Privacy Policy

This Privacy Policy explains how OneXPro LLC (“OneXPro”, “we”, “us”) handles personal data when you visit our website, contact us, or use the OneXPro QMS (Change Control) and Controlled Spreadsheet Review services (the “Services”). It is written to meet the transparency requirements of the EU and UK General Data Protection Regulation (GDPR), India's Digital Personal Data Protection Act, 2023 (DPDP Act) and comparable laws, and to be consistent with the record-keeping obligations of our pharmaceutical customers.

1. Who we are

OneXPro LLC develops and operates the Services for pharmaceutical and life-science companies. You can reach us about anything in this policy at support@onexpro.com.

2. Controller and processor

Website and enquiries. For personal data collected through this website and the contact form, and for business contact details of our customers and prospects, we act as controller (a “data fiduciary” under the DPDP Act).
Customer data in the Services. For the records our customers create in the Services — change controls, workbooks, signatures, audit trails and their users' accounts — the customer company is the controller (data fiduciary) and we act as its processor, processing that data only on its documented instructions under our agreement with it. If you are a user of the Services, your employer decides what is recorded and how long it is kept; please direct requests about that data to your company administrator first.

3. What we collect

When you visit our website or contact us

Contact form: your name, work e-mail, company, phone (optional), the topic and your message, and the date and time it was sent.
Technical data: your IP address (used to prevent abuse of the contact form) and standard server logs kept by our hosting provider (IP address, browser type, pages requested, time).

We do not use analytics, advertising or tracking cookies on this website.

When you use the Services

Account data: name, username or e-mail address, designation, department, the features you may use, account status, and password-management events (for example, when a temporary password was issued or reset). Passwords are handled by our authentication provider and are never visible to us or to your administrators.
Electronic signature data: for each signature, your user ID, printed name, login ID, designation and department at that moment, the meaning of the signature, the decision taken, and the date and time.
Records and content: the content your company enters — change control forms, attachments, spreadsheets, comments, reviews — together with the audit trail of who did what and when, including previous and new values.
Security data: sign-in attempts and lockouts, and the account audit trail (accounts created, passwords reset, permissions changed).
Principal parties (your clients): when a customer sends a change control for review by e-mailed link, we process the recipient's name, e-mail address and organisation, the one-time code sent to them, their typed name, decision and comments, and the IP address and browser used when signing.
Notifications: in-app notifications and, where configured, e-mails telling you that a step is waiting for you.

4. How we use it and why

To answer your enquiry and, if you ask, arrange a demonstration — based on your consent and our legitimate interest in responding to business enquiries.
To provide the Services — authenticating users, enforcing access rights, recording signatures and audit trails, sending notifications — to perform our contract with the customer, on its instructions.
To keep the Services secure — detecting and preventing abuse, account lockout, investigating incidents — based on legitimate interests and legal obligations.
To support our customers' regulatory obligations — such as 21 CFR Part 11 and EU GMP Annex 11 requirements for attributable, complete and enduring records.
To meet our own legal obligations — for example accounting, tax, and responding to lawful requests from authorities.

We do not sell personal data, do not use it for advertising, and do not use customer content to train AI models.

5. Regulated records and electronic signatures

The Services exist to create records that regulators require to be complete, unalterable and retained. This shapes how some rights apply:

Signed records, signatures and audit-trail entries are not edited or deleted, by design. A correction is made by a new, attributable entry, never by changing history.
When a user leaves, their account is disabled, not deleted, so their past signatures continue to show who signed them.
Requests to erase or correct data contained in GMP records are therefore assessed by the customer (the controller) against its legal retention obligations; data that must be kept by law will be kept, and access to it restricted.

6. AI-assisted drafting

The Change Control service offers an optional “Generate / Rewrite with AI” function. When a user chooses it, the relevant text from that record is sent from our servers to a large-language-model provider through our AI routing provider to produce a draft. The draft is returned to the user only; nothing is saved until the user saves it, and AI never signs. We send only what is needed for the draft, and our requests are routed only to model providers that do not collect the data for their own use. Users who do not choose AI drafting send nothing to these providers.

We share personal data only with service providers who process it on our behalf under written agreements, and only as needed:

Google Cloud / Firebase — hosting, authentication, databases and file storage.
AI routing and model providers — only when a user chooses AI drafting (see section 6).
E-mail delivery provider — to deliver notifications, principal-party links and replies to enquiries.

We may also disclose data where required by law, to protect the rights and safety of our customers, users or ourselves, or as part of a merger or acquisition, in which case this policy will continue to apply. Within a customer company, records are visible to the users that company has authorised.

8. International transfers

Each customer's database and files are stored in the cloud region selected when the company is set up. Our service providers may process data in other countries. