Privacy Notice
This notice explains how Response Ortho processes personal data when you visit www.smartfixator.com, contact us, request an account or use the Smart Fixator web application. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR, and applies to users worldwide. Where the law of your country gives you additional information or rights, you will find it in section 18.
Privacy conditions. When you request access to Smart Fixator you accept these privacy conditions:
- this Privacy Notice;
- on behalf of your institution — or yourself, if you practise independently — the Data Processing Agreement that governs the patient data you enter. It is accepted online; no signature is needed;
- receiving information messages from Smart Fixator about the software and devices you use: updates, safety notices, training and service information (see section 12).
1. Who is responsible for your data
The data controller is Response Ortho Teknolojik Üretim A.Ş., ITOSB, 10. Cadde, No:1, Tuzla, 34959 Istanbul, Türkiye (MERSİS no. 0462038264300019), the manufacturer of Smart Fixator®.
Our affiliate Response Ortho Solutions LLC, 1875 W Woolbright Rd, Boynton Beach, FL 33426, United States, supports customers in the United States.
Privacy contact: info@responseortho.com.
2. Whose data this notice covers
- Visitors to www.smartfixator.com and preop.smartfixator.com.
- Healthcare professionals and other users who request access to, sign in to or use the Smart Fixator web application.
- People who contact us through the contact form or by e-mail.
- Patients whose information clinicians enter into the application — see section 6, because different roles apply.
The Smart Fixator software is intended for use by healthcare professionals. It is not directed at consumers.
3. What we collect and how
| Source | Personal data |
|---|---|
| Account request (from you) | First and last name, e-mail address, username, password (stored only as a one-way hash), gender, role (for example surgeon, academic, student), speciality, country, and optionally city, state/province and postal code; your choice about information messages. |
| Contact form (from you) | Name, e-mail address, optional phone number, organisation and country/region, and the content of your message. |
| Use of the application (automatically) | Sign-in and account events with date and time, IP address and browser/operating-system details; security, error and server logs; your account settings. |
| Website visits (automatically) | IP address and technical request data in server logs; the country derived from your IP address by our own web server (used to pre-fill the country fields in our forms, not stored). Only with your consent: Google Analytics usage data and identifiers. |
| Third parties | Google reCAPTCHA's assessment of whether a contact-form submission comes from a person. |
| Clinical content you enter | Patient and case information, radiographs and planning data — see section 6. |
We do not ask for special categories of data about you (such as your health). Please do not include information that identifies a patient in the contact form.
4. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and managing your account, signing you in, providing the software, password resets and service e-mails | Contract (Art. 6(1)(b)) |
| Answering enquiries sent through the contact form or by e-mail | Steps at your request before a contract / legitimate interest in answering you (Art. 6(1)(b), (f)) |
| Keeping the website and application secure: spam and abuse prevention (reCAPTCHA), sign-in protection and account blocking after repeated failures, logging and troubleshooting | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations, including medical-device regulations (complaint handling, vigilance, post-market surveillance), tax and record-keeping duties and requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
| Pre-filling your country in our forms from your IP address (looked up on our own server, not stored) | Legitimate interest (Art. 6(1)(f)) |
| Website analytics (Google Analytics) | Consent (Art. 6(1)(a)) |
| Sending information messages about the Smart Fixator software and devices you use (updates, safety notices, training, service information) | Contract and legitimate interest (Art. 6(1)(b), (f)); safety notices: legal obligation (Art. 6(1)(c)) |
| Developing, improving and validating our products, including AI-assisted measurement, with anonymised case data (see section 6) | Anonymised data is not personal data; the anonymisation is carried out on the customer's behalf under the Data Processing Agreement |
Outside the EEA and the UK we rely on the equivalent legal bases in the law that applies to you.
Where we rely on consent you can withdraw it at any time (see section 5); this does not affect processing that took place before.
