Privacy

Privacy Policy

Last updated: 16 July 2026

Rucja Health takes privacy seriously. This policy covers our public marketing site at rucja.io. Patient data handled inside the Rucja product platform for hospitals is governed separately by the Business Associate Agreement and Data Processing Agreement between Rucja and each hospital customer.

Who we are

Rucja Health is a product of Hireqed, providing hospital and clinic software for oncology and integrative care teams. When we talk about "we", "us" or "Rucja" in this policy, we mean the operator of rucja.io and app.rucja.io. Contact for privacy questions: info@rucja.io.

What this policy covers

This policy applies to visitors to the rucja.io marketing site, and to prospective customers who submit an enquiry through the contact form. Patients whose data is stored in the Rucja product on behalf of a hospital should refer to their hospital's privacy notice. We process patient data only as a data processor for the hospital that operates the instance.

Information we collect

Information you give us

  • Enquiry form: name, work email, hospital or clinic name, phone number (optional), and the message you send us. Used to reply to your enquiry and, if you become a customer, to set up onboarding.
  • Email and phone: anything you send by email or over the phone as part of a sales or support conversation.
  • Product accounts: if you sign into the Rucja doctor, patient, or admin portals, we collect the account information you supply plus usage data required to run the product. This is covered by the customer agreement rather than this marketing-site policy.

Information collected automatically

  • Log data: web server logs record the request URL, IP address, referrer, browser user-agent, and timestamp. Used for security, abuse investigation, and troubleshooting. Rotated on a rolling window.
  • Analytics: if you accept the cookie banner, we load Google Analytics 4 to measure pages viewed, referrers, approximate location (country / city), device type, and events like scroll depth. See the Cookie Policy for the list of cookies set.
  • Consent Mode v2:before you decide on the banner, we run Google Consent Mode v2 with all storage set to denied. No analytics or advertising cookies are written during this period. Your decision is stored in your browser's localStorage under the key rucja-cookie-consent.

How we use your information

  • Reply to enquiries and route them to the right team.
  • Set up demos, trials, and customer onboarding.
  • Send occasional service and product-update emails to customers.
  • Measure whether the marketing site is helpful and where it can be improved.
  • Detect and prevent abuse and security incidents.
  • Comply with legal obligations (accounting, tax, response to lawful requests).

Lawful bases we rely on (GDPR / UK GDPR)

  • Consent: non-essential cookies (analytics, advertising) rely on the consent you give via the cookie banner. You can withdraw consent at any time by clearing the stored decision in your browser and reloading, or by rejecting the banner on the next visit.
  • Legitimate interests: replying to your enquiries, running our website, and preventing abuse. We balance our interest in operating a business against your right to privacy on a case-by-case basis.
  • Contract: data required to onboard and support you as a customer once a contract is in place.
  • Legal obligation: where we must retain records for tax, audit, or law enforcement purposes.

Who we share information with

We do not sell personal information. We share it only with the service providers we need to run the site and reply to enquiries, and only for the purpose they were engaged.

  • Zoho Desk: our support and sales ticketing system. Contact-form submissions land as tickets in Zoho Desk. Zoho acts as a sub-processor.
  • Google Analytics 4: pseudonymous usage analytics, only after you accept the cookie banner. IP anonymisation is applied by Google.
  • Amazon Web Services / CloudFront: hosting and content delivery for site assets and dashboard-served blog images.
  • Payment processors, auditors, professional advisers: only as needed and under confidentiality obligations.
  • Government or law enforcement: if compelled by valid legal process and only to the extent required.

International transfers

Some of our sub-processors (for example Google Analytics) are based outside your country of residence. Where transfers happen out of the UK / EEA, we rely on Standard Contractual Clauses or equivalent safeguards published by the relevant regulator.

How long we keep information

  • Enquiry-form submissions: retained in Zoho Desk for as long as needed to reply and to track the sales relationship, then archived. Archived tickets are purged on a defined schedule.
  • Web server logs: rotated on a rolling window (typically 30 to 90 days).
  • Analytics data: retained in Google Analytics for the retention window configured on the property (default 14 months).

Your rights

Depending on where you live, you have some or all of the following rights over personal information we hold about you:

  • Access a copy of your data.
  • Correct data that is wrong or out of date.
  • Delete data (subject to our legal retention obligations).
  • Object to or restrict processing based on legitimate interests.
  • Withdraw consent for cookie-based tracking.
  • Port a copy of data you provided to us to another service.
  • Complain to your local data protection authority.

To exercise any of these rights, email info@rucja.io. We reply within a month; if the request is complex we may extend by two further months and tell you why.

Security

We hold personal information under access controls, encrypt data in transit and at rest, and maintain audit logs on the product platform. See the Security page for detail on how the product is built.

Children

The marketing site is not directed at children. We do not knowingly collect information from anyone under 16 through the marketing site. Patient data handled by the product on behalf of hospitals may include minors, but that processing is governed by the hospital's own privacy notice and the customer agreement, not by this policy.

Changes to this policy

We update this policy when the way we handle information changes. The "Last updated" date at the top reflects the most recent change. For material changes that affect your rights, we will surface a notice in the product or on the site.

Contact us

Email info@rucja.io for privacy questions, subject-access requests, or complaints. For general questions about Rucja Health, email info@rucja.io.