Privacy Policy

1. Introduction

This Privacy Policy describes how Dr. WEEE SOPs ("we," "our," or "the Application") collects, uses, stores, and protects customer data when you deploy and use our Azure Marketplace application. We are committed to protecting your privacy and maintaining the security of your data.

2. Data Controller

When you deploy Dr. WEEE SOPs from Azure Marketplace, YOU are the data controller for all data processed by the application. We provide the software infrastructure, but you maintain full ownership and control over:

• User accounts and authentication data
• Standard Operating Procedures (SOPs) content
• Document revisions and version history
• User activity logs
• Business data entered into the system

3. Data Collection

3.1 Data We Collect

The Dr. WEEE SOPs application collects and stores the following types of data:

User Account Information

• Email addresses - Used for user identification and authentication
• User roles and permissions - Used for access control and authorization
• Authentication tokens - Temporary session data for secure access
• Last login timestamps - Used for security and audit purposes

Application Data

• Standard Operating Procedures (SOPs) - Documents, procedures, and workflows created by your users
• Document metadata - Creation dates, modification dates, author information, revision numbers
• Version history - Previous versions of SOPs for audit and compliance tracking
• Comments and annotations - User feedback and collaboration notes on SOPs
• File attachments - Supporting documents, images, and files uploaded to SOPs

System Logs

• Access logs - Records of user logins, page views, and feature usage
• Audit trails - Changes to SOPs, user permissions, and system configuration
• Error logs - Technical errors and system diagnostics (no personal data)
• Performance metrics - Application response times and system health data

Technical Information

• IP addresses - Used for security monitoring and access control
• Browser information - User agent strings for compatibility and troubleshooting
• Session data - Temporary data stored during active user sessions

3.2 Data We Do NOT Collect

We do NOT collect or transmit:

• Credit card information or payment data
• Social Security numbers or government IDs
• Personal health information (PHI)
• Data from your Azure subscription (resource usage, billing, etc.)
• Analytics or tracking data to external services
• Telemetry or usage data sent to third parties

4. Data Storage and Location

4.1 Storage Infrastructure

All application data is stored within YOUR Azure subscription using the following Azure services:

Azure Database for PostgreSQL

• Purpose: Stores all structured application data (users, SOPs, metadata)
• Location: Deployed in your chosen Azure region
• Retention: Data persists indefinitely until you delete it
• Backup: Automated daily backups retained for 7 days (configurable)
• Encryption:
  • Encrypted at rest using Azure Storage encryption (AES-256)
  • Encrypted in transit using TLS 1.2+
  • Database credentials stored as Azure Key Vault secrets

Azure Blob Storage

• Purpose: Stores file attachments, document uploads, and backups
• Location: Same Azure region as your deployment
• Retention: Files persist until deleted by authorized users
• Encryption:
  • Server-side encryption (SSE) with Microsoft-managed keys
  • HTTPS-only access enforced
  • Private network connectivity using Azure Private Link (optional)

Azure Container Instances

• Purpose: Hosts the application runtime environment
• Data Handling: No persistent data stored in containers
• Logs: Container logs retained for 30 days in Azure Monitor

4.2 Data Residency

5. Data Use

5.1 How We Use Your Data

Data collected by the application is used solely for:

1. Application Functionality
   • Authenticating users and managing access control
   • Storing and retrieving SOPs and related documents
   • Maintaining version history and audit trails
   • Enabling collaboration features (comments, reviews, approvals)
2. Security and Compliance
   • Monitoring for unauthorized access attempts
   • Logging system events for audit purposes
   • Detecting and preventing security threats
   • Meeting regulatory compliance requirements (ISO, FDA, etc.)
3. System Maintenance
   • Diagnosing technical issues and errors
   • Optimizing application performance
   • Ensuring system availability and reliability

5.2 How We Do NOT Use Your Data

6. Data Access and Sharing

6.1 Who Has Access to Your Data

Within Your Organization:

• Users with authorized accounts based on role-based access control (RBAC)
• Azure administrators with subscription access
• Database administrators you designate

Outside Your Organization:

• NO external access - Data remains entirely within your Azure tenant
• Support Access - We may access data ONLY when you explicitly grant access for technical support

6.2 Technical Support Access

If you request technical support, you may choose to:

1. Grant temporary access to our support team via Azure Lighthouse or guest account
2. Provide anonymized logs without sensitive data
3. Share screenshots with redacted information
4. Export specific data for troubleshooting

We will NEVER access your data without:

• Your explicit written permission
• A documented support ticket
• Time-limited access credentials
• Your ability to revoke access at any time

