Privacy notice
Last updated: 1 November 2026
You choose what to add to your passport and who can see it. This notice explains how we collect, use, share and keep personal information when you use ImplantPassport.
Who is responsible for your information?
The data controller is [to insert legal company name], trading as ImplantPassport. Business/postal address: [to insert]. Privacy contact email: [to insert]. Data protection officer or representative contact, if applicable: [to insert].
Contact us by email, post or using the email on our Contact us page for a privacy question, request or complaint. You do not have to buy a plan, sign in or use a special form to exercise your rights.
Information we collect and where it comes from
- Account information: your name, date of birth, email, optional phone number and sign-in information.
- Passport and health information: implant type, manufacturer, model and serial numbers where known, implant dates, clinic details, device settings, other medical conditions and notes you choose to provide.
- Uploaded material: photos or PDFs of implant cards, extracted text and your corrections.
- Emergency contacts and family access: the name, relationship and contact details you provide, invitations, access choices and permissions.
- Order information: purchases, renewal status, payment references and delivery details if you order a physical card. Our payment provider processes payment-card details; they are not stored in your implant record.
- Service and security information: support correspondence, consent choices, record changes, access logs and technical details needed to operate and protect the service.
Most information comes from you or someone acting with your authority. If your clinic or authorised carer provides information, we record its source and make it available for you to check. Your clinic remains responsible for its own clinical records and processing.
We need basic identity and contact information to create an account. Model and serial numbers are optional. A postal address is needed only for card delivery. Without permission to process the health information you choose to save, we cannot provide the health-record functions of your passport.
Why we use information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and manage your account, provide your order, payment support and card delivery | Performance of our contract with you, or steps you request before entering it (UK GDPR Article 6(1)(b)) |
| Read, store and display your health information, including the sharing you choose | Your consent (Article 6(1)(a)) and explicit consent for health data (Article 9(2)(a)) |
| Operate secure systems, prevent misuse, maintain proportionate audit records and respond to ordinary service enquiries | Our legitimate interests in providing a reliable, secure service (Article 6(1)(f)), balanced against your rights; health information requires an additional applicable Article 9 condition |
| Keep information required for accounting, tax and other legal duties | Compliance with a legal obligation (Article 6(1)(c)) |
| Establish, exercise or defend legal claims where necessary | Our legitimate interests or a legal obligation, as applicable; Article 9(2)(f) where health information is necessary for a legal claim |
We request permission before sending a card for reading, explicit consent before saving health information, and a separate choice before enabling sharing. Agreeing to terms or signing in is not, by itself, explicit health-data consent. We do not require marketing consent to use the service.
We do not sell your health information or use it for advertising. Card reading helps transcribe information; it does not make a diagnosis or a decision about your treatment or MRI suitability. You can correct its output. We do not make solely automated decisions with legal or similarly significant effects about you.
Emergency contacts, family access and shared links
Before enabling sharing, check the information shown in its summary. An emergency summary can contain your name, implant components, documented device settings, clinic details and the emergency contact details you select. A family summary can also include your date of birth and additional notes. Do not add sensitive information you do not want included in the relevant shared view.
Anyone with an enabled sharing link, NFC card or a photograph of its QR code can open that summary without signing in. A named family invitation uses a separate verified account. Neither form of access allows the recipient to edit your record. Adding an emergency contact does not itself invite them or give them account access.
Tell your emergency contact that you are providing their details and show them this notice. We use those details for the emergency-contact purpose and the sharing you select, relying on our legitimate interests in helping you identify someone to contact, balanced against that person’s rights. They can contact us about their information.
You can stop sharing or revoke a link from your account or ask us for help. Revocation stops future access but cannot retrieve copies someone has already saved. Keep your codes and links private when you do not want others to use them.
Service providers and international processing
We use providers for hosting, account security, card reading, payments, email and physical-card fulfilment. They receive only the information needed for their role and are subject to appropriate agreements. A printing or delivery provider may receive the approved card artwork, recipient details and address; it does not need your full clinical record. Payment descriptions do not include your implant details or medical notes.
| Provider / purpose | Provider and processing location |
|---|---|
| Patient platform and record hosting | [to insert] |
| Account authentication and security | [to insert] |
| Card reading and upload processing | Uploads pass through Bluehost in the USA to the card reader hosted by Render in Frankfurt, Germany. |
| Payments | [to insert] |
| Email and customer support | [to insert] |
| Card printing and delivery | [to insert] |
International transfers and applicable safeguards: [to insert countries, relevant UK adequacy decisions or transfer safeguards, and how to obtain a copy]. Where a provider processes data outside the UK, we use the protection required by UK data-protection law. We may also disclose information when required by law or where necessary for legal claims, using an applicable lawful basis and condition for health information.
