Privacy, Security and Subprocessors

CRIBOOS TECH, S.L. acts as data controller for personal data processed for its own purposes, including website enquiries, customer and supplier management, user administration, security, billing and legal compliance.

When Criboos Track PROM is used by an ophthalmology clinic to follow its patients, the clinic determines the purposes and means of the processing and acts as the data controller. In that context, Criboos processes patient personal data on behalf of the clinic and acts as a data processorunder the clinic's documented instructions and the applicable Data Processing Agreement.

Patients who wish to exercise rights regarding clinical or follow-up data should normally contact their ophthalmology clinic. Criboos will assist the clinic in responding to those requests as required by applicable data protection law.

Privacy contact: info@criboos.com
Address: Rambla Sant Nebridi, 10, 08222, Terrassa (Barcelona, Spain)

The categories of personal data processed depend on how the website or Criboos services are used.

• Identification and contact information, such as name, email address and telephone number.
• Account and professional information relating to authorized clinic and administrative users.
• Technical and security information necessary for authentication, access control, service operation and security.
• Communications submitted through contact, support or service channels.
• When Criboos Track PROM is used by a clinic, patient identification and contact data and health-related information required for the follow-up program, including questionnaire responses, patient-reported symptoms, quality-of-life information, satisfaction, treatment adherence and related follow-up information.

Patient health data processed through Criboos Track PROM is processed by Criboos on behalf of the relevant clinic and not for Criboos' own advertising or commercial profiling purposes.

Where Criboos acts as data controller, personal data may be processed to:

• Respond to information, support and contact requests.
• Manage customer, supplier and contractual relationships.
• Manage authorized user accounts and access.
• Operate, maintain and secure Criboos services.
• Prevent unauthorized access, fraud and misuse.
• Manage billing and administrative obligations.
• Comply with applicable legal obligations.

Where Criboos acts as a processor for an ophthalmology clinic, personal data is processed only to provide the contracted service and according to the clinic's documented instructions, including the collection, organization, storage, display and communication of patient-reported follow-up information.

Where Criboos acts as data controller, the applicable legal basis may include the performance of a contract or pre-contractual measures, compliance with legal obligations, legitimate interests relating to service operation and security, or consent where required.

Where a clinic uses Criboos Track PROM for patient follow-up, the clinic, as data controller, is responsible for determining the applicable legal basis under Articles 6 and 9 GDPR and for providing the information required by data protection law. Criboos processes such data as a processor under the clinic's instructions.

Personal data for which Criboos acts as controller is retained only for as long as necessary for the relevant purpose and, afterwards, for any period required by applicable law or necessary for the establishment, exercise or defence of legal claims.

Patient data processed on behalf of clinics is retained and deleted or returned in accordance with the applicable agreement, the clinic's documented instructions and legal retention requirements. Data remaining temporarily in backup systems is protected from ordinary use and removed according to the applicable backup lifecycle.

Criboos applies technical and organizational measures designed to provide a level of security appropriate to the nature of the data and the risks associated with the processing.

Measures applicable to Criboos Track PROM include, where relevant:

• Role-based access controls and organizational access restrictions.
• Encryption of patient identification information stored by the application.
• Protection of web communications using encrypted transport such as HTTPS/TLS.
• Secure management of user credentials, application secrets and access permissions.
• Patient access links based on temporary access tokens. Raw access tokens are not stored in the application database; cryptographic hashes are stored instead.
• Data minimization in operational logs. Criboos is designed not to intentionally record patient names, email addresses, telephone numbers, medical record numbers, raw access tokens, questionnaire responses or clinical results in ordinary application logs.
• Technical logging and audit information for security and operational purposes using technical identifiers where appropriate.
• Procedures for access management, security incident handling, service continuity, recovery and deletion of data.
• Separation of clinical information from billing information, applying data minimization to financial records.

These measures may be updated to reflect technical, organizational, legal or security improvements, provided that the overall level of protection is not materially reduced.

Criboos uses selected service providers to support the operation of Criboos Track PROM. Where those providers process personal data on behalf of Criboos, they are subject to appropriate contractual data protection obligations.

This list applies to providers processing personal data on behalf of Criboos. A provider may separately process limited service, security, traffic or billing information as an independent controller where required or permitted by applicable law. Criboos may add or replace subprocessors when necessary to provide the service. Customers with a contractual notification right will be informed of relevant additions or replacements in accordance with their Data Processing Agreement and will have the opportunity to raise a reasoned objection on data protection grounds.

Criboos seeks to use processing arrangements appropriate for European data protection requirements.

Where personal data must be transferred outside the European Economic Area to a country that does not benefit from an applicable adequacy decision, Criboos requires an appropriate transfer mechanism under Chapter V GDPR, such as Standard Contractual Clauses, Binding Corporate Rules or another legally recognized safeguard, together with supplementary measures where required.

Where Criboos acts as data controller, you may exercise the rights applicable to your circumstances, including access, rectification, erasure, restriction, objection and portability, by contacting info@criboos.com.

For personal data processed by Criboos on behalf of an ophthalmology clinic, requests should normally be addressed to the relevant clinic as data controller. Criboos will provide the assistance required from a processor.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

We use technical cookies where necessary for session management, security and application operation. If non-essential analytical or marketing cookies are introduced, consent will be requested where required by applicable law.

This page also serves as the current public description of the security measures and subprocessors applicable to Criboos Track PROM where it is incorporated by reference into a customer agreement.

Criboos may update this information to reflect changes in the service, security measures, providers or applicable legal requirements. Criboos retains sufficient information to identify previous versions where required for contractual or compliance purposes.

Material changes to subprocessors will be communicated to customers when required by the applicable Data Processing Agreement.

Document version: 1.0
Last updated: 20 August 2026