Privacy Policy

1. Data Controller Information

This Privacy Policy explains how Pharmacad Services / Dr. Julian P. Keogh ("we", "us", "our") collects, processes, and protects your personal data when you use the Keoplan application and website.

2. Keoplan AI Processing & Zero-Retention Compliance Policy

Keoplan provides biomedical translation, manuscript pre-checking, and regulatory QRD compliance auditing. To protect sensitive pharmaceutical and clinical research data:

• Zero-Retention Policy: Document text uploaded to the QRD Workspace is transiently processed for real-time browser editing. Once you trigger "Finalize & Purge", temporary database segment records are **permanently, completely, and irreversibly deleted**.
• EU Server Infrastructure: AI inference processing runs on secure, EU-based serverless endpoints (Scaleway, Paris region). Your submitted texts are never cached by third parties, sold, or used to train public AI models.
• Cloud & Local Storage: Generated final outputs are stored either in your chosen EU Scaleway S3 bucket, your private corporate S3 compatible cloud, your authorized Google Drive folder, or stored locally on your network NAS.

3. Personal Data Collected & Purpose of Processing

We process personal data for the following essential purposes:

• User Account Management: Email address, name, and cryptographically hashed password for account access, wallet credit tracking, and transaction history.
• Payment Processing: Credit package orders are processed securely via Stripe. We do not store credit card numbers; Stripe acts as PCI-DSS certified payment processor.
• Contact & Enquiries: Name, email address, phone number, and message content submitted via contact forms to fulfill customer enquiries.
• Security & Abuse Prevention: IP addresses and user agents logged ephemerally for reCAPTCHA validation and rate-limiting.

4. Legal Bases under GDPR & UK GDPR

• Art. 6(1)(b) GDPR (Contract Performance): Processing user accounts, translation requests, and payments.
• Art. 6(1)(a) GDPR (Consent): Voluntary cookies and contact form submissions.
• Art. 6(1)(f) GDPR (Legitimate Interest): Ensuring web platform security, prevention of abuse, and technical stability.

5. Data Retention Period

Account data is retained for the active duration of your account. Transaction and invoice records are kept for statutory financial retention periods (up to 6 years). Transient translation job segments are purged immediately upon job completion or workspace finalization.

6. Data Subject Rights

Under UK GDPR and EU GDPR, you have the right to request access to, rectification of, or erasure of your personal data, as well as restriction of processing, data portability, and the right to object. To exercise these rights, email [email protected].