Panopteia operates inside healthcare, emergency services, and public-access workflows. Privacy is not a compliance checkbox — it is a prerequisite for the trust that makes our work possible. This policy explains what we collect, why, and what you can do about it.
We collect different categories of information depending on whether you are visiting our public website, using a Panopteia-operated platform under an institutional agreement, or interacting with a product like Panopteia Life directly.
We do not sell personal data. We do not use personal data to train machine-learning models without explicit, time-bounded institutional consent. These are constraints, not aspirations — they are reflected in our Data Processing Agreements and Trust & Governance Council charter.
We use the information we hold for the following purposes:
We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals outside of an institutional agreement that explicitly authorizes such use and provides for human review.
We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law.
When a retention period expires, data is deleted or irreversibly anonymized on a rolling basis. Deletion timelines are reported in the quarterly Trust & Continuity Report.
We apply layered technical and organizational controls to protect personal data, including encryption at rest and in transit, tiered access controls, continuous audit logging, and independent security review. Our security posture is described in our Trust Framework.
No system is immune to breach. If a security incident affects your personal data, we will notify you in accordance with our 72-hour disclosure policy and applicable breach notification law.
Depending on where you are located, you may have some or all of the following rights. We apply the most protective standard available regardless of your jurisdiction — you do not need to know which law applies to invoke these rights.
To exercise any of these rights, use the contact form. We will respond within 30 days. There is no charge for a first request in any 12-month period.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.
If you are located in a jurisdiction with data transfer restrictions, we take appropriate steps to ensure that any transfer of your personal data is subject to suitable safeguards consistent with applicable law.
Details of applicable transfer mechanisms are available on request via the contact form.
Our public website and most platform services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16 without verified parental or guardian consent. If you believe we have inadvertently collected such data, contact us via the contact form and we will delete it promptly.
Deployments in healthcare, education, or public-service contexts may involve processing data about minors under institutional direction; those deployments are governed by a separate DPA that addresses applicable child-data requirements.
We will post material changes to this policy at least 30 days before they take effect, with a notice on this page and an entry in our public incident log. Non-material clarifications take effect immediately. The effective date at the top of this page is always current.
Continuing to use our services after the effective date of a change constitutes acceptance of the revised policy.
Privacy inquiries, subject-access requests, and data-related complaints should be submitted via the contact form. We will respond within 30 days.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.