Privacy Policy

1. Introduction

Aurora IT Tech Pte Ltd (“Aurora,” “we,” “our,” or “us”) operates the Aurora medical imaging platform and related services (collectively, the “Platform”). This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you access or use the Platform or otherwise interact with us.

We manage data in line with the Personal Data Protection Act 2012 of Singapore (“PDPA”), the EU General Data Protection Regulation (“GDPR”), and other applicable data-protection laws. If you disagree with this Privacy Policy, please discontinue use of the Platform immediately.

2. Who We Are

3. Scope

This Privacy Policy applies to personal data we collect through the Platform, through our support channels, during demos and research collaborations, at events, or via any other interaction with Aurora. If we engage in separate agreements that include additional privacy terms (for example, a Business Associate Agreement), those terms will prevail to the extent of any conflict.

4. Types of Data We Collect

We collect the following categories of data:

• Identity and Contact Data: Name, email address, organisation, job title, phone number, and country.
• Account Credentials: Username, hashed passwords, multi-factor authentication details, and access logs.
• Medical Imaging Data: Imaging files (e.g., DICOM, NIfTI) and metadata you upload, which may include de-identified clinical context.
• Support and Communications: Messages, tickets, feedback, and associated attachments.
• Device and Technical Data: IP address, browser type, system configuration, timestamps, and diagnostic logs.
• Usage Analytics: Feature interactions, session history, and error events captured through cookies or similar technologies.
• Derived Data: Analysis outputs, structured reports, and metrics generated through our AI pipelines.

Sensitive Data: We do not solicit identifiable Protected Health Information (PHI). If you upload data that could identify a patient, you are responsible for obtaining appropriate consent and executing the required agreements with us in advance.

5. How We Collect Data

• Direct interactions: When you register, log in, request support, upload files, or respond to surveys.
• Automated technologies: Through cookies, server logs, analytics scripts, and monitoring tools.
• Third parties: From integration partners (with authorisation), public sources, and analytics vendors.

6. Lawful Basis for Processing

We process personal data only where a lawful basis exists. Depending on the context, this may include:

• Consent: For optional features, marketing communications, or analytics where consent is required.
• Contractual necessity: To create accounts, provide the Platform, and deliver support services.
• Legitimate interests: To secure our systems, improve performance, undertake research with de-identified data, and prevent misuse.
• Legal obligations: To comply with applicable laws, regulatory requests, or court orders.
• Vital interests: In rare cases to protect life or safety when legally permissible.

7. How We Use Personal Data

We use personal data to:

• Provision, operate, and maintain the Platform and related services.
• Process uploaded medical imaging data and generate analysis outputs.
• Provide support, respond to enquiries, and communicate updates or changes.
• Improve our algorithms, conduct benchmarking, and develop new features (using de-identified or aggregated data wherever possible).
• Enforce our Terms of Service, investigate suspicious activity, and maintain platform security.
• Comply with audit, accounting, tax, and regulatory obligations.

8. Data Sharing and Disclosure

We do not sell personal data. We share data only in the circumstances below:

• Service providers: Cloud infrastructure, storage, analytics, and security vendors operating under written agreements and confidentiality commitments.
• Professional advisers: Legal counsel, auditors, or insurers who require the information to provide their services.
• Compliance and enforcement: Law enforcement, regulators, or courts when required by law or to protect our rights.
• Corporate transactions: In connection with mergers, financing, or acquisition events, subject to appropriate safeguards.
• With your instruction: When you explicitly authorise integrations or data exports.

9. International Transfers

We may store and process data on servers located outside your jurisdiction (including the European Union, United States, and Singapore). When transferring data internationally, we implement safeguards such as Standard Contractual Clauses, intra-group agreements, and technical measures to protect the data in accordance with applicable law.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, or enforce agreements. We apply tiered retention schedules: account and audit data follow regulatory requirements, while uploaded imaging data is deleted or anonymised when no longer needed. You may request deletion at any time (see Section 13).

11. Security

We employ layered safeguards, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256 or equivalent).
• Role-based access controls, mandatory authentication, and monitoring.
• Network segmentation, vulnerability scanning, and patch management.
• Incident response procedures, disaster recovery plans, and employee training.

No system is entirely secure; please notify us immediately of any suspected breach via security@aurora-tech.co.

12. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access a copy of your personal data.
• Request correction of inaccurate or incomplete data.
• Request deletion, anonymisation, or suspension of processing (subject to legal obligations).
• Object to processing or request restriction of processing in certain circumstances.
• Request data portability in a commonly used, machine-readable format.
• Withdraw consent where processing is based on consent (without affecting prior lawful processing).
• Lodge a complaint with the Personal Data Protection Commission (PDPC) Singapore or relevant supervisory authority.

13. Exercising Your Rights

Submit requests to privacy@aurora-tech.co. We will verify your identity before processing the request and respond within the timelines required by applicable law. We may decline requests that are manifestly unfounded or excessive, or retain certain data to comply with legal obligations.

14. Cookies and Similar Technologies

We use essential cookies for authentication and security, functional cookies to remember preferences, and analytics cookies to understand usage trends. For more detail and to manage preferences, review our Cookie Policy.

15. Third-Party Services

The Platform may link to third-party systems (e.g., secure file transfer services, identity providers, analytics vendors). Their privacy practices are governed by their own policies, which we encourage you to review. We take reasonable steps to ensure any third party given access to data adheres to confidentiality and security obligations.

16. Children’s Data

The Platform is designed for professional users aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us so we can delete it promptly.

17. Updates to This Privacy Policy

We may modify this Privacy Policy from time to time to reflect changes in technology, legislation, or our business. Material updates will be highlighted on this page and, where appropriate, communicated via email or in-product notice. The “Last Updated” date (above) indicates when the current version took effect.

18. Contact Us

For privacy questions, complaints, or data subject requests contact our Data Protection Officer at privacy@aurora-tech.co. For general support queries, email support@aurora-tech.co.

Aurora IT Tech Pte Ltd
36 Robinson Road, #13-01 City House, Singapore 068877