7. Data Security

7.1 Security Measures

We implement industry-standard security practices:

Encryption

• At Rest: AES-256 encryption for all stored data
• In Transit: TLS 1.2+ for all network communications
• Database: Encrypted PostgreSQL connections with SSL/TLS
• Credentials: Azure Key Vault for secrets management

Access Control

• Authentication: Email-based authentication with secure password hashing (bcrypt)
• Authorization: Role-based access control (RBAC) with least privilege principle
• Session Management: Secure HTTP-only cookies with expiration
• API Security: Token-based authentication with rate limiting

Network Security

• Firewall Rules: Azure Network Security Groups (NSGs) restrict access
• Private Networking: Optional Azure Virtual Network integration
• DDoS Protection: Azure platform-level DDoS mitigation
• IP Restrictions: Configurable IP whitelisting

Monitoring and Auditing

• Audit Logs: All data access and modifications logged
• Security Monitoring: Azure Monitor alerts for suspicious activity
• Compliance Scanning: Regular vulnerability assessments
• Incident Response: Documented procedures for security events

7.2 Your Security Responsibilities

As the data controller, you are responsible for:

• Securing your Azure subscription credentials
• Managing user access and permissions
• Configuring network security rules
• Maintaining backup and disaster recovery procedures
• Monitoring audit logs for your organization
• Training users on security best practices

8. Data Retention and Deletion

8.1 Retention Periods

Data is retained as follows:

Data Type	Retention Period	Justification
Active SOPs	Indefinite	Required for business operations
Archived SOPs	Indefinite	Regulatory compliance and audit trails
Version History	Indefinite	ISO/FDA compliance requirements
User Accounts	Until manually deleted	Access control
Access Logs	90 days (configurable)	Security monitoring and audit
Error Logs	30 days	Technical troubleshooting
Database Backups	7 days (configurable)	Disaster recovery

8.2 Data Deletion

You can delete data through:

1. Application Interface
   • Delete individual SOPs (moved to trash, recoverable for 30 days)
   • Permanently delete from trash
   • Remove user accounts (all associated data deleted)
   • Delete file attachments
2. Azure Portal
   • Delete the entire resource group (removes ALL data permanently)
   • Delete the PostgreSQL database
   • Delete the Blob Storage container
3. Database Access
   • Direct SQL commands to delete specific records (for administrators)

9. Your Data Rights

9.1 Access and Control

As the data controller, you have complete rights to:

• Access: View all data stored in the application
• Export: Download data in standard formats (JSON, CSV, PDF)
• Modify: Update or correct any data at any time
• Delete: Remove data permanently
• Restrict: Control who can access specific data
• Portability: Migrate data to other systems

9.2 End User Rights (GDPR/CCPA)

If you process personal data of EU citizens or California residents, you must:

• Inform users about data collection (this policy helps)
• Provide mechanisms for users to access their data
• Honor deletion requests (Right to be Forgotten)
• Obtain consent for data processing where required

The application provides tools to help you comply:

• User data export functionality
• Account deletion with data purging
• Audit logs for data access transparency

10. Compliance and Certifications

10.1 Regulatory Compliance

The Dr. WEEE SOPs application is designed to support compliance with:

• GDPR (General Data Protection Regulation) - EU data privacy
• CCPA (California Consumer Privacy Act) - California privacy rights
• HIPAA (Health Insurance Portability and Accountability Act) - Healthcare data (with proper Azure configuration)
• ISO 9001 - Quality management systems
• ISO 27001 - Information security management
• FDA 21 CFR Part 11 - Electronic records and signatures
• GxP (Good Practice guidelines) - Pharmaceutical and medical device industries

10.2 Azure Platform Compliance

The application leverages Azure's compliance certifications:

• SOC 1, SOC 2, SOC 3
• ISO 27001, ISO 27018, ISO 27017
• FedRAMP (for government deployments)
• HITRUST (for healthcare)
• Full list: Azure Compliance

11. Cookies and Tracking

11.1 Cookies Used

The application uses the following cookies:

Cookie Name	Purpose	Type	Duration
session_token	Maintain user login session	Essential	24 hours
csrf_token	Prevent cross-site request forgery	Security	Session
remember_me	Optional persistent login	Functional	30 days
ui_preferences	Store user interface settings	Functional	1 year

11.2 Third-Party Cookies

We do NOT use:

• Analytics cookies (Google Analytics, etc.)
• Advertising cookies
• Social media tracking pixels
• Third-party marketing cookies

12. Contact Information