5. Cookies and similar technologies
We use cookies that are strictly necessary for the website and the application to work. Optional analytics runs only if you choose Accept in the privacy banner. You can change your choice at any time using Cookie settings at the bottom of our homepage; rejecting analytics also deletes this site's Google Analytics cookies. We do not use advertising or profiling cookies.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| smartfixator_consent | Smart Fixator (first party) | Remembers your privacy choice | 180 days | Strictly necessary |
| PLAY_SESSION | Smart Fixator application (first party) | Keeps you signed in and secures your session | Until you sign out or close the browser | Strictly necessary |
| _GRECAPTCHA | Google (reCAPTCHA) | Distinguishes people from automated abuse when you use the contact form | Up to 6 months | Strictly necessary (security) |
| _ga, _ga_BM11WMLLJQ | Google Analytics (first-party cookies) | Counts visits and measures how the website is used, in aggregate | Up to 2 years | Analytics — only with consent |
When analytics is enabled we send page addresses without query strings, and Google signals and ad personalisation are switched off. To suggest your country in our forms the page asks our own web server for the country of your IP address; no third-party service is involved, only the country code is returned and nothing is stored in a cookie. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies may stop the application from working.
6. Patient data in the Smart Fixator application
Clinicians use the application to plan and follow deformity corrections. The application can hold patient information such as name, date of birth, gender, contact details, radiographs (including DICOM file headers), measurements, correction plans and prescriptions. Radiographs and treatment information are health data, a special category of personal data.
- Roles. For patient data, the healthcare provider or clinician who enters it is the data controller. Response Ortho processes it on their behalf, as a data processor, only to provide the software and on the controller's documented instructions.
- Data processing agreement. Every customer accepts our Data Processing Agreement online, as part of the privacy conditions accepted when requesting access; no signature is required. It sets out the controller's instructions, confidentiality, our security measures, the use of sub-processors, how we help with patients' requests and with personal data breaches, and the deletion or return of data when the service ends.
- Minimise identifiers. We ask users to enter only the patient information that is needed for treatment and, wherever possible, to use a case code instead of names.
- Where it is stored. Application data is hosted in the Netherlands (European Union).
- Our own use. We do not use patient data for our own purposes. With the customer's authorisation in the Data Processing Agreement, we anonymise case data — removing names, dates, contact details, identifiers in image headers and text burned into images — and use only the anonymised data to develop, improve and validate our products, including AI-assisted measurement. We do not attempt to re-identify anonymised data.
- Clinical judgement. AI-assisted measurements and calculated prescriptions are proposals; the clinician reviews and confirms them.
- Patients who want to exercise their rights should contact their healthcare provider; we will assist the provider as required by law.
- United States. For customers that are covered entities under HIPAA, Response Ortho acts as a business associate and signs a business associate agreement (BAA) before protected health information is entered.
7. Who receives your data
We do not sell your personal data or share it for targeted advertising. We disclose it only as needed for the purposes above:
| Recipient | Why | Location |
|---|---|---|
| DigitalOcean (hosting) | Runs our servers: the application and website; the Response Ortho contact service that forwards contact-form messages | Netherlands (application and website); United States (contact service) |
| Microsoft (Microsoft 365) | Delivers contact-form messages to info@responseortho.com and sends account e-mails | Microsoft data centres |
| Google (reCAPTCHA; Analytics with consent) | Abuse prevention; website measurement | United States and other countries |
| Competent authorities and courts | Where required by law, including medical-device vigilance reporting | As required |
| Professional advisers and auditors; a successor in a merger or acquisition | Advice, audits, corporate transactions, under confidentiality | As applicable |
Service providers act on our instructions under written contracts and may not use your data for their own purposes, except where they act as independent controllers under their own terms (for example Google for reCAPTCHA).
8. International transfers
Your data may be processed outside your country: application data in the Netherlands, the contact service in the United States and Google services in the United States and elsewhere. For transfers out of the EEA or the UK we rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission's standard contractual clauses. Where the law of another country restricts transfers, we use the safeguards that law provides (see section 18). You can ask us for information about these safeguards.
