Privacy Policy
Last updated: 5 October 2026
Tritos Medical Ltd (“Tritos Medical”, “we”, “us” or “our”) respects your privacy. This policy explains what personal information we collect when you visit our website or get in touch with us, why we collect it, how we look after it, and the rights you have.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and, where it applies, the EU General Data Protection Regulation (EU GDPR).
1. Who we are
Tritos Medical Ltd is the controller of the personal data described in this policy. You can contact us about privacy matters at:
- Email: privacy@tritosmedical.com (please mark your message “Data Protection”)
- Post: Data Protection, Tritos Medical Ltd, 33 Waringstown Road, Lurgan, Craigavon, BT66 7HH, United Kingdom
2. What this policy covers
This policy covers personal data we collect through www.tritosmedical.com, through enquiries you send us, and in the course of our business relationships with customers, prospective customers and suppliers.
It does not cover data processed within our products on behalf of our customers. When organisations use our products, those organisations decide how and why personal data in those products is used, and they are the controller of it. We generally act as their processor and handle that data only on their documented instructions, under a written data processing agreement. If you are a patient or a member of staff whose information is held in one of our products, please see the privacy notice of the organisation that provides your care or employs you, and contact them to exercise your rights.
3. The personal data we collect
Information you give us
- Contact form and email enquiries: the details you choose to provide, such as your name, email address, organisation, job title, phone number and the content of your message.
- Business relationships: contact details of people at our customers, prospective customers, partners and suppliers, plus records of our correspondence, meetings and contracts.
Information collected automatically when you visit our website
- Technical data: your IP address, browser type and version, device and operating system, the pages you request, the referring page, and the date and time of your visit. This data is recorded by our hosting provider and by the third-party services described in section 6, mainly so that the website can be delivered and protected from abuse.
We do not use analytics, advertising or tracking cookies on our website, and we do not build profiles of website visitors.
We do not ask for special category data, such as health information, through our website. Please do not include health or patient information in an enquiry.
4. How we use your data and our lawful basis
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Responding to your enquiry or request | Contact and enquiry details | Legitimate interests (responding to people who contact us) or, where you are enquiring about our products, taking steps at your request before entering into a contract |
| Providing our products and services and managing our customer relationships | Business contact details, correspondence, contract records | Performance of a contract, and legitimate interests (running our business) |
| Sending you product news or updates you have asked for | Name and email address | Consent, or our legitimate interests where the law allows us to contact existing business contacts. You can opt out at any time |
| Operating, securing and maintaining our website | Technical data | Legitimate interests (keeping our website available, secure and working properly) |
| Meeting our legal and regulatory obligations, and establishing or defending legal claims | Any of the above, as relevant | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we have considered and balanced our interests against your rights and freedoms. You can ask us for more information about this balancing assessment.
We do not sell your personal data. We do not make decisions about you based solely on automated processing.
5. Cookies and similar technologies
Our website does not currently set analytics or advertising cookies. Our own pages use only what is needed for the site to work:
- cc_cookie: remembers the choices you make in our cookie banner. It expires after 6 months.
- Browser storage that keeps page navigation smooth.
If we introduce optional cookies, such as analytics, we will only set them if you accept them in our cookie banner. You can change your choice at any time using the “Cookie settings” link at the bottom of every page.
Some pages include content from third parties, and those services may store or read information on your device:
- Contact form: our contact form is provided by Tally. Tally may use storage that is strictly necessary for the form to work and to protect against spam.
- Embedded video: our ParaNote page includes a video from YouTube in its “privacy-enhanced mode”. YouTube (Google) receives technical data such as your IP address when the video player loads. It may store information on your device, particularly once you play the video.
You can block or delete cookies and other site data in your browser settings. If you do, some embedded content, such as the contact form or video, may not work.
6. Who we share your data with
We share personal data only where necessary, with service providers who process it on our behalf under contracts that require them to protect it and to use it only as we instruct. These include:
- Website hosting and content delivery: Cloudflare, Inc., which hosts our website and protects it against attacks.
- Online forms: Tally BV (Belgium), which provides our contact form.
- Web fonts: Google LLC (Google Fonts). Your browser downloads typefaces from Google’s servers when you visit, which means Google receives your IP address and browser details.
- Embedded video: Google LLC (YouTube), as described in section 5.
- Email, IT and business systems: providers of our email, document storage and business software.
- Professional advisers: for example lawyers, accountants and auditors, where needed.
We may also disclose personal data where the law requires it, to protect our rights or the safety of others, or to a buyer or successor if our business is reorganised or sold.
Google and YouTube act as independent controllers for some of the data they receive. Their use of it is governed by the Google Privacy Policy.
7. International transfers
Some of our service providers, or their sub-processors, are located in or access data from outside the UK and the European Economic Area, including the United States. Where we transfer personal data to such a country, we make sure it is protected by an appropriate safeguard. Examples include UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement or Addendum, or the European Commission’s Standard Contractual Clauses. You can contact us for more information about the safeguards we use.
8. How long we keep your data
We keep personal data only as long as we need it for the purposes described above:
- Enquiries: up to 2 years after our last correspondence, unless the enquiry leads to an ongoing business relationship.
- Customer, supplier and contract records: for the length of the relationship and then for 6 years after it ends, so that we can meet our legal, tax and accounting obligations and deal with any claims.
- Website technical data: for a short period, in line with our hosting provider’s standard log retention, unless we need it longer to investigate a security incident.
- Marketing preferences: until you unsubscribe. After that, we keep a record of your opt-out so that we do not contact you again.
When we no longer need personal data, we securely delete or anonymise it.
9. How we protect your data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include access controls, encryption in transit, and staff training. They are governed by our Information Security Management System.
10. Your rights
Subject to certain conditions and exceptions, you have the right to:
- access the personal data we hold about you
- rectification of inaccurate or incomplete data
- erasure of your data
- restrict how we use your data
- object to processing based on our legitimate interests, and to object at any time to direct marketing
- data portability, which means receiving data you gave us in a portable format or having it transferred to another organisation
- withdraw your consent at any time, where we rely on consent. This does not affect processing that took place before you withdrew it
To exercise any of these rights, contact us using the details in section 1. We will respond within one month. We may need to confirm your identity before we act on your request. There is normally no charge.
If your request concerns data held in ParaNote or Rapid Rota, please contact the organisation that uses the product (see section 2). We will help them respond to you.
11. Complaints
If you have concerns about how we use your personal data, please contact us first and we will do our best to resolve them.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
If you live in the European Economic Area, you may also complain to the data protection authority in your country.
12. Children
Our website and services are intended for healthcare organisations and professionals. They are not directed at children, and we do not knowingly collect personal data from children through our website.
13. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page, with the date it was last updated shown at the top. If we make significant changes, we will take reasonable steps to let you know.