Vitrio — Privacy Policy

Draft for internal review. This document is a reasonable starting point, not a substitute for review by a qualified legal professional before commercial use.

Revised for operational deployment: 15 October 2026 — pending privacy/legal approval

Service operator: Vitrio is a trading name of Vitrio Limited, registered in the United Kingdom under company number 17515286. Location: Sheffield, United Kingdom. Contact: ebujoeebujoe007@gmail.com.

1. What We Collect

Account data: name, email, phone number, job title, profile photo, and role, for every staff and supplier-portal user.
Operational data: inventory records, test consumption logs, procurement requests, supplier communications, and equipment maintenance records entered by your Company's staff.
Patient and clinical data are excluded: do not submit patient names, demographics, clinical results, prescriptions, specimen/order identifiers or clinical documents. Approved integrations accept minimal operational activity and aggregate stage counts. Removing identifiers does not automatically make an event anonymous; source linkage still requires assessment.
Audit & security data: login timestamps, IP addresses, and action logs, kept for security monitoring and compliance (see Security Center).
Public site data: if you request a demo, contact Support, subscribe to the newsletter, or apply for a role on the Careers pages, we store what you submit — name, email, phone number, message or cover-note content, and, for job applications, your uploaded resume file — so a real person on the team can follow up. This data is not linked to any Company/tenant account.

2. Multi-Tenant Data Isolation

Company operational records are scoped to their owning laboratory. Shared doctor and marketplace accounts can have relationships with several companies; access must be checked against the specific authorized relationship. Platform administrators have privileged access for administration.

3. How We Use Data

Data you enter is used solely to operate the Service for your Company: displaying dashboards, calculating stock levels and alerts, generating reports, and enabling communication between your staff and your suppliers. We do not sell or share your data with third parties for advertising purposes.

4. Third-Party Services

Depending on enabled features, processors may include the hosting/database and private file-storage providers, email delivery services, Stripe or Paystack for payment details, Google for sign-in, Google Workspace or Microsoft 365 for document exports, Slack and configured webhook recipients for notifications, and Anthropic or OpenAI for optional AI assistance. Listing a provider does not mean it is enabled. Administrators must review each enabled integration, its permitted data, retention, contractual safeguards and any international transfers before use. The operator must maintain an approved, deployment-specific processor register; this draft does not constitute that approval. Patient and clinical data must not be sent through the operational deployment.

5. Data Retention

Retention depends on the record category, customer contract and applicable law. Closing an account does not automatically erase stock movements, purchasing approvals, invoices or audit evidence. The operator must approve a category-specific retention schedule, including backups and file storage, before commercial release. A privacy-request outcome must explain any information retained and its basis.

6. Your Rights

Signed-in users can submit and track an authenticated privacy or account-closure request. Requests are reviewed by the platform administrator; submission is not immediate erasure or subscription cancellation. Requests affecting shared operational records are handled with the laboratory's data-governance responsibilities and applicable retention requirements. You can also contact support if you cannot access your account.

If you're not a Company user — you submitted a demo request, support message, newsletter signup, or job application — contact us via the Support page to request a copy or deletion of that data.

7. Security

Access is protected by role-based permissions, brute-force login lockout (both IP-based and account-based), and tenant-scoped queries throughout the application. See the in-app Security Center for current posture.

8. Contact

Privacy questions and requests can be directed to ebujoeebujoe007@gmail.com. Your laboratory administrator can help with records managed by your laboratory.