Transparency about how we collect, use, and protect your data.
Last updated: May 15, 2026
This Privacy Notice for VirtuCath, LLC ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.
This summary provides key points from our Privacy Notice, but you can find out more details about any of these topics by using our table of contents below to find the section you are looking for.
What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use. Learn more about personal information you disclose to us.
Do we process any sensitive personal information? We do not process sensitive personal information.
Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, and other outside sources. Learn more about information collected from other sources.
How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent. We process your information only when we have a valid legal reason to do so. Learn more about how we process your information.
In what situations and with which types of parties do we share personal information? We may share information in specific situations and with specific categories of third parties. Learn more about when and with whom we share your personal information.
How do we keep your information safe? We have adequate organizational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your. Learn more about how we keep your information safe.
What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information. Learn more about your privacy rights.
How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request, or by contacting us. We will consider and act upon any request in accordance with applicable data protection laws.
Want to learn more about what we do with any information we collect? Review the Privacy Notice in full.
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.
Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:
Sensitive Information. We do not process sensitive information as that term is defined under applicable law (for example, special categories of personal data under GDPR Article 9, or "sensitive personal information" under the CCPA/CPRA). Please note, however, that for license enforcement we do collect persistent device and hardware identifiers (as described under Device Data below). These identifiers are personal data under the GDPR and a "unique identifier" under the CCPA/CPRA and are handled in accordance with this Policy.
Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is handled and stored by FastSpring. You may find their privacy notice link(s) here: https://fastspring.com/privacy/.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.
Like many businesses, we also collect information through cookies and similar technologies.
The information we collect includes:
In Short: We may enrich contact records you submit to us with publicly available professional information for sales-qualification purposes. We do not buy contact lists, run affiliate programs, or engage in targeted advertising or profiling.
We may enrich contact records you submit to us (for example, through our website contact form or our HubSpot CRM) with publicly available professional information — such as company name, job title, and professional profile drawn from sources like LinkedIn — for the purpose of qualifying inbound sales inquiries and keeping our records accurate. We do not purchase contact lists from third-party data brokers, do not operate affiliate or referral programs that share your data, and do not engage in "targeted advertising" or "profiling that produces legal or similarly significant effects" as those terms are defined under the CCPA/CPRA or other US state privacy laws. See Section 11 for additional state-specific disclosures.
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
If you are located in the EU or UK, this section applies to you.
The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:
If you are located in Canada, this section applies to you.
We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.
In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. The categories of third parties we may share personal information with are as follows:
Named sub-processors. The following are the specific sub-processors we currently engage. We will update this list when we add, remove, or replace a sub-processor.
| Sub-processor | Purpose | Data categories | Location |
|---|---|---|---|
| FastSpring | Merchant of record, payment processing, subscription billing, invoicing | Name, email, billing address, payment-instrument details, purchase history | United States |
| Cloudflare, Inc. | Website hosting, content delivery network, DNS, bot/security challenge | IP address, request metadata, server logs, security-challenge state | United States (global edge network) |
| Cryptlex | License key issuance, activation, node-locking, license-compliance reporting | Email, license key, hardware fingerprint, activation timestamps, app version | United States / India (per Cryptlex DPA — verify residency at procurement) |
| HubSpot | Customer-relationship management, sales pipeline, marketing email (opt-in only) | Name, business email, company, job title, conversation and email history | United States |
| Fastmail | Outbound and inbound email correspondence ([email protected]) | Email address, message content you send to or receive from VirtuCath | Australia |
If you would like to receive notice of changes to this list, email [email protected] to be added to our sub-processor notification list.
We also may need to share your personal information in the following situations:
In Short: We use a small number of strictly-necessary cookies and request your consent before placing any other cookies on your device. You can change your choice at any time via the "Manage Cookie Preferences" link in the footer.
When you first visit our Site we display a cookie banner. Strictly-necessary cookies (for security, session continuity, and CAPTCHA on forms) are placed without your consent because the Site cannot operate without them. Preferences, analytics, and marketing cookies are only placed if you grant consent through the banner or the preferences modal. You can withdraw or change your consent at any time using the "Manage Cookie Preferences" link in the page footer; doing so causes any non-essential cookies in the rejected categories to be deleted on your next page load.
| Category | Cookie / technology | Purpose | Lifespan |
|---|---|---|---|
| Strictly Necessary (always on) |
__cf_bm, cf_clearance (Cloudflare) | Bot management and security challenge state | Up to 30 days |
| cf-chl-* (Cloudflare Turnstile) | CAPTCHA challenge state for contact / quote / beta-download forms | Session | |
| vc_cookie_consent_v1 (localStorage) | Records your cookie consent choices so we don't ask again on every page | 12 months | |
| Preferences (opt-in) |
"Remember me for downloads" | Lets you skip re-entering download information on subsequent visits. Not used for cross-site tracking. | 30 days |
| Analytics (opt-in) |
None currently in use | Category reserved for future aggregate-usage analytics | — |
| Marketing (opt-in) |
None currently in use | Category reserved for future advertising / remarketing | — |
We do not currently embed Google Analytics, Meta Pixel, LinkedIn Insight, or similar third-party analytics or advertising trackers. If we add any in the future we will update this list and require fresh consent through the cookie banner before they load.
