Pluto MedTech Business and Account Privacy Notice

Status: Adopted and published

Version: 1.0, 5 October 2026

This notice explains how Pluto MedTech uses personal data about pharmacy trial applicants, customer contacts, authorised account users, suppliers, and other business contacts. It does not cover patient queue data, for which the pharmacy is the controller and Pluto MedTech acts as processor under the DPA.

Who We Are

Controller: Pluto MedTech, operated by John Ranola
Business structure: Sole trader; no company number
CRO business-name registration number: 793705
Address: Flat 5, Saint Bernadette Hall, Richmond Hill, Rathmines,
         Dublin, D06 RK24, Ireland
Privacy email: john@plutomedtech.net
Telephone: +353 86 327 9897
VAT status: Not VAT registered

Information and Purposes

We may use pharmacy and trading names, PSI registration number, business address, contact name and role, business email and telephone, username, account activity, support correspondence, contract and invoice data, and security or incident records. For electronic contract acceptance, we also record the signatory name and title, document versions and hashes, acceptance timestamp, IP address, and browser user-agent evidence.

We use this information to assess registration applications, administer trials and subscriptions, authenticate and support users, communicate service and security information, maintain contracts and invoices, prevent misuse, protect the Service, and comply with legal obligations.

The applicable Article 6 GDPR bases may include steps requested before a contract, performance of a contract, compliance with legal obligations, and legitimate interests in operating and securing a business service. The precise basis depends on the activity. Pluto MedTech does not rely on consent where the processing is necessary to administer the service or contract.

Recipients and Locations

Authorised Pluto MedTech personnel and professional advisers may access these records where necessary. Amazon Web Services provides hosted infrastructure, account email, backups, and operational monitoring, with primary resources in Ireland. Payment providers or other business systems must be added to this notice before they receive contact data.

Where a provider operation involves access outside the EEA, Pluto MedTech will use an applicable GDPR transfer mechanism such as an adequacy decision or approved standard contractual clauses with required supplementary measures.

Retention

• Rejected or withdrawn applications: 90 days after the decision or withdrawal.
• Inactive account and ordinary support records: 12 months after account closure or issue resolution.
• Security and incident records: six years after closure, or longer only for an active investigation, legal hold, or claim.
• Contracts, invoices, and tax records: six years after the end of the relevant accounting period, or longer where Irish law requires it.
• Electronic contract acceptance records: retained with the corresponding contract for six years after the relationship ends, or longer for an active dispute, legal hold, or legal requirement.

Data is deleted or anonymised when no longer needed for these purposes, subject to legal obligations, dispute preservation, and documented security holds.

Your Rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. Contact john@plutomedtech.net. We may need to verify your identity.

You may complain to the Data Protection Commission at https://www.dataprotection.ie/.

Notice Record

Effective date: 5 October 2026
Last reviewed: 5 October 2026
Next review: 5 October 2027, or earlier after a material processing change