Privacy Policy

NOVENTRA is operated by CENTRIVON TECHNOLOGIES LTD, a company registered in England and Wales (company number 17490734), registered office 128 City Road, London, EC1V 2NX, United Kingdom.

NOVENTRA (https://noventra.centrivon.tech) and its operator CENTRIVON TECHNOLOGIES LTD (centrivon.tech) are referred to in this policy as "CENTRIVON", "we", "us" or "our". We are responsible for the personal data described in this policy.

NOVENTRA is a business platform used by medical companies, manufacturers and healthcare organisations. When an organisation uses NOVENTRA to manage its own business records (for example clients, installed units, visits, warranties and service tickets), that organisation decides what it records, and we process that content on its behalf to provide the service.

For any privacy question or request, contact us at contact@centrivon.tech.

Account and sign-in information

When you create an account or sign in, we collect the information needed to identify you and keep your account secure:

• Sign in with Google or Microsoft. When you choose one of these providers, the provider shares your name, email address and profile picture with us, together with a unique account identifier issued by that provider. We do not receive your provider password.
• Email and password. Your email address and a password. Passwords are stored only in hashed form by our authentication system; we never store or see your password in plain text.
• Email sign-in links. Your email address, so we can send you a one-time sign-in or password reset link.
• Passkeys. If you register a passkey, we store only the passkey's public key, its identifier, a label and usage details (such as when it was created and last used). Your fingerprint, face scan, device PIN or any other biometric data stays on your device and is never sent to or stored by us. The private key never leaves your device.

Profile and organisation information

• Your name, job title, phone number and country, where you provide them.
• Your organisation's legal name, display name, type (for example medical company, manufacturer or healthcare organisation), country, workspace address and logo.
• Your role and permissions within the organisations you belong to, and any invitations you send or receive.

Content you and your organisation add

Business records entered into or imported to NOVENTRA, such as brands, product catalogues, clients and hospital sites (including addresses and map locations), installed units and serial numbers, warranties and documents, visits and visit reports, service tickets and attachments. Some of these records may contain the names and contact details of people at client organisations.

Security and usage information

• Sign-in and security events (for example sign-ins, passkey additions and removals) and administrative audit records.
• Technical information sent by your browser, such as IP address, browser type, device type and timestamps, which we use to operate and protect the service.

Billing information

If your organisation subscribes to a paid plan, we keep records of the plan, subscription status and invoices. Card details are entered with and processed by our payment provider; NOVENTRA does not store full card numbers.

We use personal data only to provide and protect NOVENTRA, specifically to:

• Create and secure your account, including verifying your identity, protecting against unauthorised access and keeping security records.
• Sign you in using the method you choose (passkey, Google, Microsoft, email link or password).
• Operate the service: setting up your organisation's workspace, applying roles and permissions, storing and displaying your organisation's records, enabling connections that your organisation approves, and providing support.
• Communicate with you about your account, such as sign-in links, password resets, invitations, security notices, trial and subscription notices, and service updates.
• Manage subscriptions, billing and refunds.
• Comply with legal obligations and enforce our Terms of Service.

We do not use your personal data for advertising, and we do not use data received from sign-in providers for any purpose other than signing you in and running your account.

Where data protection law requires a legal basis, we rely on performance of our contract with you or your organisation, our legitimate interests in operating and securing the service, compliance with legal obligations, and your consent where we ask for it.

When you sign in with Google, we request only basic profile information (your name, email address and profile picture) and use it solely to create your account and sign you in. We do not request access to your Gmail, Google Drive, Calendar, Contacts or other Google services.

NOVENTRA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or allow humans to read it except where you give permission, where it is necessary for security or to comply with the law.

NOVENTRA's application, database and file storage are hosted on managed cloud infrastructure operated by our hosting providers. Data may be stored and processed in countries other than your own. Where personal data is transferred internationally, we rely on the safeguards required by applicable law, such as contractual protections with our providers.

We protect data with measures including:

• Encryption in transit (HTTPS/TLS) for all traffic to and from NOVENTRA.
• Encryption at rest provided by our infrastructure providers.
• Database-level access rules that separate each organisation's records, so members can only access data for organisations they belong to and only in line with their role.
• Private file storage for documents, with short-lived access links issued only to authorised users.
• Hashed passwords, public-key-only passkey storage and single-use sign-in links.
• Restricted, audited administrative access.

No method of transmission or storage is completely secure, but we work to protect your information and will notify affected users and authorities of a personal data breach where the law requires.

We do not sell, rent or trade personal data, and we do not share it with third parties for their own marketing or advertising.

We share personal data only in these limited circumstances:

• Service providers that we need to run the platform, acting on our instructions, such as cloud hosting, database and file storage, authentication and sign-in, email delivery, mapping and payment processing providers. They may use the data only to provide their services to us.
• Sign-in providers (Google, Microsoft), only to complete the sign-in you start with them.
• Within your organisation and approved connections. Information you add to an organisation is visible to other members of that organisation according to their roles. Data is shared with another organisation only through connections and sharing settings that the organisations involved approve.
• Integrations your organisation enables, such as importing records from another system your organisation uses.
• Legal requirements: where we are required to do so by law, court order or a lawful request from a public authority, or where necessary to protect the rights, property or safety of our users, the public or CENTRIVON.
• Business transfers: if CENTRIVON is involved in a merger, acquisition or sale of assets, subject to this policy continuing to protect your data.

NOVENTRA uses essential cookies and your browser's local storage to keep you signed in, remember your active workspace and preferences (such as light or dark mode), and protect sign-in flows. These are necessary for the service to work and are not used for advertising or cross-site tracking.

You can clear cookies and site data in your browser settings at any time; doing so will sign you out. See also our Cookie Policy.

The owner of an organisation can ask us to delete it from the organisation's settings, or by contacting our support team. Once we confirm the request, your workspace becomes read-only for 30 days, so you can export anything you need. The owner can cancel at any time during that period. At the end of the 30 days, we permanently delete your organisation's data from our live systems, including its users' access, records, documents and uploaded files.

If a healthcare organisation's profile is shared with its suppliers, deleting it removes its members, access, private information and files, and returns the profile to an unclaimed listing. Equipment and service records that suppliers keep for their own customers are not deleted.

We keep a limited record of payments (amount, currency, date and invoice reference, with no names or contact details) for 10 years, because tax and accounting law requires it.

When an individual user account is deleted, we also remove that person's profile, memberships, roles and notifications.

Notifications: 12 months once read, 18 months if unread. Activity and security logs: 24 months. Administrative audit records: 36 months, and records of completed deletions: 6 years. Payment records: 10 years, as described above.

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your account and personal data;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent where we rely on consent.

To request access, correction or deletion of your account and data, email contact@centrivon.tech from the email address linked to your account. We may ask you to confirm your identity before acting on the request, and we will respond within the time required by law (normally within one month).

You can also update much of your profile directly in your account settings, and remove passkeys from the account security page. If your data was added by an organisation you work with, we may refer your request to that organisation. If you are not satisfied with our response, you may complain to your local data protection authority; in the United Kingdom this is the Information Commissioner's Office (ICO).

NOVENTRA is a business service and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at contact@centrivon.tech and we will delete it.

We may update this policy from time to time. We will post the updated version on this page with a new effective date and, if the changes are significant, notify account holders by email or in the app before they take effect.

CENTRIVON TECHNOLOGIES LTD, operator of NOVENTRA
Registered in England and Wales, company number 17490734
ICO registration number: ZC294125
Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
Website: centrivon.tech
Service: https://noventra.centrivon.tech
Privacy and legal questions: contact@centrivon.tech