On checkout pages, our merchant-of-record partner FastSpring may set its own cookies on the checkout domain (separate domain, governed by FastSpring's privacy notice).
You can also block or delete cookies directly through your browser settings. Please note that disabling strictly-necessary cookies may prevent parts of the Site (forms, login, anti-bot challenges) from working.
In Short: We keep your information only as long as needed for the specific purpose it was collected for, with concrete retention periods for each category below.
We retain personal information only for as long as necessary to fulfill the purposes set out in this Privacy Notice, except where a longer period is required or permitted by law (for example, tax, accounting, or audit obligations). Specific retention periods we apply:
| Category of data | Retention period | Basis |
|---|---|---|
| Account and license records (name, email, company, license key) | Duration of the account plus 7 years | US/EU tax and accounting record-keeping; defence of legal claims |
| Payment and invoicing records (handled by FastSpring, our merchant of record) | 7 years after the transaction | Tax / financial-records statutes |
| License activation logs (hardware ID, activation timestamps, app version) | 24 months after the activation is deactivated or the license expires | License-compliance audit; fraud prevention |
| Marketing email subscribers | Until you unsubscribe, then up to 24 months in a suppression list to honour your opt-out | Consent (you may withdraw at any time); proof of opt-out |
| Support tickets and bug reports (including diagnostic log bundles) | 3 years from ticket closure | Product improvement; defect investigation |
| Web server / Cloudflare access logs | 30 days, then aggregated | Security; abuse prevention |
| Cookie consent records | 12 months from your last consent action | ePrivacy compliance; demonstrating consent |
When we no longer need your personal information, we either delete it or anonymise it (so it can no longer be associated with you). If deletion is not immediately possible (for example, because it is stored in a backup), we will isolate and protect it until deletion is feasible.
In Short: Your data is processed in the United States. We use European Commission Standard Contractual Clauses (and the UK Addendum) as the primary safeguard for transfers, plus supplementary measures required by the Schrems II ruling.
VirtuCath, LLC is established in Minnesota, United States, and our hosting, payment, and operational infrastructure (including Cloudflare for hosting / CDN / DNS and FastSpring for payments) is located in the United States or in regions designated by those providers. If you access the Services from the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal information will be transferred to, stored in, and processed in the United States.
We rely on the following safeguards for international transfers of personal data out of the EEA / UK / Switzerland:
VirtuCath, LLC has not itself self-certified under the EU-US Data Privacy Framework. We may add DPF self-certification as an additional transfer mechanism in the future; if we do, this Section will be updated.
You may request a copy of the relevant safeguard in place for any specific transfer by emailing [email protected].
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment. We utilize advanced security techniques, including cryptographic hashing and salting, to anonymize sensitive application usage data, ensuring that your technical configurations are stored separately from your personal contact information.
The Services are intended for professional and business use by engineers and medical-device R&D teams and are not directed to minors. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us with personal information, please contact [email protected] and we will delete it.
In Short: Depending on your location, you may have rights that allow you greater access to and control over your personal information.
In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) to withdraw consent at any time where processing is based on consent (without affecting the lawfulness of processing carried out before the withdrawal). In certain circumstances, you may also have the right to object to the processing of your personal information.
Right to lodge a complaint with a supervisory authority. If you are in the EEA, UK, or Switzerland and you believe our processing of your personal information violates applicable data protection law, you have the right to lodge a complaint with your local data protection supervisory authority. A directory of EEA authorities is available at edpb.europa.eu/about-edpb/about-edpb/members; the UK authority is the Information Commissioner's Office (ico.org.uk). We would, however, appreciate the opportunity to address your concerns first — please contact [email protected].
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals.
In Short: If you are a resident of certain US states, you may have specific rights regarding your personal information.
The table below shows the categories of personal information we collect, or expect to collect under this Privacy Notice. Because VirtuCath is in a pre-launch and limited-beta phase, some categories may not yet have been collected in practice.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name | YES |
| B. Personal information as defined in the California Customer Records statute | Name, contact information, education, employment, employment history, and financial information | YES |
| C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | NO |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | YES |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other similar network activity | Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements | YES |
| G. Geolocation data | Device location | YES (imprecise, regional only — derived from IP address; we do not collect precise device location) |
| H. Audio, electronic, sensory, or similar information | Images and audio, video or call recordings created in connection with our business activities | NO |
| I. Professional or employment-related information | Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | YES |
| J. Education Information | Student records and directory information | NO |
| K. Inferences drawn from collected personal information | Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics | NO |
| L. Sensitive personal Information | NO |
Learn more about how we use your personal information in the section, "HOW DO WE PROCESS YOUR INFORMATION?"
