Privacy Policy

1. Introduction

This Privacy Policy explains how Maia Vision Ltd collects, uses, stores, protects, and shares personal data in connection with VisionSuite, the web-based platform available at https://visionsuite.maiavision.co.uk.

This Privacy Policy applies to VisionSuite only. It does not necessarily apply to the general Maia Vision Ltd website at https://maiavision.co.uk, which may have separate privacy notices, terms, or policies.

VisionSuite is designed to support research, clinical data management, participant engagement, collaboration, and related workflows within vision science, optometry, ophthalmology, healthcare research, and associated fields.

Depending on how VisionSuite is used, Maia Vision Ltd may act as a data controller for limited information, such as account administration, platform security, support, and business contact data.

Where VisionSuite is used by a university, research organisation, healthcare organisation, sponsor, study team, or other customer to manage project, participant, research, or health-related data, Maia Vision Ltd will usually act as a data processor on behalf of that organisation.

Where an organisation, research team, sponsor, university, healthcare provider, or project owner is responsible for a study or project, that organisation is normally responsible for explaining:

• how project data is used;
• what lawful basis applies;
• how long the data is kept; and
• how participants can exercise their rights.

This Privacy Policy should therefore be read together with any participant information sheet, consent form, study privacy notice, research protocol, contract, or Data Processing Agreement that applies to the relevant project.

2. Information We Collect

The information processed through VisionSuite depends on the configuration of the relevant project, study, portal, or organisation. VisionSuite may process the categories of information described below.

Account and user information

We may collect and process information about authorised users of VisionSuite, including:

• names, email addresses, and organisation or institution details;
• user roles, access permissions, and account status;
• login credentials and authentication records; and
• system activity records.

Participant and project information

Where VisionSuite is configured for a research, clinical, university, or healthcare-related project, it may process participant-related personal data. This may include:

• participant names, dates of birth, and contact details;
• study identifiers and demographic information;
• appointment or study participation information;
• parent or guardian information where applicable; and
• other project-specific information entered by authorised users.

Research and health-related information

Depending on the project, VisionSuite may process research and health-related information, including:

• clinical images, visual field assessments, and Optical Coherence Tomography data;
• research measurements and questionnaire responses;
• study documentation, research notes, and uploaded supporting files; and
• other information relevant to the project.

Where information identifies an individual and relates to their health, clinical status, vision, or medical care, it may be special category personal data under UK data protection law. Such information should only be uploaded to VisionSuite where there is appropriate authority, governance, ethical approval, participant information, consent where applicable, contract coverage, and data protection documentation.

Technical, usage, and security information

We may process technical and operational information required to run, secure, maintain, and improve VisionSuite. This may include:

• login records, access records, audit logs, and session information;
• IP addresses, browser information, and device information;
• error logs, backup records, and security monitoring information; and
• support-related information.

Communications and support information

If you contact us or your project administrator about VisionSuite, we may process your name, email address, organisation, role, message content, support request details, and any related information needed to respond to your query.

Cookies and similar technologies

VisionSuite may use cookies, session storage, and similar technologies to provide essential platform functionality, maintain secure sessions, support authentication, remember preferences, and protect the service from misuse. More information is provided in section 9 below.

3. How We Use Information

We use personal data where necessary to provide, operate, secure, maintain, and support VisionSuite.

This may include using information to:

• create and manage user accounts;
• authenticate users and apply role-based or project-level access controls;
• display project information to authorised users;
• support participant and research workflows;
• enable secure communication and collaboration;
• store uploaded files and records;
• allow permitted data export;
• provide technical support and troubleshoot issues;
• maintain backups and monitor service performance; and
• protect VisionSuite against unauthorised access or misuse.

We may also use information to manage our relationship with customer organisations, comply with legal and contractual obligations, support audits or security reviews, investigate suspected incidents, respond to lawful requests, and improve the reliability, usability, security, and functionality of VisionSuite.

Where we process project, participant, research, or health-related data on behalf of a customer organisation, we process that data only in accordance with the relevant organisation's documented instructions, applicable contract, Data Processing Agreement, and project governance requirements.

We do not sell personal data. We do not use identifiable participant health data for advertising. We do not use VisionSuite to make decisions based solely on automated processing that have legal or similarly significant effects on individuals, unless this is expressly stated in project-specific documentation.

4. Legal Basis for Processing

Where Maia Vision Ltd acts as a data controller, we rely on one or more lawful bases under UK data protection law depending on the purpose of the processing.

We may rely on the following lawful bases:

• Contract: where processing is necessary to provide access to VisionSuite, manage user accounts, support customer organisations, administer our services, or take steps before entering into a contract.
• Legitimate interests: where processing is necessary for appropriate business, operational, technical, or security purposes, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: where processing is necessary to comply with legal obligations, including obligations relating to data protection, security, accounting, tax, corporate administration, regulatory compliance, or lawful requests from public authorities.
• Consent: where consent is appropriate, such as for optional communications, non-essential cookies, or specific project features where consent is required.

Where we rely on legitimate interests, those interests may include operating and improving VisionSuite, maintaining platform security, preventing misuse, managing support requests, keeping appropriate records, and communicating with users and customer organisations about the service.

Where we rely on consent, you may withdraw your consent at any time.

Where VisionSuite is used for a research, clinical, university, healthcare, or participant project, the relevant data controller is normally responsible for identifying the lawful basis for processing project data. Where special category data is processed, the relevant data controller is also responsible for identifying an additional special category condition under UK data protection law.

If you are a participant, parent, guardian, patient-facing user, or research subject, please refer to the relevant study privacy notice, participant information sheet, consent form, or project documentation for details of the lawful basis that applies to your project data.

