Privacy notice
This notice covers the grema.io website, email sent to hello@grema.io, and information we handle when we design, build, integrate or look after software for a customer under the Grema name.
Do not send patient data or credentials by email
Please do not email us patient data, personal health information, passwords, access keys or other credentials. If you send some by mistake, we will delete it and tell you.
What this website collects
- We set no cookies, run no advertising or tracking scripts, and the site has nothing to fill in.
- The site uses Cloudflare Web Analytics, a privacy-focused, cookieless measurement service. Cloudflare says it uses no cookies or other client-side storage, does not fingerprint visitors, and does not build advertising profiles of them. We use it only to see aggregate page views. See Cloudflare Web Analytics.
- Apart from that, the site loads nothing from other websites. Fonts, images and scripts are served from grema.io.
- The site is served by Cloudflare, which processes standard request data (such as IP address, browser user agent, the page requested and the time) to deliver and protect the site and keeps it in its logs. See Cloudflare's privacy policy.
What you choose to email us
If you email us, we receive your email address, name and whatever you write, such as your organisation, what you need built and the systems you use. We use it to reply, to scope and schedule work, and to send agreements and invoices. We do not sell it, and we do not share it except with the service providers that deliver and store our email and handle payments.
Information we handle during an engagement
During an engagement we work from material the customer chooses to share, such as workflows, designs, code, configuration and access to test systems. This material is covered by a signed agreement, which sets how it is used, kept and returned or deleted. Where that agreement says something different from this notice, the agreement applies.
Patient data
We handle patient data only when an engagement requires it, and only after the agreement that governs it is signed: a business associate agreement in the United States, or the agreement your privacy law calls for in Canada. That agreement, not this notice, sets what we may do with the data, where it is held, how it is protected and when it is returned or deleted. Wherever we can, we build and test with synthetic data instead.
How long we keep information
We keep emails about work that did not go ahead for up to 12 months, or less if you ask us to delete them. We keep engagement material only as long as the signed agreement allows, and remove our access to customer systems when the engagement ends. Business records such as contracts and invoices are kept as long as the law requires.
Your choices
You can ask to see, correct or delete personal information you sent us by emailing hello@grema.io. If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada or your local privacy regulator.
Where information is held
We are a Canadian company. Email, payment, hosting and Cloudflare data may be processed outside Canada, including in the United States, by our service providers. Where an engagement requires data to stay in a particular country, the signed agreement says so.
Changes
If this notice changes, we will update the effective date above.