SafeTrace Privacy Notice
Version 0.1 (draft for legal review), 13 October 2026. Not yet in force.
This notice explains how [MEDICORE LEGAL ENTITY NAME] Limited, trading as Medicore (CRO [CRO NUMBER], [REGISTERED ADDRESS]) ("Medicore", "we"), which provides SafeTrace, uses personal data when we are the controller. That covers:
- people who hold a SafeTrace account;
- billing contacts;
- people who contact us or ask for a demo;
- visitors to our website.
Records inside a customer's SafeTrace organisation are different. Equipment, procedure and test records, and the names of the people who tested and released equipment, are controlled by the organisation that uses SafeTrace; we process them on its behalf under our Data Processing Agreement. If your employer, or a service provider that tests your equipment, uses SafeTrace and you have questions about those records, please contact that organisation first.
SafeTrace is not designed for patient information. We ask our customers not to enter it.
Contact: [PRIVACY EMAIL]. Data protection officer: [DPO NAME/CONTACT, or "We have not appointed a DPO because we are not required to; contact us at the address above"].
What we collect and why
| Data | Source | Purpose | Lawful basis (GDPR Art. 6) | Retention |
|---|---|---|---|---|
| Name, email, password hash, two-step sign-in enrolment, sign-in records | You, when you sign up or are invited | Create and secure your account; let you sign in | Contract (Art. 6(1)(b)), or legitimate interests of your organisation and of us in providing a secure service (Art. 6(1)(f)) | While the account exists, then up to 90 days |
| Organisation and billing memberships and roles | Your organisation's owners | Control what you can see and do | Contract / legitimate interests | While the membership exists, then per the customer's DPA |
| Security logs (actions, timestamps, IP-derived information) | Generated when you use the Service | Security, fraud prevention and investigating misuse | Legitimate interests (Art. 6(1)(f)) | [12 months, CONFIRM] |
| Billing contact and subscription status | You and Stripe | Take payment, issue invoices, keep tax records | Contract; legal obligation (Art. 6(1)(c)) for tax records | 6 years after the end of the financial year (Taxes Consolidation Act 1997) |
| Terms acceptance record (who accepted, which version, when) | Generated when you accept | Evidence of the agreement | Legitimate interests; legal claims | Life of the contract plus 6 years (Statute of Limitations 1957) |
| Support correspondence and demo requests | You | Help you, answer your enquiry and improve the Service | Legitimate interests | 2 years after the issue is closed; 12 months for enquiries unless you become a customer |
| Marketing emails (where you agree) | You | Product news | Consent (Art. 6(1)(a)), or soft opt-in for existing customers under S.I. 336/2011 reg. 13 | Until you unsubscribe |
Our website sets no cookies and uses no analytics. When you email us from the website, we receive what you send.
We do not sell personal data. We do not use personal data to train AI models.
Who we share data with
- Service providers acting for us: hosting, database, email, payments and error monitoring. They are listed in our Sub-processors list.
- Your organisation: its owners and quality managers can see your membership and activity in their organisation.
- Professional advisers, such as lawyers, accountants and insurers, under confidentiality.
- Authorities, where the law requires it, or to establish, exercise or defend legal claims.
- A buyer or successor, if our business is sold or reorganised, subject to equivalent protection.
International transfers
Our primary database is in the EU (Ireland). Some providers are based in, or give support from, the United States or other countries. In those cases we rely on:
- the EU-US Data Privacy Framework, where the provider is certified; or
- the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
Contact us for a copy of the relevant safeguards.
Your rights
You have the right to:
- access your personal data;
- correct it;
- erase it;
- restrict or object to its processing;
- data portability;
- withdraw consent at any time, where we rely on consent.
Records of tests you carried out or released for your organisation are part of that organisation's evidence and are kept as it decides; requests about them go to your organisation (see above).
To use a right, email [PRIVACY EMAIL]. We will respond within one month; this can be extended by two months for complex requests, and we will tell you if it is.
If you are unhappy, you can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, www.dataprotection.ie. In the UK you can complain to the Information Commissioner's Office. Or you can complain to the supervisory authority where you live or work. We would appreciate the chance to deal with your concern first.
Security
The main measures are listed in Annex 2 of our Data Processing Agreement. They include two-step sign-in, access control enforced in the database, encryption in transit, private file storage and an append-only audit trail. No system is perfectly secure; we will tell you and the Data Protection Commission about a breach where the law requires.
Cookies
See our Cookie Policy.
Changes
We will post updates here and change the version date. If a change materially affects how we use your data, we will tell account holders in advance.