company, the number of the FDA record, the country, the date of the FDA’s decision and what happened, and, where it found a contact, the role group and the domain of the email address. The contact’s name and address are kept only for a contact that is kept for writing to. Each day it writes a report for the director with those same things and the job title, with any part of the contact’s name taken out of the title. No person’s name or address is in the report or in the software’s log.

What it cannot tell. The software checks that the address is on the company’s domain. It does not check that the person named in a summary still works there, which is why, for a named person, it takes only a clearance decided in the last twelve months and why you may tell us if you no longer do. A shared company inbox from the company’s own website, described next, is read for a clearance decided in the last two years, whatever its age within them, because a company’s shared inbox does not go stale in that way.

A shared inbox from the company’s own website. From 13 October 2026 the software also looks at the company’s own website for a shared company inbox, such as info@ or regulatory@. Since 14 October 2026 it does this for every company on the two FDA lists whose newest clearance was decided in the last two years and for which we hold no contact, unless our exclusion rules rule the company out. That includes a company whose 510(k) summary gave no contact the software can keep, because it names no one, names a consultant, or gives a job title that fits none of our role groups, and a company whose summary the software does not read, because its newest clearance is more than twelve months old or because it has only one entry on the two lists. It never keeps a person’s address from a website, and it does not keep an inbox for sales, careers, press, investors or privacy. To find the website it uses, in this order: the web domain of the customer contact address the company gives in the FDA’s medical device identifier database (GUDID, read through openFDA), which it uses only for the domain and does not store; a web address or email domain printed in the 510(k) summary that is not a consultant’s; or, only if neither gives one, a domain made from the company’s name. Each must resemble the company’s name. It treats a site as the company’s only when a page on it shows the company’s name together with the number of the FDA record, the device’s name or, for a domain that was not made from the name, the company’s city as the FDA record gives it. It reads at most six pages of the site (the home page and pages such as contact, about, company, team, imprint or impressum), obeys the site’s robots.txt, identifies itself as ProofPack with the web address of this notice, and keeps the address only when it is on the company’s own domain or its www host. It stores the address with the web address of the page it was read on, and a shared inbox is stored with no name: the first message to it opens “Hello,”. The same limits apply as for a contact from a summary: the two FDA lists, one contact per company, the same checks and the same evidence that the employer is a body corporate. The twelve months does not apply to a shared inbox: it is the limit on a named person read from a summary, who may have left the company, and a company’s shared inbox does not go stale in that way. The software tries a company’s website at most once in 30 days and the websites of at most 60 companies a day, and for each try it records the company, the FDA record number, the domain, where the domain came from, how many pages it read and what happened, and no address.

Companies known from a small-business research award. From 14 October 2026, for a company that holds such an award, as “Where it comes from” describes, and is on neither FDA list, the software finds a contact in two ways, and keeps at most one contact for a company. The NSF’s Awards database publishes the email address of an award’s principal investigator. Where that address is on the company’s own web domain (not a free-mail provider, a university or a government domain, and a domain that matches the company’s name), the software stores the person’s first name, the address and the web address of the award page it was read from, records the person’s role as the award’s principal investigator, puts them in the engineering role group and writes to them as the company’s technical lead. The NIH database publishes investigators’ names and no email address, and our software stores no investigator from NIH. Otherwise the software looks at the company’s own website for a shared company inbox such as info@. To find the website it uses, in this order: the web domain of the principal investigator’s address, where that address passed the checks above; a web address printed in the award’s abstract that is not a university, government or platform site; or, only if neither gives one, a web address guessed from the company’s name. The software guesses only from the company’s distinctive name words run together, when there are two or more of them, or from its whole name run together, and never from the first word of a name alone; a name of one word is used only if it has at least seven letters. It accepts a website only if one of its pages shows the company’s name together with the city or the state on the award record or, for a web address it guessed, together with a phrase of the award’s title or the award’s number; for a guessed address it does not accept the city and the state together. It reads the website as it reads the website of a company on an FDA list: at most six pages, obeying the site’s robots.txt, keeping the address only on the company’s own domain or its www host, and storing it with the web address of the page it was read on. The websites of these companies count in the same 60 companies a day, and the software tries a company’s website at most once in 30 days. For each try it records the company, the award’s number, the domain, where the domain came from and what happened, and no address. It never stores a personal address from a website. The software does not check that a principal investigator still works at the company, which is why it reads awards only from the last two years and why you may tell us if you no longer do. The limits on the emails our software sends each day, at most 20 first emails and 50 messages in all, apply to a contact found this way as to every other.