Card reading and temporary drafts
Upload your own card, or a card you have permission to use. Files are sent only after you agree to card processing. The website gateway uses temporary upload files and removes them after forwarding. The reader processes uploads in memory and keeps completed results for up to ten minutes. Reading jobs and results are lost if the service restarts. Provider infrastructure and security logs may record connection metadata.
Your editable draft is held in this browser tab for up to 30 minutes. Reading a card does not itself create an account or a permanent passport record. A necessary secure session cookie ties the reading job to your browser. Check every extracted field against your original card.
How long we keep information
We retain information only for the purpose for which it is needed, taking account of your account status, consent, legal duties, security needs and any live dispute. We do not keep an archived account indefinitely simply because it has been archived.
| Information | Retention period or criteria |
|---|---|
| Account and passport records | While needed to provide your active account and the functions you choose; after closure, deletion or anonymisation timetable: [to insert]. Any necessary legal retention is explained separately. |
| Uploaded cards and OCR results | Processing and source-checking retention: [to insert]. Retaining an original for ongoing record support must be explained before upload. |
| Payments and order records | For applicable accounting, tax and claims requirements: [to insert period and basis]. Health information is not retained solely because a payment record is required. |
| Support, consent and audit records | For resolving requests, demonstrating choices and proportionate security/accountability needs: [to insert periods]. |
| Backups and security logs | [to insert deletion cycle and log-retention period]. Backups awaiting scheduled deletion are restricted and are not used to reactivate a closed account. |
Your rights and withdrawing consent
Depending on the circumstances, you can ask to access or obtain a copy of your information, correct it, erase it, restrict its use, receive portable data or object to processing based on legitimate interests. These rights do not depend on buying an annual service.
You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing before it. We stop the consent-based processing, including relevant sharing, and explain which functions can no longer operate and whether any information must be retained under a separate lawful basis. We do not switch lawful basis simply to continue the same consent-based use.
Closing or archiving an account, cancelling renewal, stopping sharing and asking for erasure are different actions. Tell us which you want; we help you complete the relevant steps. Withdrawing consent does not automatically cancel billing, so request cancellation too if that is what you want.
We normally respond to rights requests within one month. Where the law permits additional time, we explain the reason and revised timescale. We may ask for proportionate evidence of identity. Requests are normally free; any lawful exception or limitation will be explained.
If you are unhappy with our response, you can complain to the Information Commissioner’s Office (ICO). You can contact the ICO without first complaining to us.
Cookies, browser storage and security
Essential cookies and browser storage support sign-in, security, temporary form drafts and the choices you make. Storage details, providers and expiry periods: [to insert]. Optional Google Analytics runs on our public information pages only after you select Accept analytics. Refusing analytics does not prevent you from using the website or passport.
With your consent, Google Analytics measures public page views and selected clicks, such as Create my ID card, pricing and contact links. It uses pseudonymous identifiers and technical information about your browser, device and visit. It does not receive form entries, card uploads, implant details, account records or the destination details of contact links. Tracking is excluded from enrolment, account, passport, payment and shared-record pages. Page URL query strings and fragments are removed; recognised search and AI referrals are reduced to their website origin.
The optional _ga and _ga_* analytics cookies expire after 90 days. We store your choice in ip-analytics-choice-v1 in this browser for 90 days. You can withdraw consent using Analytics settings in the footer of any public information page, then select Reject analytics. This stops future collection and removes our analytics cookies from that browser. Event-level retention in Google Analytics is two months; aggregated reports may remain longer. Analytics is not used for advertising, Google signals or user-provided data collection.
Google processes analytics data and may process it outside the UK, including in the USA. See Google’s privacy policy and Google’s data processing terms for information about processing and transfer safeguards. Our lawful basis for optional analytics is your consent. You can contact us through our Contact us page about your privacy choices.
We use access controls and security measures appropriate to the information being processed. Keep your sign-in details private, use a secure device and sign out on shared devices. No online service can guarantee that every risk is eliminated. If a personal-data breach creates a high risk to your rights, we notify you as required by law.
Updates to this notice
We keep this notice current and show its update date above. We tell you about material changes affecting how we use your information and request fresh consent where required before a new consent-based use begins.