Privacy Policy

C-O-G-S (Core Operations & Growth Systems) is operated by Next Gen Tech Platforms INC ("we", "us"). It is a business application used by medical device distributors and manufacturers to run sales orders, inventory, loaner trays, commissions and case scheduling.

C-O-G-S is not a consumer product. Accounts are created for people by the organization that employs or contracts them. If you are a patient whose information appears in C-O-G-S, we hold that information on behalf of the organization that put it there — see Patients below.

1. Who controls your information

For information about a customer organization's own business — its orders, its people, its patients — that organization is the controller and we are the processor. We handle that information under their instructions and under our agreement with them, not for our own purposes.

For information about the organization as our customer — the account, billing, support correspondence — we are the controller.

2. What we collect

Information about you as a user

• Name, work email address, job title, telephone number
• Your role and the organization you belong to
• Employment type, territory and reporting line, where your organization records them
• Payment details your organization holds for paying you commission, where it uses that feature

Information your organization puts into the system

• Sales orders, charge sheets, purchase orders, invoices and commission records
• Surgeons, hospitals, doctors' offices and manufacturers, and the contacts at them
• Inventory, loaner trays, implants, custody records and shipping information
• Documents uploaded to the library — contracts, pricing files, employment forms
• Messages and mentions in team chat

Protected health information

Where an organization uses the patient data features, C-O-G-S holds:

• The patient identifier (medical record number) read from a charge sheet
• The patient label image cropped from that sheet
• Date of surgery, procedure, operating surgeon and facility

Patient identifiers are stored separately from the rest of the order, in storage with its own access rules, and are visible only to the roles an organization has authorised. Copies of a charge sheet sent outside the organization have the patient label removed from the image before sending.

Information collected automatically

• IP address, browser and device type, and timestamps
• Records of signatures, approvals and custody handovers, including the IP address and browser used — these are recorded deliberately so a chain of custody can be relied on later
• Application logs and error reports

We do not use advertising trackers, we do not sell information, and we do not use third-party analytics that build profiles across other websites.

Camera and photographs

When you photograph or scan a document, the images go to your organization's records in C-O-G-S. We do not access your photo library except for images you choose.

Connected mailboxes

If you choose to connect your Google or Microsoft mailbox so that C-O-G-S can send on your behalf, we store an access token for that purpose. The permission requested is limited to sending. We do not read your mail, and you can disconnect at any time.

3. Why we use it

• To provide the application to the organization that engaged us
• To send the emails the application exists to send — orders to manufacturers, invoices to hospitals, reminders and statements
• To read handwritten charge sheets and labels automatically, where that feature is switched on
• To keep audit, custody and disclosure records
• To secure the service, investigate misuse and meet our legal obligations
• To bill the customer organization

We do not use customer data, and never patient data, to train machine learning models of our own.

4. Who we share it with

We use the following service providers. Each receives only what it needs to perform its function.

We also share information where we are required to by law, and we may transfer information as part of a merger or sale of the business, in which case the receiving party is bound by this policy or one no less protective.

We do not sell personal information and we do not share it for advertising.

5. Health information

Where a customer organization is a Covered Entity or a Business Associate under the US Health Insurance Portability and Accountability Act, we act as its Business Associate in respect of protected health information held in C-O-G-S, and handle that information under a Business Associate Agreement with that organization.

The safeguards built into the application include:

• Patient identifiers kept in separate storage with their own access rules
• Access limited by role, enforced by the database rather than only by the interface
• Automatic removal of the patient label from any copy of a document sent outside the organization
• An append-only record of every disclosure of a patient identifier — which cannot be edited or deleted
• Encryption in transit and at rest

6. Patients

If you are a patient, we hold your information on behalf of the hospital, surgeon or device company involved in your procedure. We cannot identify you to answer a request directly, and we are not permitted to disclose or amend records on our own initiative. Please contact the organization that treated you; they can reach us.

7. How long we keep it

We keep information for as long as the customer organization's account is active, and afterwards for as long as that organization instructs or the law requires. Audit, custody and disclosure records are deliberately append-only and are retained for the life of the account, because their value depends on their not being alterable.

8. Your choices

If you use C-O-G-S through your employer, your organization administers your account. Ask your administrator to correct, export or close it. We will help them do so.

Depending on where you live you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain uses. Write to us at the address below and we will route your request to the organization that controls the information, or handle it directly where we are the controller. We will not discriminate against you for exercising a right.

You can unsubscribe from reminder and digest emails using the link in those messages. Emails that form part of a transaction — an order sent to a manufacturer, an invoice — are not marketing and cannot be switched off individually.

9. Security

Information is encrypted in transit and at rest. Access is restricted by role and enforced at the database. Signing in uses a one-time code sent to your work email, or your organization's Google or Microsoft account. Administrative access by our staff is limited, recorded, and excludes patient identifiers.

No system is perfectly secure. If a breach affects your information we will notify the affected organization without undue delay, and will support the notifications they are required to make.

10. International transfers

C-O-G-S is operated from the United States and information is processed there. If you use it from elsewhere, you are sending information to the United States.

11. Children

C-O-G-S is a workplace application and is not directed at children. We do not knowingly create accounts for anyone under 18. Patient information may relate to a person of any age; it is held on behalf of the treating organization and is covered by the sections above.

12. Changes

We will post any change on this page and update the date at the top. Where a change is significant we will tell customer organizations directly.

13. Contact

Next Gen Tech Platforms INC
privacy@c-o-g-s.com