Privacy notice

What we collect

Partly settled

Account details you give us: name, work email, organisation, and billing identifiers held by our payment processor rather than by us.

Audit inputs: the URLs you ask us to check, and the publicly available pages retrieved from those URLs. An audit reads pages as an ordinary visitor would. It does not sign in, does not submit forms, and does not attempt access to anything behind authentication.

Report artefacts: the findings, the rule text and citation each finding was produced from, and the date of the run.

Open: Retention periods for audit inputs and report artefacts are not yet fixed. Pending counsel.

What we do not do

Settled

We do not modify your website. Findings are reported to you; remediation is yours to apply. There is no script, overlay, or agent that we install on your pages.

We do not sell personal information, and we do not share it with advertising networks.

Protected health information

Not yet in place

Our intended design holds authorization records and content hashes rather than patient images. The purpose is to be able to state that an asset may not be published because no live authorization exists for it, without our systems holding the image itself.

A Business Associate Agreement is required before we handle any protected health information. We do not have one in place. Until we do, do not send us patient images, patient records, or any other protected health information, and our products should not be used as a store for them.

Open: Whether the authorization-and-hash design keeps us outside Business Associate status is a question for counsel and is unresolved.

Cookies and analytics

Open

This site is statically rendered and loads no third-party origins.

Open: Product analytics for the signed-in application are not yet chosen. This section will be rewritten with the specific tooling, the lawful basis, and the opt-out before the application is generally available.

Subprocessors

Open

Open: A named subprocessor list with locations and purposes is required and is not written yet. Do not treat its absence as a statement that there are none.

Your rights, and how to exercise them

Open

Open: Access, correction, deletion, portability, and the request route and response window need drafting against the specific regimes that apply to us. Pending counsel.

Security

Open

Open: Encryption, access control, logging, and breach-notification commitments will be stated here once they are things we can evidence rather than things we intend.