Privacy Policy

Last updated: 24 September 2026

1. Introduction

This Privacy Policy explains how Tactuum Ltd ("Tactuum", "we", "us", "our") collects, uses, and protects personal data in connection with Quris (the "Platform"), available at https://quris.com, including the organisation sites hosted on it and the Quris mobile apps for iOS and Android.

Quris is a software platform that lets client organisations ("Client", "your organisation") create, manage, and publish their own clinical guidelines. Many guideline pages are public, so you can use much of the Platform without an account. Please read section 3 carefully. It explains the difference between data Tactuum controls directly (such as account, usage, and analytics data) and the clinical guideline content that each Client organisation controls.

2. Who we are

Tactuum Ltd is registered in Scotland, UK.

Registered address: 280 St Vincent Street, Glasgow G2 5RL, United Kingdom Contact us.

Tactuum Ltd is the data controller for the purposes of this Privacy Policy, except where section 3 says otherwise.

3. Controller vs. processor: an important distinction

Personal data on Quris is handled in two different capacities:

• Tactuum as controller. Tactuum is the controller for visitor and usage data, account and sign-in data, feedback and support communications, cookies, and other data generated by use of the Platform itself. This Privacy Policy governs that data.

• Tactuum as processor. When a Client organisation uploads, enters, or manages clinical guidelines or related content on Quris, Tactuum acts only as a data processor for that content. That content may include personal data about the organisation's staff, patients, or service users. Tactuum processes it solely on the organisation's documented instructions. The organisation remains the data controller for that content. It is responsible for having a lawful basis to process it, for responding to data subject requests about it, and for its own privacy notices. The terms for this processing are in the Data Processing Agreement or contract between Tactuum and the organisation, not in this Privacy Policy.

• Organisation analytics. A Client organisation may add its own Google Analytics property to its pages on Quris. If you consent to analytics cookies, usage data from those pages is also shared with that organisation, which controls its own use of it.

If your data has been included in clinical guideline content by one of our Clients, please contact that organisation directly rather than Tactuum.

4. Personal data we collect

As controller, we may collect:

• Usage and device data: pages visited, searches, features used, timestamps, IP address, device and browser type, and similar diagnostic and log data. This is collected through server logs and Microsoft Azure Application Insights monitoring. It is also collected through Google Analytics, but only if you consent.

• Account and sign-in data: for users who sign in to restricted content or to manage content, this includes your name, work email address, organisation, and the identifiers and group memberships supplied when you sign in with your organisation's Microsoft account (Microsoft Entra ID).

• Feedback and communications: information you give us through the feedback form (such as your name, email address, and message) or when you contact us for support, sales enquiries, or a demo.

• AI search questions: where AI-assisted search is available, the questions you ask and the answers generated. These are kept as an audit trail (see section 8).

• Mobile app data: if you use the Quris mobile app and enable notifications, a device push-notification token.

• Cookies and similar technologies: as described in our Cookie Policy.

We do not intentionally collect special category data (such as health data) about identifiable individuals as controller. Please do not include patient-identifiable information in feedback or AI search questions. Any special category data within Client-managed guideline content is handled by Tactuum solely as a processor (see section 3).

5. How we use personal data and our legal basis

6. How we share personal data

We may share personal data with:

• Service providers and subprocessors who support the Platform, under contracts that require them to protect it appropriately. These include:

  • Microsoft: Azure hosting, Application Insights monitoring, Entra ID sign-in, and Azure AI services for AI-assisted search.

  • Google: Google Analytics (only with your consent) and Firebase Cloud Messaging for app push notifications.

  • Civic UK Ltd: CookieControl, our cookie consent provider (civicuk.com).

  • Fonticons, Inc.: Font Awesome, which serves the Platform's icons and receives your IP address when icons load.

• Client organisations: analytics data for their own pages, where you have consented (see section 3).

• Professional advisers and authorities where required by law or regulation, or to protect our legal rights.

• A successor entity in the event of a merger, acquisition, or sale of assets, subject to equivalent protections.

Some guideline pages embed third-party content chosen by the Client organisation, such as YouTube videos, Microsoft Forms, or Jotform forms. When you interact with that content, the third party processes your data under its own privacy policy.

We do not sell personal data.

7. International data transfers

Tactuum operates in the UK, US, and Canada, and some of our service providers (such as Google) process data outside the UK. Where personal data is transferred outside the UK or European Economic Area, we rely on appropriate safeguards, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum, to keep your data protected.

8. Data retention

• Account data is kept while your organisation's account is active, and for a reasonable period afterwards to meet legal, accounting, or reporting obligations or to resolve disputes.

• AI search transcripts are kept for 90 days and then deleted.

• IP addresses used for rate limiting are held in server memory only for the rate-limit window or block period, which is at most one hour, and are not stored in a database.

• Diagnostic and monitoring logs, including the IP address of any request that exceeds a rate limit, are kept for a limited period in line with our Azure retention settings.

• Google Analytics data is kept according to the retention setting on the relevant Analytics property.

• Client-managed guideline content is kept for the periods set out in the contract between Tactuum and the organisation.

9. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, in line with our information security policies. These measures include encrypted connections (HTTPS with HSTS) and access controls. They also include rate limiting: we use your IP address to count requests to features such as the feedback form, and we may temporarily block an IP address that sends too many requests. This protects the Platform from spam and abuse.

10. Your rights

If you are in the UK or EEA, you have the right to:

• Access the personal data we hold about you

• Request correction of inaccurate data

• Request erasure of your data

• Object to or restrict certain processing

• Request data portability

• Withdraw consent at any time, where processing is based on consent. For cookies, use the CookieControl icon on any page.

• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local supervisory authority

To exercise these rights, contact us here. If your request concerns clinical guideline content managed by a Client organisation, we will ask you to contact that organisation, as described in section 3.

11. Children's privacy

Quris is intended for healthcare professionals and the staff of Client organisations and is not directed at children. We do not knowingly collect personal data from children as controller.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated "Last updated" date.

13. Contact us

Tactuum Ltd 280 St Vincent Street, Glasgow G2 5RL, United Kingdom