Where it runs. Today the software runs once a day on the computer that runs our sending software, which is our director’s own computer. We intend to move it later to scheduled jobs on GitHub and to move the outreach database to Cloudflare’s D1 service. Before either move we change “Where we keep it” and “Who receives it”.

Why we use it

To send you a short email telling you that ProofPack exists, what it computes, and how to see it, because your company is named in a public FDA record or holds a US federal small-business research award for an AI medical product; and up to three short follow-ups in the same thread if you do not reply. Then it stops. From 13 October 2026 our software sends the follow-ups as well as the first email, as item 9 of the safeguards in our legitimate interests assessment explains: on days 5, 11 and 18 after the first email, as replies in the same thread, at most three, and the last says that we stop there. It sends no follow-up after you reply, after you ask us to stop, or after a bounce or a hold on your record, and none while a pause for the deliverability of our email is on. The follow-ups count against the 50 messages a day our software may send. We also keep a record that we wrote to you, so we do not write again too soon, and a record of any request to stop, so that we honour it.

Which wording of the first email you read. The first email exists in three fixed wordings for each role group, written in advance, for a company on an FDA list, and in three more for a company known from an award. From 23 October 2026 the three wordings that apply to your employer differ only in the subject line, and the body is the same. From 23 October 2026 every wording also says that, for a small number of teams, the first full pack is free, in return for the team’s regulatory affairs lead reviewing the pack wording and completing the installation and operational qualification (IQ/OQ) record, the offer our pricing page calls “First full pack free”. The second set also says that the award record is what we know about the company and what ProofPack does, and does not say or imply that the company has or plans a submission. If we write to a shared inbox, such as info@, the email opens “Hello,”, and from 23 October 2026 it carries one added line asking the reader to pass it to their regulatory lead if it is theirs. Our software chooses one of the three that apply to your employer by a fixed rule from totals it keeps for each wording: how many people were sent it and how many replied, were interested, asked us to stop or bounced. From 23 October 2026 the totals count only emails sent with the wordings of that date, and the totals for the earlier wordings are not used. The totals carry no name or address, and a reply of yours is counted only in the total for the wording you were sent. The rule uses your role group and whether the wording fits your employer’s device name in the subject, and nothing else about you. It has no effect on you beyond which of the wordings of the same email you read. It is not profiling and not an automated decision about you, and no language model writes or chooses any part of an email. The footer of an email to a company known from an award reads: “Why you are receiving this: your company holds a US federal small-business research award (the public NIH RePORTER or NSF Awards records), and your work address is published on your company website or in a public award record.”

Alerts to our director

When you reply to an email of ours, our software emails our director a short alert, from our outreach mailbox to his own address, joshua.sandhu@globalphoenix.co.uk, and to no one else, because our software refuses any other recipient. It names your company, your role group, the step you replied to, the date, a link to the thread in the mailbox and the first 60 words of your reply, without the earlier messages quoted under it. Those 60 words can include whatever you wrote about yourself. It does not give your name or your address. It sends one alert for each thread, however many replies the thread holds, and the link is to the thread the reply is in. It sends no alert for an out-of-office reply, a bounce or your own request to stop. If someone else at your company, such as a colleague the email was forwarded to, writes in the thread and asks us to stop, we put their address on the suppression list, stop sending to you, and email our director one alert saying so, with the same details and the first 60 words of the message and without any name or address. Our software also emails him an alert when one of its scheduled tasks fails or its daily check at 07:00 finds a problem, and a summary at 08:00 on Mondays: totals for the last seven days and to date, the counts for each wording and the number of messages due in the next seven days, with no name or address. Google, the provider of the mailbox, is the only other party involved.

Our lawful basis

Legitimate interests, UK GDPR Article 6(1)(f). Our interest is telling the small number of people who prepare AI medical device submissions that a tool exists that computes the statistics those submissions need. The people we write to work at companies named in a public FDA record or that hold a US federal small-business research award for an AI medical product. Most of those companies are in the United States. The statements in this notice about the Privacy and Electronic Communications Regulations 2003 apply to a recipient in the United Kingdom; a recipient in the United States has the same opt-out, honoured on receipt, and the same suppression list. We have written down how we weighed that interest against your interests in a legitimate interests assessment, which is published in full.

