Website privacy notice Version 1.0 — Policy date 29 October 2026 Privacy at a glance You can browse this site without an account. The site code sets no cookies or analytics trackers. Technical server logs may be used to deliver and protect the website. If you email us, IDCP uses the information to answer your enquiry or manage the relevant service. For patient-assessment and app-licensing information, read the app privacy notice. The sections below explain what we use, why, how long we keep it and how to exercise your rights. Who is responsible? IDCP Scotland Limited, registered in Scotland (SC666120), 77 Torrisdale Street, Glasgow, Scotland, G42 8PW. Contact [mailto:Support@idcpscotland.co.uk] Support@idcpscotland.co.uk. IDCP Scotland Limited is the controller for website enquiries and its own Peekaboo administration. This notice covers website visits and those activities. Information comes from you, your organisation’s authorised contact or the technical request made by your browser. If an administrator supplies your details, we use them only for the stated administration, support and safety purposes. Separate consultancy, research and Dino-Lite project delivery is outside its scope. Read the Peekaboo Vision privacy notice for app-specific information. Information we use When you contact us, we receive the name, email address, organisation details, message and attachments you provide. We use them to respond to enquiries, administer licences and support, and deal with complaints or privacy requests. Please do not send patient records or unnecessary sensitive information. Our website is hosted on an IDCP-operated server in the Netherlands. Delivering and securing the site may involve processing IP addresses, requested pages, timestamps, browser information and technical error or security records. The website has no contact form, customer account, newsletter or patient-upload facility. Enquiries use email links. Why we use information We rely on legitimate interests for necessary business-contact handling, routine support and website security: responding to enquiries, administering organisational access and protecting the service. Where you personally enter a contract with us, or request steps before doing so, contract may be the appropriate basis. A contract with an organisation does not automatically provide the contractual basis for every employee’s information. Legal obligation applies where we must keep or report information under applicable law, including relevant product-safety duties. We use information only where necessary for these purposes. We do not use this website for advertising profiling or sell personal information. Service providers and international processing Microsoft 365 provides our support mailbox and SharePoint organisation-licence records. Within IDCP, access is restricted to the Managing Director and CEO according to their duties. Microsoft and its relevant subprocessors process information to provide, maintain and secure those services, under applicable service and data-protection terms. We require providers processing personal information on our behalf to apply appropriate contractual confidentiality, security and data-protection safeguards consistent with this notice and applicable requirements. Our Microsoft 365 setup is selected for UK/European use; actual storage and processing locations depend on the tenant, service configuration and Microsoft’s contractual commitments. We do not promise that every processing activity remains in the UK or Europe. Where a restricted international transfer takes place, the applicable basis must be a UK adequacy regulation, an appropriate safeguard such as approved contractual clauses, or another lawful permitted route. Where a restricted transfer to a recipient in the Netherlands or another EEA country occurs, UK adequacy regulations currently provide a permitted route. Transfers to other countries require their own applicable assessment and lawful route. You may ask us for the relevant safeguard information or a copy, subject to necessary redaction of confidential information. See [https://www.microsoft.com/en-us/trust-center/privacy/data-location] Microsoft data-location information. Unexpected sensitive information Routine enquiries and licensing do not require patient records. If sensitive information is sent accidentally, we restrict access, notify the sender without repeating patient identifiers and ask for a redacted resubmission. We arrange secure removal or minimisation of unnecessary details unless a documented legal obligation requires retention. We still assess the necessary facts of a product complaint or safety concern and meet applicable reporting duties. If identifiable health information is necessary for a safety investigation, we will explain the purpose, applicable lawful basis and additional protection before requesting it through an appropriate secure route. This website provides no patient-upload facility. Retention The following periods apply to IDCP’s records. They do not describe a patient-record database in the app. - General enquiries: 12 months after closure. - Routine technical support: 24 months after closure. - Organisation licences and associated commercial records: the active term plus six years after expiry or termination. - Routine website access logs: 30 days from creation. - Website security-incident records: 90 days after closure, unless an investigation or legal hold justifies longer retention. - Product complaints, safety incidents and post-market surveillance (PMS): ten years after record closure and, if later, through the end of the applicable device-model PMS period, subject to any longer legal requirement. - Privacy requests: three years after closure, keeping only necessary request and outcome evidence. Necessary safety records follow the product-complaint schedule, even if first received as a support email. We review expired records quarterly for deletion or irreversible anonymisation. A documented investigation, dispute or legal hold may require longer retention; we review that need regularly. Backup copies, recycle bins, version history and service audit logs follow the relevant recovery and supplier retention arrangements. Deleting an active record does not necessarily remove every recovery copy immediately. We restrict access to retained copies and do not use them for unrelated purposes. Cookies and website storage This initial website does not use analytics, advertising pixels, embedded videos, external font services or optional browser-storage features. Cloudflare is not included in the selected deployment. The static website code does not set cookies. Hosting access and security logs are separate from browser cookies. Read our cookies and storage information for more detail. If we introduce cookies, tracking or another integration, we will update this information and obtain consent where required before using it. This notice describes the IDCP website; websites reached through external links have their own practices. Access and security Our Microsoft 365 mailbox and SharePoint licence records are available internally only to the Managing Director and CEO as required for their duties. We apply proportionate access and security controls. No method of transmission or storage can be guaranteed completely secure. Contact the support mailbox if you believe information has been exposed or used incorrectly. Your rights and privacy requests Depending on the processing and applicable conditions, you can request access, correction, deletion, restriction or portability of your personal data. Where consent is used, you can withdraw it without affecting earlier lawful processing. Contact us to exercise your rights; we may need proportionate identity checks. You may complain to the [https://ico.org.uk/make-a-complaint/] Information Commissioner’s Office. Contacting IDCP first does not remove that right. Your right to object: you can object to our use of your personal information based on legitimate interests. Contact the support mailbox and explain your circumstances. We will consider your objection under the applicable data-protection rules. For access and other individual-rights requests, we respond without undue delay and normally within one month, subject to the applicable legal rules. If a lawful extension or clarification is needed, we explain it and the applicable timetable. Exercising a right does not require you to use a particular email subject or form. To complain about our handling of personal information, email [mailto:Support@idcpscotland.co.uk?subject=Privacy%20complaint] Support@idcpscotland.co.uk or write to our registered office. Describe the concern and how you would like us to contact you; do not include unnecessary patient information. We acknowledge data-protection complaints within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. Jamie Thomson coordinates handling; you may request escalation to Jan Boers through the same contact. This does not restrict your right to contact the ICO. Use [mailto:Support@idcpscotland.co.uk] Support@idcpscotland.co.uk for privacy requests. We may ask for information reasonably needed to identify the records and confirm your identity. Providing information necessary to answer an enquiry or arrange a licence is optional, but without it we may be unable to fulfil that request. Changes to this notice We will identify the effective date when this notice is issued and update it when our processing changes. Material changes will receive any notification required by law.