9. How long we keep your data
| Data | Retention |
|---|---|
| Account data | While your account is active; after it is closed, only for as long as the law requires or allows us to keep it — for example until legal claims are time-barred |
| Contact-form messages | For as long as needed to deal with your enquiry and any follow-up, unless they become part of a contract or complaint file |
| Sign-in, security and server logs | For as long as needed to protect the service and investigate incidents, and as required by law |
| Complaint, vigilance and other regulatory records | For the periods required by medical-device law |
| Google Analytics data (with consent) | For the retention period configured in Google Analytics |
| Patient data in the application | As instructed by the healthcare provider under the Data Processing Agreement; when the service ends it can be exported for 30 days and is then deleted within 60 days |
When a retention period ends we delete, destroy or anonymise the data.
10. How we protect your data
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), passwords stored only as salted one-way hashes, role-based access limited to people who need it, account blocking after repeated failed sign-ins, logging, and confidentiality obligations for our staff and providers. No system is completely secure; if a personal data breach occurs we will notify the authorities and the people affected where the law requires.
11. Your rights
Depending on the law that applies to you, you may have the right to:
- know whether we process your data and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, or its processing restricted;
- receive data you gave us in a portable format;
- object to processing based on our legitimate interests;
- withdraw your consent at any time;
- not be subject to decisions based solely on automated processing;
- know who has received your data, and ask us to tell them about corrections or erasures;
- claim compensation for damage caused by unlawful processing;
- complain to a data protection supervisory authority — in the EEA the authority of your country of residence or work, in the UK the Information Commissioner's Office (for other countries see section 18).
How to exercise them. Write to us at the address in section 1 or e-mail info@responseortho.com. We may ask you to confirm your identity before we act. We reply free of charge within one month, unless the law allows an extension or a fee. Country-specific application procedures are in section 18.
US residents. Residents of some US states have similar rights (to know, delete, correct and opt out), the right to appeal a refusal, and the right not to be discriminated against for using them. We do not sell or share personal information as those laws define it. You can send a request by the means above, including through an authorised agent.
12. Information messages
Information messages about the Smart Fixator software and devices you use — updates, safety notices, training and service information — are part of the privacy conditions you accept when you request access. You can stop them at any time through the link in each message or by writing to info@responseortho.com; safety notices required by medical-device law and messages needed to run your account (such as password resets) are always sent. We do not send promotional messages about other products without your separate consent.
13. Children
Our website and application are intended for healthcare professionals and are not directed at anyone under 18. We do not knowingly collect personal data about children as users. If you believe a child has given us personal data, contact us and we will delete it. Clinicians may enter information about patients of any age, which is covered by section 6.
14. Automated decisions
We do not take decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Automatic account blocking after repeated failed sign-ins is a security measure that you can resolve through the unblock link we e-mail you.
15. Links to other websites
Our pages link to other websites, such as responseortho.com and Google's policies. Those sites have their own privacy practices, and we are not responsible for them.
16. Changes to this notice
We may update this notice when our services or the law change. The date at the top shows the latest version. If we make material changes we will tell account holders by e-mail or in the application before the changes take effect.
17. How to contact us
Response Ortho Teknolojik Üretim A.Ş., ITOSB, 10. Cadde, No:1, Tuzla, 34959 Istanbul, Türkiye · info@responseortho.com
18. Country-specific information
Türkiye
If you are in Türkiye, the Law on the Protection of Personal Data No. 6698 (KVKK) applies. Our information notice under that law — with the legal bases we rely on, transfers within and outside Türkiye, your rights under Article 11 and how to apply to us — is available in Turkish: KVKK Aydınlatma Metni. Applications under that law can also be sent by registered electronic mail (KEP) to response.ortho@hs01.kep.tr. You can also complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).