This Cordex-Terminology Privacy & Data-Flow Statement forms part of the Cordex-Terminology EULA.
Scope & roles
This statement explains what data Cordex-Terminology stores, where it goes, and who is responsible for it. It forms part of the Cordex-Terminology EULA and supplements our Privacy Policy.
For Customer Data, you decide what is collected and why, and you are responsible for it under privacy law. We are the provider of the Software. We operate the hosted service and handle account, key and request data as described below.
What is stored, and where
- Our service (Microsoft Azure, Australia): your account, API keys (hashed), OAuth clients, usage counts and request logs.
What reaches us
We receive each API request, including the endpoint, parameters, time, your key or client identifier and the calling IP address. We use this to run, secure, rate-limit and bill the service.
Third parties
- Microsoft Azure: hosting, in Australian regions.
- Key-Warden: licensing and billing.
- Stripe or PayPal: payment.
Each third party handles data under its own terms and privacy policy.
Security
We design the Software to keep Customer Data in your environment, use encrypted connections, sign licence tokens, and avoid storing secrets in the browser. You are responsible for the security of your devices, servers, tenants, accounts, keys and backups, and for the access you grant.
Retention & deletion
You control how long Customer Data is kept in your environment. When your subscription ends, your keys and OAuth clients stop working. Codes you have already stored in your own systems remain yours to keep, subject to the source licences.
We keep licence, account and billing records for as long as needed to provide the service and meet legal obligations (generally 7 years for tax records), then delete or de-identify them.
Your obligations
You must have a lawful basis and any required consents for the data you record, give any required notices, respond to access and correction requests, and meet the Australian Privacy Principles and any health records or sector laws that apply to you. You are responsible for checking codes are fit for your clinical or business use, and for holding the terminology licences that apply in your country.
Overseas disclosure
Data in your environment stays where you host it. Our licensing and account records are held in Microsoft Azure in Australia. Payment providers and any AI provider you choose may process data overseas under their own terms.
Contact
MYITANDAPPS PTY LTD · ABN 82 659 633 888 · PO Box 7570, Redland Bay QLD 4165, Australia
Email: cordex-terminology@myitandapps.com.au