We rely on this basis only for business-to-business email to corporate subscribers, which is the position the Privacy and Electronic Communications Regulations 2003 (PECR), regulation 22, take. So our software checks every contact when it is loaded, and again before any message to it is built:

• we do not write to personal addresses at the free-mail providers on our list, such as gmail.com, outlook.com or yahoo.com;
• we do not write to sole traders or anyone who is not a body corporate: our software accepts a contact only when it is marked as working at a body corporate and carries the https web address of the record that shows it, and it treats an organisation whose status we have not established as excluded. The software checks that the web address is there and is https, not what the page says; we read the record when we prepare the list. On our 8 October 2026 list, each of those web addresses is a page on a public authority’s website, such as a company register. For a contact our software finds by itself, it is the web address of the company’s entry at Companies House or of the FDA’s record of the clearance, which is also a public authority’s page;
• we do not write to anyone in Germany or Austria, at all, or to a .de or .at address;
• we do not write to a Danish company that the Danish company register (CVR) marks as not wishing to receive marketing (reklamebeskyttelse). Two companies on our 8 October list are marked so: we took them off the list that day, and the setup our director ran on 10 October 2026 put them on our software’s suppression list, 7 rows in all. Our software does not read the Danish register itself, so we check it by hand before we add any other Danish company.

If we write to you and any of those describes you, tell us and we will delete the record.

How long we keep it

Twelve months after the last activity on your record, and then we delete it, unless your company becomes a customer, in which case the customer records described in our privacy notice apply instead. “Activity” means the record being loaded into our outreach database, a message sent to you or a reply from you. Our software lists the records that are due; it deletes nothing itself, so our director deletes them by hand, at least once a month. Contact details collected on 8 October 2026 that are not loaded into our outreach database, including the 8 we set aside, stay where “Where we keep it” says, and we delete them, and the copies it lists, within twelve months of 8 October 2026.

If you ask us to stop, we keep your email address on a suppression list for as long as we send any outreach at all. That is the one record we keep on purpose after you object, because it is what stops us writing to you again.

Where we keep it

On 11 October 2026 the contact details we collected on 8 October are on the computer that runs our sending software, which is our director’s own computer, in four kinds of file: the files of the list written on 8 October 2026; copies of the public pages the details were read from; working copies made while the list was put together and checked and while our sending software was tried out, one of them a trial copy of the sending software’s database that holds 22 of the contacts and from which no message has been sent; and the records our AI assistant keeps of the sessions in which this work was done (Anthropic, under “Who receives it”). One named person’s work address and one general inbox, both at one of the two Danish companies we set aside, were also written on 8 October 2026 into files in the code repository of our sending software, which is private and which GitHub holds. On 10 October 2026 we removed them from its current files and rewrote its history so that no version in it contains them; GitHub still holds the earlier versions, outside that history, until it deletes them (GitHub, under “Who receives it”). The outreach database our sending software sends from exists: on 10 October 2026 the setup our director ran created it, a file on the same computer, and loaded into it 22 of the contacts, the ones our software accepts, with 7 rows on its suppression list for the two Danish companies. Our outreach records, meaning the details listed above, the messages and the suppression list, are kept in that file. When the stop link records a request, it records it on this website, in the Cloudflare database named below. Our sending software reads the stop-link records from this website before each sending run and does not send to an address recorded there; if it cannot read them, it does not send. It copies each record it does not already hold into its own suppression list.

Contacts our software collects from 12 October 2026 are kept in the same way: in the outreach database on the same computer, each with the web address of the FDA summary it was read from or, for a contact found from a small-business research award, of the award page or the company’s own page it was read from. The records of the awards the software keeps, and the countries it finds in the FDA’s records with the web address of the record each came from, are kept on the same computer. A company the software holds back, for the reasons given under “Contacts our software collects by itself”, is recorded on that computer as held, without the name or address of any contact there, and receives no email.

