Who controls your data
The data controller for the personal data described here is Spwig Pte. Ltd. (UEN 202609858E), 3 South Buona Vista Road, #B1-08 Viva Vista, Singapore 118136. For data-protection questions, write to [email protected].
What we collect
When you fill in the download form we collect: your name, your email address, your institution or organisation, your optional free-text use-case description, your acknowledgement of the research-use-only notice, your optional consent to receive release updates, and the date and time you submitted the form. When you visit the website our hosting provider records standard server access logs (IP address, user agent, referer, request path, response status, timestamp). We do not use third-party analytics, advertising trackers, or session-recording tools.
Browser storage (no cookies)
We do not use cookies. The download page stores a copy of your signup details in your browser's localStorage so you don't have to re-fill the form on a return visit; this stays on your device and is not transmitted back to us. You can clear it any time from your browser settings.
Why we use it
We use your data to: (1) email you the download link you asked for; (2) if you opted in, send you occasional release notes and research-relevant updates; (3) keep a record of who acknowledged the Research Use Only notice and the version of the notice they accepted, in case of audit or compliance review; (4) understand, in aggregate, who is using the software (e.g. the rough mix of academic vs non-academic institutions) to inform our research and roadmap. We do not sell your data or use it for advertising.
Legal basis (GDPR)
For EU and UK users, our legal bases under the GDPR are: consent for marketing emails (you tick the box on the download form, you can withdraw any time); contract or pre-contract steps for sending the download link you requested; and legitimate interest for record-keeping of the research-use-only acknowledgement and for security log retention.
Third parties
We use a small number of third parties to actually deliver the service: Microsoft Corporation (Microsoft 365 / Office 365) for transactional and marketing email — emails are sent from our [email protected] mailbox through the Microsoft 365 SMTP infrastructure, with replies routed to [email protected]; GitHub, Inc. (a subsidiary of Microsoft) for the actual binary downloads — a separate privacy policy applies once you click a download button; and our hosting provider for the website itself. We don't share your data with anyone else, and we don't sell it. If you've explicitly granted us permission to communicate with someone on your behalf (e.g. by replying to a release email asking for a feature on behalf of your lab), we may rely on that to do so.
International transfers
Spwig is based in Singapore. Email sent through Microsoft 365 may be processed in the European Union, the United States, and other regions in line with Microsoft's published Online Services Data Protection Addendum and Standard Contractual Clauses. GitHub processes downloads through its global content-delivery infrastructure. Our hosting provider may store and process data in jurisdictions outside Singapore. Where we transfer EU or UK personal data outside those regions, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum) or another transfer mechanism permitted by the GDPR.
How long we keep it
Signup records (your name, email, institution, use-case description, RUO acknowledgement, marketing consent state, and submission timestamp) are kept for the duration of your engagement plus two years after your last interaction, then deleted. If you unsubscribe from release updates we keep an unsubscribe record so we don't accidentally email you again. Server access logs are retained for up to 90 days for security and debugging purposes, then deleted or anonymised.
Your rights
Under the Singapore Personal Data Protection Act and the EU/UK General Data Protection Regulation (where it applies), you have rights to access the data we hold about you, ask us to correct it, ask us to delete it, ask us to export it in a portable format, object to certain processing, and withdraw any consent you gave us. To exercise any of these rights, email [email protected]. We'll respond within thirty days. You also have the right to lodge a complaint with your local data-protection authority (in Singapore, that's the Personal Data Protection Commission).
How we protect it
We use HTTPS for all traffic to the website, restrict access to signup data to a small number of authorised staff, and review our security practices periodically. No system is perfectly secure; if we ever experience a personal-data breach that's likely to result in a high risk to your rights and freedoms, we'll notify you and the relevant supervisory authority as required by law.
Children's data
Spwig Medical Viewer is a tool for researchers and is not directed at children. We don't knowingly collect personal data from anyone under the age of 16. If you believe we have, email [email protected] and we'll delete it.
Changes to this policy
We may update this Privacy Policy occasionally. We'll change the "Effective" date at the top of this page when we do. If we make material changes that affect how we handle data we already hold, we'll email registered users who opted in to release updates, and we'll show a notice on the download page.
Contact
Questions about this Privacy Policy, or about data we hold about you? Email [email protected].