Privacy Policy
Effective 17 September 2026. This policy explains how FUSION CELL COMPANY LIMITED ("TraceVial", "we") handles personal data in connection with our website, our signup process and the TraceVial platform.
1. The two roles, and why the distinction decides everything below
TraceVial handles personal data in two separate capacities, and which one applies decides who you ask, what your rights are, and which document governs.
| We are the controller | We are the processor | |
|---|---|---|
| The data | Visitors to our website; people who fill in the signup wizard; the account and contact details of the people who administer and use a Workspace; support and sales correspondence; security and billing records | Everything a customer puts into its Workspace: specimen and inventory records, attributes, project and task data, uploaded files, and whatever personal data those contain |
| Who decides why it is held | We do | Our customer does |
| Governed by | This policy | The Data Processing Addendum and the customer's contract with us — not this policy |
| Who to ask about it | support@tracevial.com | The customer whose Workspace holds it |
If you are a research participant or specimen donor, we are almost certainly not your controller. A laboratory that uses TraceVial decides what records to keep about you and why. We hold them on that laboratory's instructions and have no relationship with you. Ask the laboratory. If you contact us, we will pass the request to the relevant customer and tell you we have done so; we cannot answer it ourselves.
The rest of this policy is about the first column.
2. What we collect, and where it comes from
When you visit our website or sign up for a Workspace
| What | Where it comes from |
|---|---|
| Your name, email address, and the password you choose | You, in the signup wizard |
| Your organisation's name, and the Workspace address derived from it | You |
| Your answers to the signup questionnaire — organisation type, the biological materials you work with, what you want to manage first, how you manage data today, approximate sample volume, how many people will use the Workspace, and your compliance requirements | You |
| An invitation code, where you have one | You |
| A CAPTCHA result confirming the form was not submitted by a bot | Google reCAPTCHA, on our signup form |
| Email verification status and the timestamps around it | Our systems, as you confirm your address |
When you hold an account on a Workspace
| What | Where it comes from |
|---|---|
| Name, email address, and an employee code where your organisation uses one | Your organisation's administrator, or you |
| A password hash, and a hash of the signing PIN used for electronic signatures | Derived from what you set — we never store either in a readable form |
| Optional profile details: work email, company, department, job title, website, country, profile picture | You |
| Your role and group memberships, and your per-location inventory permissions | Your organisation's administrator |
| Your name, email and Google account identifier, where your organisation enables Google single sign-on | Google, when you choose to sign in with it |
When you use the platform
| What | Why it exists |
|---|---|
| Audit records of what you created, changed, or deleted, with your identity and a timestamp | Data integrity, and 21 CFR Part 11 |
| Electronic signature records, which include your IP address and browser user agent alongside your identity, the time, and the meaning of the signature | A signature has to be attributable, and to be shown afterwards to have been made by you |
| Server and application logs: request metadata, error traces, and IP addresses | Operating and securing the service |
When you contact us
Sales, demo, upgrade and support requests, with whatever you put in them, and our correspondence.
We do not use advertising or cross-site tracking technology, run third-party advertising networks, or build marketing profiles from platform activity.
3. Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Creating and running your Workspace and account; authenticating you | Performance of a contract |
| Verifying your email address and stopping automated signup abuse | Legitimate interests — keeping the service usable and secure |
| Providing support, and responding to sales, demo and upgrade requests | Contract, or legitimate interests before one exists |
| Keeping audit and electronic signature records, including the IP address a signature was made from | Contract; and legal obligation where our customer is subject to Part 11 or an equivalent |
| Securing the service: logging, rate limiting, investigating abuse | Legitimate interests |
| Billing, tax and accounting records | Legal obligation |
| Service announcements about availability, security and changes | Contract, or legitimate interests |
| Marketing email to business contacts who asked to hear from us | Consent, or legitimate interests where the law allows for business contacts |
| Understanding how the product is used, in aggregate, to improve it | Legitimate interests |
We do not sell personal data, and we do not share it for cross-context behavioural advertising, as the California Consumer Privacy Act uses those terms. We do not use your personal data or Customer Data to train machine learning models.
Sensitive data. We do not intend to hold health or genetic data in our own right. Such data can exist inside a customer's Workspace — that is processor-role data, governed by the DPA, and the customer is responsible for meeting whatever conditions its own law places on that category.
4. Who we share it with
Sub-processors and service providers. We use a small number of vendors to run the service. Each is bound by contract to process personal data only on our instructions and to protect it. Those that handle personal data are listed, with their role and location, in Annex III of our Data Processing Addendum.
Your own organisation. If you use a Workspace, your organisation's administrators can see your account details and your activity in it. Your organisation, not you, controls that Workspace.
Others, in specific circumstances: professional advisers under confidentiality; an acquirer in a merger, acquisition or asset sale, on notice to you; law enforcement or a regulator where we are legally required, having first satisfied ourselves the request is valid and, where we are lawfully able, told the affected customer.
5. Where it is held, and international transfers
The platform is hosted on Amazon Web Services in AWS ap-southeast-1 (Singapore). Each customer Workspace has its own isolated database schema and its own storage bucket.