Who receives it

These are the third parties that touch this data:

Recipient	What they do with it	Where
Google (Google Workspace, Gmail)	The mailbox the emails are sent from and replies arrive in, and from which our software emails our director the alerts and summaries described under “Alerts to our director”	Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, is the Google contracting entity for a customer with a United Kingdom billing address; Google is a US company
Cloudflare	Hosts this website and the address the stop link points to. Since 7 October 2026 the site’s code writes the record of a stop request made through that link to our Cloudflare D1 database, which runs in Cloudflare’s Western Europe region. Our sending software reads those records from this website before each sending run	Global edge network; the contracting entity is Cloudflare, Inc., United States
GitHub	Holds the code repository of our sending software and its scheduled jobs: jobs that collect the public regulatory records, and a digest job that renders the digest described in the Resend row. All of those jobs have been switched off since 8 October 2026, so GitHub runs none of them, and GitHub lists no run of the digest job. Until 8 October 2026 the collecting jobs ran on GitHub, and GitHub keeps each run’s output, a file of company names, device records and public record identifiers with no person in it, for 30 days. The digest job reads no database today, so the digest it renders there holds no reply; GitHub keeps that digest as a file for 30 days and, because the job prints it, in the job’s log for as long as the repository keeps logs, 90 days under its setting on 24 September 2026. We will change this row before that job reads a database. One named person’s work address and one general inbox, both at one of the two Danish companies we set aside, were written on 8 October 2026 into files in that repository; on 10 October 2026 we removed them from its current files and from its history, and GitHub still holds the earlier versions, outside that history, until it deletes them, as “Where we keep it” says	GitHub, Inc., United States
Anthropic	Our director uses its AI assistant, Claude, in this work. On 8 October 2026 it read the public pages and registers these details came from and wrote the details into our contact list, and on 10 October 2026 it read some of them again, so Anthropic received them. The records of those sessions are kept on our director’s computer, as “Where we keep it” says	Anthropic, PBC, a US company; which of Anthropic’s terms applied to that use, and where it processed it, are [unverified]
Resend	Delivers to our director, and no one else, a digest when we run it. It lists up to ten messages our reply-reading software read in the seven days up to the digest’s date, each cut to its first 60 words, with the date it was read and, for a reply to our outreach email, the company’s name, the recipient’s role group and the identifier of the highest-weighted public record we hold for the company. Messages the software classed as a request to stop, an out-of-office reply or a bounce are left out. The reply-reading software reads the outreach mailbox, every hour from a task registered on 10 October 2026	Plus Five Five, Inc. (“Resend”), a US company; its sending domain is in eu-west-1 (Ireland)

We do not sell or share your data with anyone else, and no one else uses it for their own purposes. The full list of our service providers, with the terms each one’s transfers rely on, is at /legal/sub-processors.

International transfers

Google, Cloudflare, GitHub, Anthropic and Resend are US companies, and Cloudflare operates a global network, so some of your data may be processed outside the United Kingdom. Where a transfer leaves the UK, it is made under the provider’s data-processing terms. Cloudflare, GitHub and Resend use the UK International Data Transfer Addendum to the EU standard contractual clauses, as their published terms state; for Google the mechanism is [unverified], for GitHub whether its data protection agreement covers the account we use is [unverified], and for Anthropic the mechanism that applied to our director’s use on 8 October 2026 is [unverified]. The sub-processors page gives the detail. You can ask us for a copy of the safeguards.

Your rights

You have the right to:

• object to our using your data for this purpose;
• access what we hold about you;
• have it corrected if it is wrong;
• have it erased;
• have our use of it restricted while a dispute is settled.

Your right to object is honoured on receipt and without question. You do not have to give a reason. Any of these has the same effect:

1. Click the stop link in any email we send. It opens a page on this website with one button, “Stop these emails”, and needs no login. Opening the page records nothing; pressing the button asks us to record your request, and the next page says whether it was recorded. The same link is in the email’s headers in the standard one-click unsubscribe form (RFC 8058), so a mail client that supports it can offer you an unsubscribe button that sends the request without opening the page. Our sending software reads the stop-link records from this website before each sending run and does not send to an address recorded there; if it cannot read them, it does not send.
2. Reply to the email and say so, in any words. A scheduled task, registered on 10 October 2026, runs our software to read replies to our emails every hour, but only while our director is logged on to the computer that runs it and that computer is awake, and our software reads them again just before each sending run, and once you have replied we send no further automated follow-up. The same holds if a colleague of yours replies in the thread and asks us to stop: we put their address on the suppression list and send you no further follow-up either. The software reads the outreach mailbox’s Inbox and Spam folders and covers every message that arrived since its last successful reading, going back at least 26 hours, so a reply that arrives while the computer is off is read at the next reading and a reply that Gmail files as spam is read as well. It reads a message in full only when the message is in a thread our software sent into, or comes from an address in the outreach database, or has the subject “unsubscribe”, which is the subject a mail client uses for the unsubscribe address in the headers of our emails. A message with that subject is recorded as a request to stop for the address it came from. Our software puts your address on the suppression list by itself when the reply is, for example, “unsubscribe”, “No thanks.” or “I object.”; it does not recognise every wording (“I object to this.” is one it does not), so a person reads every reply and adds the address by hand when the software has not.
3. Email joshua.sandhu@globalphoenix.co.uk.

