Legal
How Qevatrix collects, uses, shares and protects personal data — for visitors to this website, for customers, and for the people whose records our customers manage in the platform.
Qevatrix provides quality, regulatory, clinical and evidence software for medical device manufacturers. For data you enter into a Qevatrix application, your company is the controller and Qevatrix is the processor acting on your documented instructions. For our own website, marketing and billing, Qevatrix is the controller.
Account details (name, work email, role), workspace content you create, billing details (company name, address, VAT identifier — card data is handled by our payment processor and never reaches our servers), support correspondence, and technical logs such as IP address, browser type and timestamps used for security and troubleshooting.
To provide and secure the service under our contract with you (Art. 6(1)(b)), to meet our own legal and accounting obligations (Art. 6(1)(c)), and for the legitimate interests of keeping the platform secure and improving it (Art. 6(1)(f)). Marketing emails are sent only with your consent (Art. 6(1)(a)) and every message carries a one-click unsubscribe.
Clinical applications may process health data. Direct identifiers are removed at import wherever the study design allows, and subjects are handled by code. Where identifiable data is necessary, your organisation relies on an Article 9 condition — normally explicit participant consent, scientific research, or the medical devices public-health condition — and must hold the corresponding ethics approval.
Workspace content is retained for the life of the subscription and then deleted 30 days after termination, with backups rolling off within a further 30 days. Regulated quality, vigilance and clinical records are retained for the period you configure in the retention register. Billing records are kept for 10 years to meet statutory accounting duties. Website enquiries are deleted 24 months after the last interaction.
Data is encrypted in transit (TLS 1.2+) and at rest. Every row is scoped to a single workspace with row-level security, privileged operations run through audited server functions, and every create, change, signature and export is written to an append-only audit trail. Automated security scans run nightly and findings are triaged in a documented register.
EU and UK workspaces are hosted in EU regions by default. Where a subprocessor operates outside the EEA, transfers rely on the 2021 EU Standard Contractual Clauses and the UK International Data Transfer Addendum, supported by a transfer impact assessment.
You may request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent at any time. We answer within one month. If we cannot erase a record because medical device law requires us to keep it, we will tell you which obligation applies. You may also complain to your supervisory authority.
Privacy questions, data subject requests and DPA copies: use the contact form and mark your message “Privacy”. Requests from our customers' study participants should go to the sponsoring organisation, which is the controller for that data.
ePrivacy
Strictly necessary cookies keep the service working and need no consent. Analytics cookies are only set after you opt in, and you can change your mind below.
| Cookie or storage key | Category | Purpose | Retention |
|---|---|---|---|
| Session and authentication | Strictly necessary | Keeps you signed in to your workspace and protects against request forgery. | Session, or until sign-out |
| qvx:cookie-consent | Strictly necessary | Stores your cookie choices so we do not ask again on every visit. | 12 months |
| qevatrix-theme | Strictly necessary | Remembers your light or dark theme preference. | 12 months |
| Google Analytics (_ga, _ga_*) | Analytics | Aggregated page and traffic measurement on the public website. Off until you opt in. | Up to 14 months |
Your cookie choice
You have not made a choice yet — analytics cookies are off.
Article 30(2)
A summary of the processing carried out on behalf of customers. The full register, the DPA and the transfer impact assessment are in the GDPR pack.
All applications
Name, work email, role, authentication events, IP address
Retention: Life of the subscription plus 6 years of audit trail
QualityOS, RegulatoryOS, DeviceOS
Author and approver identity, e-signature meaning, complaint contact details
Retention: Device lifetime plus the statutory retention period set by the customer
ClinicalOS
Health data (special category), subject code, outcome scores, dates generalised on import
Retention: Per protocol, minimum 10 years for EU MDR clinical evidence
StudyOS
Coded subject records, site personnel names and roles, monitoring findings
Retention: Per protocol and trial master file requirements
EvidenceOS
Coded, de-identified clinical outcomes and implant data
Retention: Per registry charter
Public website
Name, work email, company, message content
Retention: 24 months after last interaction, or until unsubscribe
All applications
Billing name, address, VAT identifier, invoice history (card data never touches Qevatrix)
Retention: 10 years (statutory accounting retention)
Managed cloud hosting and database
Application hosting, database, object storage and backups
EU (default) — region selected at onboarding — Within the EEA; SCCs where support is provided from outside the EEA
Payment processing
Subscription billing and invoicing
EU / United States — EU Standard Contractual Clauses and UK Addendum
Transactional email
Account, subscription and notification email delivery
EU / United States — EU Standard Contractual Clauses and UK Addendum
AI model providers (Qevatrix Intelligence)
Drafting and cross-referencing text submitted by the user
EU / United States — EU Standard Contractual Clauses; zero-retention processing and no training on customer data
Request the data processing agreement, ask about a subject request, or read the full GDPR control register.