We are established at 27/147 Xuan Dinh Street, Xuan Tao Ward, Hanoi, Vietnam (Enterprise Registration No. 0111184391), and our staff reach your data from there to operate and support the service — so data hosted in AWS ap-southeast-1 (Singapore) is reached from Vietnam, which is a cross-border transfer under several regimes in the region and is disclosed here for that reason. Our sub-processors and where they operate are listed in DPA Annex III, and the measures protecting data in transit and at rest are in DPA Annex II.
If the law of your country requires a particular instrument before personal data may be sent to ours, tell us at support@tracevial.com before you sign: §10 of our Data Processing Addendum says what we will and will not enter into, and we would rather agree it than assume it.
6. How long we keep it
| What | How long |
|---|---|
| An account on a live Workspace | For as long as the Workspace is live and the account is active. Accounts are deactivated rather than deleted while audit and signature records reference them — a signed record must keep the identity of its signer for that signature to mean anything |
| An abandoned signup that was never confirmed | Swept automatically after its token expires |
| Audit trail and electronic signature records | For the life of the Workspace. Our packages do not time-limit audit retention, because a Part 11 record that has been aged out is not a record |
| Server and security logs | 90 days |
| Sales, demo, upgrade and support correspondence | 24 months after the last contact |
| Billing, tax and accounting records | As tax law requires, typically 7 years |
| Customer Data after a subscription ends | Per §14 of the Terms of Service: a retrieval window, then deletion |
7. Your rights
Subject to the law that applies to you, you may ask us to: give you access to your personal data and a copy of it; correct it; delete it; restrict or object to a processing activity; give it to you or another controller in a portable format; and withdraw a consent you gave, without affecting what was done before.
California residents may additionally ask what categories we collected, used and disclosed and for what purpose, ask us to delete or correct it, and are entitled not to be discriminated against for exercising a right. We do not sell or share personal data, so there is no opt-out to exercise. An authorised agent may make a request on your behalf with proof of authorisation.
In Singapore, Japan, South Korea, Vietnam, Australia and New Zealand, the rights above are the ones the local regime gives you — the Personal Data Protection Act 2012, the Act on the Protection of Personal Information, the Personal Information Protection Act, Decree 13/2023/ND-CP and the Law on Personal Data Protection, the Privacy Act 1988, and the Privacy Act 2020 respectively. What those regimes require of us when we handle a customer's data on its instructions is set out in §15 of our Data Processing Addendum.
Ask at support@tracevial.com. We will respond within the period the law requires — 45 days under the CCPA, and whatever period applies where you are — and may need to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.
Two limits worth stating plainly.
A request about data in a customer's Workspace goes to that customer, not to us (§1). We will forward it and say so.
An audit or electronic signature record cannot be erased or altered, by us or by our customer. That is the point of it: it exists to show what happened and who did it, is protected by integrity checking, and is frequently a legal obligation of the laboratory that holds it. Where the law gives you an erasure right, that right is subject to the exemptions for compliance with a legal obligation and for establishing or defending legal claims, and we will explain which applies rather than silently refusing.
Complaints. You may complain to the data protection regulator where you live. We would rather you came to us first at support@tracevial.com. We have not appointed a Data Protection Officer.
8. Cookies and similar technologies
We use a small number of strictly necessary cookies. We do not use advertising or cross-site tracking cookies, so there is no tracking consent banner and nothing to opt out of.
| Cookie | Purpose |
|---|---|
| Session cookie | Keeps you signed in. Marked Secure and HttpOnly, and SameSite=Lax so that a return from an identity provider works |
| CSRF token | Protects form and API submissions against cross-site request forgery. Marked Secure |
| reCAPTCHA | Set by Google on the signup form, to distinguish a person from a bot. Governed by Google's privacy policy |
| Preference storage | Your browser stores interface preferences — a chosen theme, an open panel — locally. These never leave your browser |
9. Security
The technical and organisational measures we maintain are described in Annex II of our Data Processing Addendum. They include isolating each customer's workspace, encrypting data in transit and at rest, role-based access control, audit logging and automated backups.
No system is completely secure. We take measures appropriate to the risk, and we cannot guarantee that personal data will never be accessed, disclosed, altered or lost. Keeping your credentials and signing PIN confidential is part of what protects your account.
Report a suspected vulnerability or a compromised account to support@tracevial.com.
10. Children
The platform is a business tool, not directed at children, and we do not knowingly collect personal data from anyone under 16 in their own right. A customer's Workspace may hold records about donors of any age; that is processor-role data and the customer's responsibility.
11. Changes
We may update this policy as the service and the law develop. We will post an updated policy here with a new effective date, and for a material change we will notify account holders by email or in the product before it takes effect. Continuing to use the service after a change takes effect means the updated policy applies.
12. Contact
FUSION CELL COMPANY LIMITED, 27/147 Xuan Dinh Street, Xuan Tao Ward, Hanoi, Vietnam (Enterprise Registration No. 0111184391). Privacy enquiries and data subject requests: support@tracevial.com. Security: support@tracevial.com.
© 2026 TraceVial™. All Rights Reserved.