For access, correction or erasure, email the same address. We aim to answer within five working days and will answer within one month. We do not charge. To answer an access request we look your address up in our contact records, export the record and the message history, and send them to the work address we hold, so we know we are sending them to you.

We do not make any automated decision about you, and we do not profile you.

Complaints

If you think we have handled your data wrongly, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

Changes

If this notice changes, the new version appears here with a new version line and date. Our sending software checks, before each sending run, that this notice and the legitimate interests assessment are published and live, and does not send otherwise.

On 10 October 2026 this notice changed from version outreach-privacy-2026-10-08. “Where things stand” now gives the contact details we collected on 8 October 2026. “What we hold about you” lists what our software stores, and no longer lists checks on your address that it does not make. “Where it comes from” names both FDA lists, the 510(k) summaries the FDA publishes and the official company registers we read, and says how the details were collected. The Danish exclusion is added. “How long we keep it” defines activity as our software records it and says how long the files of 8 October 2026 are kept. “Where we keep it” says where the details and their copies are today and from 12 October 2026. The GitHub row says that its scheduled jobs are switched off and what the code repository holds, and Anthropic is added to the recipients. The stop link is described as it works: a page with one button, and the one-click form in the email’s headers. The reading of replies is dated to 12 October 2026 and to the hours our director is logged on.

On 11 October 2026 this notice changed from version outreach-privacy-2026-10-10. “Where we keep it” now says that the outreach database exists: our director created it on 10 October 2026 by running the setup, with 22 contacts and 7 suppression rows for the two Danish companies, where the earlier version said it did not exist yet and would be created on 12 October 2026. The two scheduled tasks are described as registered on 10 October 2026, and the reading of replies is described as our software does it: the Inbox and Spam folders, every message since the last successful reading and at least the last 26 hours, in full only for a message in a thread we sent into, from an address in our outreach database, or with the subject “unsubscribe”, which is recorded as a request to stop for its sender.

On 12 October 2026 this notice changed from version outreach-privacy-2026-10-11. A new section, “Contacts our software collects by itself”, says that from 12 October 2026 our software also collects new contacts once a day, from the 510(k) summaries the FDA publishes for a company’s clearance decided in the last twelve months, which name a contact person with a work address. It says what it collects, that it looks only at companies on the two FDA lists, keeps at most one contact per company, never keeps a submission consultant (only an address on the company’s own domain), takes an address only when it appears in full in the PDF’s text, applies the checks listed under “Our lawful basis”, holds a Danish company back for a manual register check, treats a company as a body corporate when it has an active entry at Companies House (a United Kingdom company) or when the applicant’s name on the FDA’s record ends in a recognised legal form, with the web address of that entry or FDA record kept as the evidence, keeps no contact for any other company, writes a daily report that names no person, and where the software runs and that we change two sections of this notice before it moves. “Where things stand”, “Where it comes from” and “Where we keep it” refer to it. The collection of 8 October 2026 by the director with Claude is unchanged and still described as it was.

On 13 October 2026 this notice changed from version outreach-privacy-2026-10-12. “Why we use it” no longer says that our software sends only the first email: from 13 October 2026 it also sends the follow-ups, on days 5, 11 and 18 after the first, as replies in the same thread, at most three, the last saying that we stop there, and none after you reply, ask us to stop, or after a bounce or a hold. It says that the first email exists in a few fixed wordings and that our software chooses between them by counts of interested replies for each wording, which uses nothing about you beyond your role group and which of the wordings fits your employer’s device name. A new section, “Alerts to our director”, says that our software emails our director, at his own address, one short alert for each thread in which you reply, with the first 60 words of your reply, an alert when a colleague of yours asks in the thread to be left alone, and summaries of totals with no name or address. “Where things stand” is now dated 13 October 2026 and says that outreach email has been sent since 12 October 2026, where the version of 12 October said that none had, and the right to object says that a stop request from a colleague in the thread also stops the emails to you. “What we hold about you” and the Google row say so. The same version adds “A shared inbox from the company’s own website”: from 13 October 2026, when a 510(k) summary gives no contact our software can keep, it reads the company’s own website for a shared company inbox, never a person’s address, and uses the FDA’s device identifier database only to find the web domain; “Where it stops” says that the only website it reads is the company’s own.

