Privacy Policy

Data Stewardship

How we handle your workspace information.

Last updated: 26 August 2026

By creating an account or using armarium, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with how we handle personal data as described here, you should not use the service. This Privacy Policy forms part of, and should be read alongside, our Terms and Conditions and our Cookie Policy.

1. Who We Are

armarium is operated by:

MedPort Technologies Limited
Company number: 17284812
Registered office: 88 Whateley Crescent, Birmingham, England, B36 0DP

MedPort Technologies Limited is the data controller responsible for your personal data under the UK GDPR and the Data Protection Act 2018, and is registered with the Information Commissioner’s Office (ICO) under registration number ZC212038.

If you have any questions about this policy or your data, contact us at admin@medporttechnologies.com. We have not appointed a formal Data Protection Officer, as we are not required to do so, but the above contact will handle all data protection queries.

2. Information We Collect

2.1 Information you provide directly:

• Name, email address, and institution or affiliation (for account registration and communication);
• Password, stored only as a salted cryptographic hash — we cannot view your password;
• Research workspace content you choose to enter or upload, such as paper titles, abstracts, manuscript links, keywords, notes, submission and review status, conference and presentation materials (including uploaded poster or slide files), calendar deadlines, ideas, and discussion posts;
• Details of co-authors and collaborators you add to a paper or workspace, such as names, email addresses, institutional affiliations, and ORCID identifiers;
• Email addresses of collaborators you invite to a shared paper or workspace;
• Correspondence you send us, such as support requests.

2.2 Other people’s information you provide to us.

armarium is a collaborative tool, so some of the information above — for example, a co-author’s name and email address, or an invited collaborator’s email address — is personal data about someone other than you. When you add this information:

• you act as the data controller for that information, and you are responsible for ensuring you have a lawful basis (such as a legitimate professional relationship, or their consent) to share it with us and to have it processed within armarium;
• we act as a data processor on your behalf for that specific information, storing and displaying it only to enable the collaboration and communication features you use;
• you must not upload special category data (for example, data revealing health, race, religion, or sexual orientation) about any third party, or any information you are not lawfully entitled to share, including patient data or other confidential third-party records unrelated to your own authorship or research administration.

2.3 Automatically collected information:

• Basic technical information (such as IP address, browser type, device type, and request timestamps), collected automatically by our hosting and security infrastructure to maintain security, prevent abuse, and diagnose faults;
• we do not currently use analytics, advertising, or tracking cookies — see our Cookie Policy for full details of the strictly necessary cookies we do use.

3. How We Use Your Data

• To create, authenticate, and manage your account;
• To store, sync, and display your workspace content, including to collaborators you have explicitly invited or added;
• To enable collaboration features such as shared papers, task assignment, and discussion threads;
• To send account-related communications (for example, password reset links or collaboration invitations);
• To respond to support requests;
• To maintain the security, integrity, and performance of the Service;
• To comply with our legal obligations.

We do not use your data for advertising, and we do not sell, rent, or trade your data to third parties.

4. Legal Basis for Processing

• Contract: processing necessary to provide the Service you’ve registered for (account management, workspace storage, collaboration features).
• Legitimate interests: maintaining security, preventing fraud or abuse, diagnosing technical issues, and improving the Service, balanced against your rights.
• Consent: where you ask us to share information at your instruction (for example, inviting a named collaborator), and for any optional communications you opt into.
• Legal obligation: where we must retain or disclose data to comply with the law.

5. How Your Data Is Stored

• Your account data and workspace content (papers, tasks, discussion posts, calendar entries, and related records) are stored in a Postgres database hosted by Neon, Inc.
• Uploaded files, such as conference posters and presentation materials, are stored using Cloudflare R2 object storage.
• The armarium website and application are hosted and served via Cloudflare’s global network.
• Passwords are hashed using an industry-standard salted hashing algorithm and cannot be viewed by us in plain text.
• We use encryption in transit (HTTPS/TLS) and access controls to protect data moving between your device and our infrastructure, and take reasonable technical and organisational measures to protect data at rest against loss, misuse, or unauthorised access.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes. We share data only where necessary, with:

• Infrastructure and service providers: Neon, Inc. (database hosting) and Cloudflare, Inc. (application hosting and file storage), each acting as a data processor under contract;
• Other users you invite or add: information you enter about a paper — including co-author details and discussion content — is visible to other members of that paper’s workspace, according to the roles and permissions you set;
• Legal authorities: where required by law, court order, or a valid request from a competent authority.

All third-party processors we use are required by contract to protect personal data to a standard consistent with the UK GDPR.

7. International Data Transfers

Some of our service providers, including Neon and Cloudflare, may process data on servers located outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on a UK adequacy regulation, so that the recipient offers an adequate level of data protection.

8. How Long We Keep Your Data

• We retain your data for as long as your account remains active, or as long as necessary to provide the Service.
• If you delete your account, your personal data, workspace content, and uploaded files will be permanently deleted within 30 days, except where retention is required by law, or where content remains part of a shared workspace that another user (for example, a co-author) continues to own and use — in which case your personal involvement will be removed or anonymised where reasonably practicable.
• Backup copies are retained for a limited period for disaster-recovery purposes and are deleted on a rolling basis.

9. Your Rights

Under the UK GDPR, you have the right to:

• Access a copy of your personal data;
• Correct inaccurate or incomplete information;
• Request deletion of your data (the “right to be forgotten”);
• Restrict or object to certain processing;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Request transfer of your data to another service (data portability);
• Lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, contact admin@medporttechnologies.com. We will respond within one month, as required by law. Where a request concerns personal data about a third party (for example, a co-author) that you added, we may need to verify the request with you or, where appropriate, direct the individual to contact you directly as the relevant controller.

10. Security

We take reasonable technical and organisational steps designed to protect your personal data, including encrypted transport, hashed credentials, and access controls limiting who can view workspace content to the account holder and any collaborators they have explicitly added. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children’s Data

armarium is intended for users aged 18 and over. We do not knowingly collect data from children. If we discover an account belongs to a minor, it will be deleted.

12. Data Breach Procedure

In the unlikely event of a data breach, affected users will be notified without undue delay in accordance with UK data protection law, and we will take appropriate remedial action. Where required, we will also notify the ICO within 72 hours of becoming aware of a breach.

13. Cookies

We use cookies and similar technologies limited to those strictly necessary for the Service to function, such as keeping you logged in. We do not currently use analytics, advertising, or tracking cookies. Full details are set out in our Cookie Policy.

14. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes to the Service or legal requirements. Any material changes will be notified on this page and, where appropriate, by email.

15. Contact

MedPort Technologies Limited
88 Whateley Crescent, Birmingham, England, B36 0DP
admin@medporttechnologies.com