Privacy Statement
DBFoot.com — Diabetic Foot Wellness Monitoring Service
Effective Date: January 2026
Pilot Programme
We are committed to protecting your privacy and handling your personal data responsibly. This Privacy Statement explains how we collect, use, store, share, and protect your information in connection with the Diabetic Foot Wellness Monitoring Service (the "Service"). It should be read alongside the Terms and Conditions (which you have already accepted).
1. Who We Are
- Data Controller: DBFoot.com ("we", "us", "our")
- Registered address: Unit 5, Toberbride Business Park, Collooney, Sligo, Ireland
- Email for privacy queries: info@DBFoot.com
We are running this Service as a wellness and research pilot programme.
2. What Information We Collect
| Category | Examples | How we collect it |
|---|---|---|
| Identity & Contact Data | Name, email, phone, postal address, ID number (optional) | Provided by you during sign-up or assessment |
| Health & Wellness Data | Foot-risk category, thermal & visual images, clinician notes, wellness plan | Generated via the app, device, and clinician review |
| Technical & Usage Data | Device ID, IP address, app logs, upload timestamps | Automatically when you use the app/device |
| Communications | Emails, support tickets, feedback | When you contact us |
Special Category Data: Foot images and temperature readings are special category health data under UK/EU GDPR. We only process these with your explicit consent (given when you tick "I Agree").
3. How We Use Your Information
| Purpose | Legal Basis (UK/EU GDPR) |
|---|---|
| Deliver the Service (assessment, image review, clinician contact) | Contract (Terms and Conditions) + Explicit consent (health data) |
| Operate and secure the app/device | Legitimate interests (system functionality & security) |
| Contact you about concerning changes or Service updates | Contract + Legitimate interests (safety) |
| Anonymised research & service improvement | Legitimate interests (research) – no identifiable data used |
| Respond to support queries or legal requests | Legal obligation or legitimate interests |
| Send Service reminders (e.g., "upload due") | Contract |
We do not use your data for marketing without separate consent.
4. Who We Share Your Data With
| Recipient | Purpose | Safeguards |
|---|---|---|
| Assigned clinician(s) | Image review & wellness support | Contractual NDA + role-based access |
| Hosting provider (UK/EU data centres) | Secure storage & processing | UK/EU adequacy + DPA |
| Essential staff (IT, admin) | Service operation | Need-to-know access only |
| Anonymised researchers | Pilot evaluation | Data fully de-identified |
| Regulators / courts | Legal compliance | Only if required by law |
We never sell your data.
5. International Transfers
All servers are located in the UK or EEA (when the launched [post-pilot] service goes live). If any future transfer outside these areas is needed, we will use International Data Transfer Agreements (IDTA) or equivalent safeguards and inform you.
6. Data Retention
| Data Type | Retention Period |
|---|---|
| Images & health records | 6 months after you leave the pilot (or longer if required for research with renewed consent) or retained, while you remain on the launched service. |
| Account & contact details | Deleted within 30 days of pilot or service exit |
| Anonymised research data | Indefinite (no personal identifiers) |
| Logs | 12 months for security |
You can request deletion earlier (subject to legal obligations) by emailing info@DBFoot.com.
7. Security
- Encryption: Images encrypted in-transit (TLS 1.3) and at-rest (AES-256).
- Access controls: Multi-factor authentication, role-based access, audit logs.
- Incident response: Any breach will be reported to you and the ICO within 96 hours if required.
8. Your Rights (UK GDPR)
You have the right to (when the service is launched):
- Access your data (free copy within 1 month).
- Rectify inaccurate data.
- Erase data ("right to be forgotten") – subject to research needs.
- Restrict processing.
- Object to processing based on legitimate interests.
- Data portability (structured format).
- Withdraw consent for health data (stops Service immediately).
- Complain to the appropriate ICO.
To exercise rights, email info@DBFoot.com. We will respond within 2 weeks.
9. Cookies & Tracking
The app uses essential technical cookies only (no analytics or advertising).
10. Children
The Service is for adults (18+). We do not knowingly collect data from children.
11. Changes to this Privacy Statement
We may update this Statement. Material changes will be notified by email / in-app message at least 14 days in advance. Continued use = acceptance.
12. Contact Us
- Data Protection Officer: info@DBFoot.com
- General privacy queries: info@DBFoot.com
- Postal: DBFoot.com C/O Firefly Orthoses Limited. (Address above)