We may disclose your personal information with our service providers pursuant to a written contract. We disclose, or expect to disclose under this Privacy Notice, the following categories of personal information to third parties for a business or commercial purpose:
The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"
"Sale" or "share" of personal information. We do not sell or share (as those terms are defined in the CCPA/CPRA) your personal information, and we have not done so in the preceding twelve (12) months. We also do not "process for targeted advertising" within the meaning of the Virginia, Colorado, Connecticut, Utah, or Texas privacy laws.
Depending on your state of residence, you may have additional rights described below. None of these rights are absolute; we may decline a request where the law permits (for example, where verifying your identity is not possible, where complying would prejudice the rights of others, or where retention is required by law).
If you are a California resident, you have the right to:
To exercise these rights, see "How to exercise your rights" below. California residents may also designate an authorised agent to make a request on their behalf; we will require written authorisation and proof of identity.
"Your Privacy Choices" link. Because we do not sell or share personal information, we are not required to display a "Do Not Sell or Share My Personal Information" link. We will add one if our practices change.
Shine the Light (Cal. Civ. Code § 1798.83). California residents may request information about the categories of personal information we disclose, or expect to disclose, to third parties for those third parties' direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes; if you have questions, contact [email protected].
If you are a Virginia resident, you have the right to: (i) access and confirm whether we process your personal data; (ii) request correction of inaccuracies; (iii) request deletion; (iv) receive a portable copy of personal data you provided; and (v) opt out of (a) targeted advertising, (b) the sale of personal data, and (c) profiling that produces legal or similarly significant effects. We do not engage in (a), (b), or (c). Virginia does not provide a private right of action; the Attorney General enforces the VCDPA. If we decline a request, you may appeal — see "Appeals" below.
If you are a Colorado resident, you have the rights to access, correct, delete, port, and opt out of targeted advertising / sale / profiling (we do not engage in any of these). You may exercise rights via the methods described under "How to exercise your rights." Colorado requires that you be able to opt out via a Universal Opt-Out Mechanism (UOOM); because we do not sell, share, or use personal data for targeted advertising or profiling, no UOOM signal currently has any practical effect on our processing. We will honour recognised UOOM signals if we add any such processing in the future.
If you are a Connecticut resident, you have rights of access, correction, deletion, portability, and opt-out (targeted advertising / sale / profiling) substantially similar to those described for Virginia and Colorado above. We do not engage in those processing activities.
If you are a Utah resident, you have rights of access, deletion, portability, and opt-out of the sale of personal data and targeted advertising. The UCPA does not include a right to correct inaccuracies or a right of appeal. We do not sell personal data and do not engage in targeted advertising.
If you are a Texas resident, you have rights of access, correction, deletion, portability, and opt-out of (a) targeted advertising, (b) the sale of personal data, and (c) profiling that produces legal or similarly significant effects. We do not engage in those activities. Texas residents may appeal — see "Appeals" below.
State privacy laws are evolving. If you reside in a US state with a comprehensive privacy law not specifically listed above (for example, Oregon, Montana, Iowa, Tennessee, Delaware, New Jersey, New Hampshire, Indiana, Minnesota, Maryland, Kentucky, Rhode Island), we will honour the access, correction, deletion, portability, and opt-out rights granted to you under the law of your state of residence. Contact [email protected] to exercise these rights.
To exercise any of the rights described above, email [email protected] or submit a data subject request via the contact channels at the bottom of this document. We will verify your identity through information already on file (for example, the email address associated with your VirtuCath account) before fulfilling sensitive requests. Authorised agents must provide written authorisation and we may require direct confirmation from the consumer.
If we decline to take action regarding your request and your state of residence grants an appeal right (e.g., Virginia, Colorado, Connecticut, Texas), you may appeal our decision by emailing [email protected] with the subject line "Privacy Decision Appeal" within 60 days of our response. We will respond in writing within 60 days, including a written explanation of the reasons for the decision. If your appeal is denied, you may contact your state Attorney General.
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice.
If you have questions or comments about this notice, you may contact our Privacy Contact by email at [email protected], by phone at , or contact us by post at:
Note: VirtuCath has not formally appointed a Data Protection Officer under GDPR Article 37. The Privacy Contact is the point of contact for privacy enquiries and data subject requests.
Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, correct inaccuracies, or delete your personal information. To request to review, update, or delete your personal information, please fill out and submit a data subject access request.