Privacy Policy

1. Scope and roles

This Policy applies to Portal users, customer administrators, and people who contact us about the Portal. When an organisation provides data about its users, that organisation may be the controller of that business data. Its own privacy notice and agreement with Healiot also apply.

2. Data we process

Depending on your role and use of the Portal, we process:

• identity and contact data, such as work email address and optional display name;
• tenant membership and access data, including your assigned customer organisation and active status;
• authentication and security data, including sign-in verification records, session cookies, access timestamps, and security-related logs;
• license and machine data supplied through Keygen, such as license identifiers, product details, machine identifiers, activation status, and associated metadata; and
• audit activity produced by Portal actions, such as license, machine, and access-management events.

3. Sources and purposes

We receive data directly from you when you sign in or contact us; from the customer administrator that provisions your access; and from Keygen for license and machine records. We use data to authenticate approved users, show tenant-scoped information, operate and secure the Portal, provide support, enforce agreements, and comply with law.

Where applicable law requires a legal basis, we process data to perform our contract, pursue legitimate interests in operating a secure enterprise service, comply with legal obligations, or with consent where consent is required.

4. Service providers and disclosures

We disclose data only as needed to operate the Portal, including to Keygen for license-management data, to hosting and database infrastructure providers, and to Resend for production sign-in email delivery. We may also disclose data where required by law, to protect rights or safety, or in connection with a corporate transaction, subject to applicable law.

We do not sell personal data or use Portal data for cross-context behavioral advertising.

5. Retention

We retain data while the relevant customer relationship and tenant access are active, then for the period reasonably necessary to meet contractual, security, dispute-resolution, backup, and legal requirements. Authentication records and session data are retained only for their configured validity period or as needed for security. A customer may request deletion or return of its data through the contact details below, subject to the applicable agreement and law.

6. Security and international transfers

We use access controls, tenant-scoped authorization, authenticated sessions, HTTPS in transit, and operational safeguards designed to protect Portal data. No system can be guaranteed completely secure. Service providers and customers may operate in different countries; where data is transferred internationally, we use safeguards required by applicable law.

7. Your rights and cookies

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability, or objection to certain processing. If your employer or customer organisation controls the relevant data, please contact that organisation first. The Portal uses essential cookies and similar session technology to authenticate users and maintain secure sessions. Blocking essential cookies may prevent the Portal from functioning correctly.

8. Children, changes, and contact

The Portal is intended for authorised business users and is not directed to children. We may update this Policy to reflect changes in our service or legal obligations and will revise the “Last updated” date. For privacy requests or questions, contact info@healiot.com. You may also have the right to complain to the data-protection authority relevant to you.