GDPR & Data Rights
Last updated: August 14, 2026
1. Controller and privacy contact
The controller is OphTrack. Send privacy requests and DPO-related enquiries to contact@ophtrack.com.
2. Your rights
Subject to the GDPR's conditions, you may request:
- access to personal data held about you;
- rectification of inaccurate or incomplete data;
- erasure of personal data;
- restriction of processing;
- objection to processing based on legitimate interests;
- portability of data processed by automated means on a contract or consent basis; and
- withdrawal of consent where consent is the legal basis.
3. Submitting a request
Email contact@ophtrack.com with the subject “GDPR request”. State the account email address and the right you wish to exercise. Do not send an identity document initially. OphTrack will request proportionate additional verification only where reasonably necessary to confirm identity.
4. Response period
OphTrack responds without undue delay and normally within one month. Where a request is complex or numerous, this period may be extended by up to two further months. You will be informed of an extension and its reasons within the original month.
5. Available controls
- Edit or delete individual surgery records in the application.
- Export your structured surgery log as CSV.
- Request account/profile export, correction, restriction, or deletion by email.
6. Accidental patient information
If you believe patient-identifying information was entered despite the product controls, stop using the affected entry and contact contact@ophtrack.com immediately. Include the OphTrack case code if available, but do not repeat the identifying information in your email.
7. Complaints
You may lodge a complaint with the French supervisory authority, the CNIL, through www.cnil.fr.