Privacy notice (draft)

Last updated: [DATE]. [COMPANY LEGAL NAME] (“we”), of [REGISTERED ADDRESS], uses this notice to describe how it handles personal information gathered on this website and in the course of an Audit Defense Pack engagement.

1. Information this website collects

• Your fit check answers: role, company size, ISO 13485 status, FDA registration status, device class, the type and timing of your next inspection or audit, the tools you use, which records you could export, whether those records hold restricted data, and whether the budget fits.
• The contact details you type in: your name and email, plus company, phone and a note if you choose to give them.
• Technical information: our server holds your IP address in memory for a short time to limit abuse, and does not save it alongside your answers. Standard access logs on our web server may be kept for [RETENTION PERIOD].
• Campaign tags: when the link that brought you here carried utm_ tags, we save those tags with your answers.

The site runs no analytics, no advertising trackers and no cookies. Your fit check answers stay in your browser's session storage until the tab is closed. Fonts come from Google Fonts, so Google receives your IP address as each page loads. [OWNER: hosting the fonts on our own server would end this.]

2. How we use it

• To answer you and, at your request, to set up a call or an engagement. [LAWFUL BASIS, for example pre-contract steps you asked for, or legitimate interests.]
• To email occasional updates, and only if you ticked the box asking for them. Unsubscribing is possible at any point.

3. Customer records in an engagement

The Audit Defense Pack Services Agreement governs the quality records you upload, and our data and security page describes how they are handled. They are processed on an encrypted workstation and by Anthropic (Claude) as subprocessor, which does not train its models on our clients' data. They are deleted 30 days after the pack is delivered unless you convert to a subscription, or sooner if you ask, with written confirmation. We do not accept export-controlled data, or personal data other than names, employee IDs and roles.

Patient information. Do not upload patient-identifiable information. Before sending complaint, adverse-event or medical device reporting records, take out or replace patient names, dates of birth, medical record numbers, addresses, contact details and anything else that could identify a patient. The service is not built as a HIPAA-covered system and is not meant to receive protected health information. Should patient-identifiable information reach us regardless, we halt, leave it unprocessed, delete it, and confirm the deletion in writing. [OWNER/LAWYER: confirm this wording and whether any customer needs a business associate or data processing agreement.]

4. Who receives it

• Anthropic, PBC, which performs the AI-assisted analysis of engagement records.
• [ACCOUNTING OR INVOICING TOOL], which issues our invoices. We take payment by invoice only, never through this website.
• [SCHEDULING TOOL], when you book a call.
• [EMAIL PROVIDER], which carries our email in and out.
• [HOSTING PROVIDER], which hosts this website and the server that takes in fit check answers.

We never sell personal information.

5. Retention

Fit check answers and contact details: [RETENTION PERIOD, for example 24 months after the last contact]. Engagement records: as set out in section 3. Accounting records: for as long as the law requires.

6. Your rights

[The rights that apply where you are, for example access, correction, deletion and objection, and how to complain to a regulator.] Email us to use any of them.

7. Changes

Any change will appear on this page with a new date.