Privacy policy.
How Tulparus handles personal data on this website, in the pilot programme and in the product.
Who we are
Tulparus is operated by GetClinic Inc., a Delaware corporation. For this website and for enquiries, GetClinic Inc. is the data controller.
What this covers
This policy covers three settings: people who visit tulparus.ai, people who ask for access or take part in the pilot programme, and the product used by customer organisations.
In the product, your organisation decides what patient data is entered and why. Your organisation is the controller of that data and Tulparus acts as its processor under a data-processing agreement. Where this policy and that agreement differ, the agreement applies to product data.
Data we collect on this site
We collect as little as the site needs. We do not sell personal data and we do not use advertising trackers.
Patient data
No patient data is collected through this website or the request access form. Please do not put it in a message to us.
Inside the product, patient data is entered by your organisation and kept in your organisation’s own data space. Other organisations cannot read it. We use it only to provide the service to you.
Case data is not used to train models by default. It can enter a training set only if your organisation has agreed to that in a recorded agreement, and then only after each case passes eligibility and de-identification checks.
Why we may use it
Under the GDPR, the UK GDPR and Turkish law (KVKK), we need a lawful ground for each use. Ours are:
- Answering your request and running the pilot programme: our legitimate interest in doing so, or steps taken at your request before an agreement.
- Analytics, session recordings and error reports: your consent, which you can withdraw at any time.
- Keeping the site secure and preventing abuse: our legitimate interest.
- Product data: the data-processing agreement with your organisation, which sets out its instructions to us.
- Records we must keep by law: legal obligation.
Who we share it with
We use these providers to run the site. Each acts on our instructions, apart from where noted.
The product runs on Amazon Web Services. We may also disclose data where the law requires it, or to professional advisers under a duty of confidence.
Transfers outside your country
GetClinic Inc. and most of the providers above are in the United States. When personal data leaves the EEA, the UK or Turkey, we rely on the safeguards the law provides, such as standard contractual clauses, the UK addendum or a provider’s participation in the EU–US Data Privacy Framework. Ask us if you want to see which one applies.
How long we keep it
Your rights
You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. You can withdraw consent at any time with . Write to [email protected] and we will reply within one month.
If your data is in the product on behalf of your organisation, please contact your organisation first. We will help it answer you.
You may also complain to your data protection authority: in the EEA the authority of your country, in the UK the Information Commissioner’s Office, in Turkey the Personal Data Protection Authority (KVKK).
Security
Data is encrypted in transit and at rest. Access in the product is role based and logged, and each organisation’s data is kept apart from every other’s. The Security and compliance page has the detail.
Children
This site is for professionals. It is not directed at children, and we do not knowingly collect their data through it.
Changes
We will post changes here with a new date. If a change materially affects pilot participants or customers, we will tell them directly.