5. Sharing and Disclosure

Personal data may be shared only where necessary and appropriate for the operation, security, governance, support, or lawful administration of VisionSuite.

Depending on your role and the project configuration, information may be visible to authorised users such as:

• project administrators, researchers, clinicians, and collaborators;
• study coordinators, investigators, and research teams;
• participants, parents, or guardians where the relevant portal allows this;
• institutional administrators; and
• other users who have been granted appropriate access.

Where VisionSuite is used by an organisation, we may share or make data available to that organisation, its authorised representatives, project owners, investigators, research teams, sponsors, or other parties authorised under the relevant project governance arrangements.

We may use trusted service providers and supporting services to host, secure, maintain, back up, monitor, and support VisionSuite. These may include:

• hosting providers and backup storage providers;
• certificate and security services;
• source code management services;
• email or communication services;
• professional advisers; and
• technical support providers.

Where such providers process personal data on our behalf, we require appropriate contractual, security, and data protection safeguards.

We may disclose information where required by law, regulation, court order, legal process, regulatory request, contractual obligation, or where disclosure is necessary to protect the security, rights, property, or safety of Maia Vision Ltd, VisionSuite, users, participants, customer organisations, or others.

VisionSuite production data is intended to be hosted in the United Kingdom. If any personal data is transferred outside the United Kingdom, we or the relevant data controller will ensure that appropriate safeguards are in place where required by applicable data protection law.

6. Data Storage and Security

VisionSuite is hosted in a server environment controlled and administered by Maia Vision Ltd. Production data is intended to be hosted in the United Kingdom.

We use technical and organisational measures designed to protect personal data processed through VisionSuite. These measures may include:

• authenticated access and role-based permissions;
• project-level access controls;
• HTTPS/TLS encryption and password hashing;
• restricted administrative access and server-level access controls;
• security monitoring, audit records, and activity records;
• web security headers and backup processes; and
• access controls based on the principle of least privilege.

Authorised users are responsible for keeping their login details secure, using VisionSuite only for authorised purposes, and following any project-specific, institutional, or organisational security requirements that apply to them.

No online service can be guaranteed to be completely secure, uninterrupted, or free from error. If you become aware of a suspected security issue, unauthorised access, data incident, or vulnerability affecting VisionSuite, please contact us promptly using the details at the end of this policy.

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it is processed, including to provide VisionSuite, maintain security, comply with legal or contractual obligations, resolve disputes, support audits, and meet operational requirements.

Retention periods may vary depending on the type of information and the applicable project requirements:

• Account and user information is generally retained while the relevant account remains active and for a reasonable period afterwards where needed for security, audit, support, legal, or contractual reasons.
• Project, participant, research, and health-related data is normally retained according to the instructions, retention schedule, research protocol, contract, Data Processing Agreement, or governance requirements of the relevant data controller.
• Technical logs, audit records, security records, and backup records are retained for periods appropriate to operational, security, audit, and recovery needs.

Backup copies may retain deleted or amended information for a limited period until backups are overwritten or deleted according to the applicable backup cycle.

Where Maia Vision Ltd acts as a data processor, return, deletion, archiving, or retention of project data will be handled in accordance with the relevant data controller's documented instructions and any applicable contract or Data Processing Agreement.

8. Your Rights

Under UK data protection law, you may have rights in relation to your personal data. These may include:

• the right to request access to your personal data;
• the right to correction of inaccurate data;
• the right to deletion of data in certain circumstances;
• the right to restriction of processing;
• the right to object to processing;
• the right to data portability; and
• rights relating to automated decision-making.

Where processing is based on legitimate interests or certain public interest grounds, you may have the right to object to that processing. You may also object to direct marketing at any time.

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Some rights may not apply in every situation. For example, rights may be affected by research exemptions, legal obligations, clinical or health-related requirements, contractual obligations, security needs, or the lawful basis relied on for processing.

Where Maia Vision Ltd is the data controller for the relevant information, you can contact us using the details at the end of this policy to exercise your rights.

Where your request relates to project, participant, research, clinical, or health-related data controlled by a university, research organisation, healthcare organisation, sponsor, or other project owner, we may need to refer your request to that organisation. Maia Vision Ltd will support the relevant data controller in responding to rights requests where required by applicable contract, Data Processing Agreement, or law.

You also have the right to complain to the UK Information Commissioner's Office, the UK supervisory authority for data protection. The ICO can be contacted at https://ico.org.uk.

9. Cookies and Similar Technologies

VisionSuite may use cookies, session storage, local storage, and similar technologies to operate and secure the platform.

Essential cookies and similar technologies may be used to:

• keep you signed in;
• maintain secure sessions;
• remember authentication status;
• protect against unauthorised access;
• support security controls; and
• provide core platform functionality.

These technologies are necessary for VisionSuite to work properly.

We may also use preference cookies or similar technologies to remember user choices, such as interface preferences, where applicable.

We will not use non-essential analytics, advertising, or tracking cookies on VisionSuite unless they are clearly explained and, where required, appropriate consent has been obtained.

You may be able to block or delete cookies using your browser settings. However, blocking essential cookies may prevent VisionSuite from working correctly.

A separate Cookie Policy may provide further information about the cookies and similar technologies used by VisionSuite.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to VisionSuite, legal requirements, data processing activities, security arrangements, or operational practices.

When we update this Privacy Policy, we will change the "Last updated" date at the top of this page.

Where changes are significant, we may take reasonable steps to notify affected users, customer organisations, or project administrators.

Your continued use of VisionSuite after an updated Privacy Policy is published means that you have had an opportunity to review the updated wording. Where a project-specific privacy notice, participant information sheet, contract, or Data Processing Agreement applies, those documents may contain additional information about changes affecting a specific project.