Privacy notice

Who we are

UndosaTech is a pre-launch research data reuse project operated from Dundee, Scotland. For data collected through this website and the UndosaTech platform (app.undosatech.com), UndosaTech is the data controller. Contact: dpo@undosatech.com.

Company registration and ICO (Information Commissioner's Office) registration details will be published here as the project completes its incorporation and registration steps.

This website (undosatech.com)

This website sets no cookies, runs no analytics, and uses no tracking. Our hosting provider (Netlify) processes standard server logs — IP address, user agent, pages requested — for security and operations. If you email us, we hold your email and its contents for as long as the correspondence is relevant.

The platform (app.undosatech.com)

If you register for a platform account, we process:

• Account data — name, institutional email address, institution, and authentication factors (including TOTP multi-factor enrolment where you enable it). Lawful basis: contract (Art. 6(1)(b) UK GDPR).
• Usage and audit records — actions taken on the platform (study creation, data access requests, query execution) are written to a tamper-evident audit log. This is core to the platform's governance function. Lawful basis: legitimate interests (Art. 6(1)(f)) in maintaining research governance and security.
• Operational logs and metrics — request metadata (endpoint, timing, status) retained for security monitoring and service operation. Lawful basis: legitimate interests.

Research data. The platform is designed so that patient-level research data remains within the contributing institution's own infrastructure. Where institutions contribute dataset metadata or run federated analyses, the contributing institution remains the data controller for that material and UndosaTech acts as processor under a data processing agreement. Aggregate outputs are protected by statistical disclosure control and differential privacy mechanisms.

Sub-processors

We use the following infrastructure providers: Netlify (this website), Vercel (platform frontend), Railway (platform API), and Supabase (authentication and platform database). A current list, including hosting regions and transfer safeguards, is available on request at dpo@undosatech.com and will be published on the Trust & Security page as certification work completes.

Retention

Account data is retained while your account is active and removed on verified deletion requests. Audit records are retained for the period required by research governance obligations, as they exist precisely to evidence what happened and when. Server logs are retained on providers' standard short rotation periods.

Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability, and objection. To exercise them, email dpo@undosatech.com. You also have the right to complain to the ICO (ico.org.uk).