On 14 October 2026 this notice changed from version outreach-privacy-2026-10-13. “Why we use it” now says that the follow-ups count against the 50 messages a day our software may send, where the earlier version said 25. “A shared inbox from the company’s own website” now says that, from 14 October 2026, the software looks at the company’s own website for a shared company inbox for every company on the two FDA lists whose newest clearance was decided in the last two years and for which we hold no contact, including a company whose 510(k) summary it does not read because the clearance is more than twelve months old or because the company has only one entry on the two lists, where the version of 13 October 2026 limited it to a company whose summary gave no contact the software could keep. It says that the software tries the websites of at most 60 companies a day, and that the twelve months applies to a named person read from a summary and not to a shared inbox, which does not go stale in that way; “What it cannot tell” says the same. Every other limit on the reading of websites is unchanged. The same version adds a source of companies to write to: from 14 October 2026 our software also reads the National Institutes of Health’s RePORTER database and the National Science Foundation’s Awards database, which list the small-business research awards (SBIR and STTR) made to companies in the United States, and keeps an award only if its title or abstract names artificial intelligence or machine learning (an index term in NIH’s record is not enough) with a medical product and a clinical setting, and does not describe drug discovery or development, a therapeutic, a vaccine, an antibody, gene or cell therapy, agriculture, veterinary or defence work. “Where it comes from” names the two databases and says what the software records from an award. “Contacts our software collects by itself” has a new paragraph: for a company known from an award that is on neither FDA list, the contact is either the NSF award’s principal investigator, whose business email address the NSF publishes, taken only on the company’s own web domain, or a shared inbox from the company’s own website, and a web address the software guessed from the company’s name is accepted only when a page shows the company’s name together with a phrase of the award’s title or the award’s number, and the software guesses only from the company’s distinctive name words run together or its whole name, never from the first word of a name alone; the software stores no investigator from NIH. “Where it stops” and the limit on evidence of a body corporate now cover these companies, for which the evidence is a legal-form suffix on the organisation’s name in the award record. “What we hold about you” lists the sentence from the award record. “Which wording of the first email you read” says that a company known from an award has three further wordings of the first email, which say only that the award record is what we know about the company and do not say that it has or plans a submission, and gives the footer of that email, which names the NIH and NSF records. “Our lawful basis” says that the people we write to may be at a company that holds such an award, and that a recipient in the United States has the same opt-out and the same suppression list. The same version also says that, when the FDA’s list of AI-enabled medical devices gives no country for a company, our software finds it from the FDA’s own records read through openFDA: the 510(k) record of the company’s clearance, the premarket approval record (a US state gives the United States), or the establishment registration record when every establishment under the company’s name gives the same country. It stores the country with the web address of the record it came from, and when the records disagree, or a record under the same company name shows Germany, Austria, Denmark, Switzerland or Liechtenstein beside another country, the country stays unknown and the company is excluded. “What we hold about you” and “Where it comes from” say so. “Where things stand” is now dated 14 October 2026.

On 23 October 2026 this notice changed from version outreach-privacy-2026-10-14. The wordings of the first email changed on that date. “Which wording of the first email you read” now says that the three wordings that apply to your employer differ only in the subject line and have the same body, and that every wording, including the three for a company known from an award, says that the first full pack is free for a small number of teams, in return for the team’s regulatory affairs lead reviewing the pack wording and completing the installation and operational qualification (IQ/OQ) record. Where the version of 14 October 2026 said that the wordings for a company known from an award said only that the award record is what we know about the company and what ProofPack does, they now also make that offer, and they still do not say or imply that the company has or plans a submission. It says that an email to a shared inbox carries one added line asking the reader to pass it to their regulatory lead if it is theirs, and that the totals the choice of wording uses count only emails sent with the wordings of 23 October 2026. Step two, the follow-up on day 5, also changed on that date: it links to the public sample pack and not to the demo, and states the same offer. The sources, what we hold about you, the limits on the emails our software sends each day, the number of follow-ups and their timing, the footer and the records are unchanged.