Privacy policy

Information you give us

When you fill in one of our forms, we ask only for what we need to understand and answer your request:

• Your name, and on some pages the name of your clinic, centre or company.
• Your phone number, which may be a WhatsApp number.
• Your website address, if you choose to add it.
• The service, sector or medical specialty you are interested in, your main priority and how you prefer to be contacted.
• Anything you write in the message or notes field.

If you contact us directly by WhatsApp, phone or email, we receive your number or email address and the content of the conversation.

Please don't send us patient records, health information or other sensitive personal data through our forms. Business details are all we need to prepare for a first conversation.

Information recorded when you send a form

• The page you sent it from, including any campaign tags in its address (such as UTM parameters or an ad click identifier), so we know which page or campaign brought your request.
• Your IP address, and the date and time of the request.
• A score from Google reCAPTCHA that estimates whether the request came from a person or an automated program.

Information collected while you browse

Like most websites, ours relies on a few technologies that collect technical information automatically, such as your IP address, device and browser type, the pages you view and the links you click. The section on cookies explains which ones we use and why.

• To answer your request, arrange a call and prepare a proposal.
• To follow up on the conversation you started with us, through the channel you prefer.
• To understand which pages, campaigns and services bring us enquiries, so we can improve the website and what we offer.
• To measure how our advertising performs and show it to people who are more likely to find it useful.
• To protect our forms and systems from spam, fraud and misuse.
• To meet our legal obligations, and to establish or defend legal claims where needed.

We do not sell personal information, and we don't make decisions about you based solely on automated processing. We will not add you to a marketing mailing list without your agreement.

Depending on the situation, we rely on one or more of the following:

• Your request: when you ask us to contact you or prepare a proposal, we need your details to take the steps you asked for before any agreement.
• Our legitimate interests: running and securing the website, understanding how people find us and measuring our advertising, in ways that respect your rights and reasonable expectations.
• Your consent: where the law requires it, for example for certain cookies. You can withdraw it at any time, without affecting anything done before.
• Legal obligations: when the law requires us to keep or disclose information.

Cookies are small files that a website stores in your browser. Our website does not set cookies of its own to work. The cookies below come from the two services we use, and the last row is a small preference our site keeps in your browser:

Meta Pixel

Meta Pixel starts only after your first interaction with a page (a scroll, a tap or a key press) or a few seconds after the page has loaded. It tells Meta which pages you view, when you tap one of our WhatsApp, phone or email links, and when a request is sent successfully. We don't include your name, phone number or message in what it sends. Meta's automatic event detection may also note which buttons you click, but not what you type into our forms, and Meta may combine this information with what it already knows about you under its own policy.

Google reCAPTCHA

reCAPTCHA loads only when you start filling in one of our forms. It looks at technical signals, such as how you interact with the page, and Google returns a score that helps us reject automated submissions. Its use is governed by Google's Privacy Policy and Terms of Service.

Your choices

• You can block or delete cookies in your browser settings, or use a browser or extension that blocks tracking.
• You can control how Meta uses your activity for advertising in the ad settings of your Facebook or Instagram account.
• If reCAPTCHA is blocked, our forms may not send. You can still reach us by WhatsApp, phone or email.

Your information is handled by our team and by a small number of service providers who help us run the website. Each one receives only what it needs for its role:

• Hostinger, which hosts our website, our application server and the database where requests are stored.
• Google, which provides reCAPTCHA spam protection.
• Meta, which provides Meta Pixel for advertising measurement, and WhatsApp if you choose to message us there.

Google and Meta also use the information they receive under their own privacy policies, linked below.

Within ONXCODE, requests are visible only to team members who need them, through personal accounts with role-based permissions.

We may also disclose information when the law, a court or a competent authority requires it, to protect our rights or the safety of others, or to a successor if ONXCODE is merged or acquired, in which case your information remains protected by this policy.

• Google Privacy Policy(opens in a new tab)
• Google Terms of Service(opens in a new tab)
• Meta Privacy Policy(opens in a new tab)
• WhatsApp Privacy Policy(opens in a new tab)
• Hostinger Privacy Policy(opens in a new tab)

Our service providers run data centres in several countries, so your information may be stored or processed outside the country where you live, including in Europe and the United States. When that happens, we rely on the safeguards these providers offer and take reasonable steps to keep your information protected to a comparable standard.

We keep your request and the related correspondence for as long as we need them to respond, follow up and keep a record of our discussions. If you become a client, the information becomes part of our client records and is kept for the length of our relationship and any period the law requires afterwards.

When we no longer need information, we delete it or anonymise it so that it can no longer identify you. Information collected by Meta and Google is kept under their own policies.

We use technical and organisational measures suited to the information we hold, including:

• Encrypted connections (HTTPS) for every page of the website and every form submission.
• Access to requests limited to authorised team members, through personal accounts and role-based permissions.
• Spam and abuse protection on every form.

No website or online service can be guaranteed to be completely secure. If we ever learn of a breach that affects your information, we will act promptly and inform you and the relevant authorities where the law requires it.

Depending on where you live and the law that applies to you, you may have the right to:

• Ask whether we hold information about you, and receive a copy of it.
• Have inaccurate or incomplete information corrected.
• Have your information deleted.
• Object to how we use it, or ask us to limit it.
• Withdraw any consent you have given.
• Receive your information in a portable format, where this applies.

To make a request, email hello@onxcode.io or message us on WhatsApp. We may ask you to confirm your identity first, and we will reply as soon as we can and within the time the law allows. Reasonable requests are free of charge.

If you are not satisfied with our answer, you can contact the data protection authority in your country.

Our website and services are meant for businesses and professionals. They are not directed at anyone under 18, and we do not knowingly collect information from children. If you believe a child has sent us personal information, please contact us and we will delete it.

When we build, host or maintain a system for a client, such as a clinic system that holds patient records, the client decides what information it holds and how it is used. We handle that information only to deliver the agreed work, on the client's documented instructions, under our contract and a non-disclosure agreement (NDA). Questions about that information should go to the organisation that runs the system.

Our website links to services we don't control, such as WhatsApp, Facebook, LinkedIn and Google. When you follow those links, that service's own privacy policy applies.

We may update this policy as our website, our services or the law change. The date at the top of this page shows the current version, and any significant change will be made clearly visible here.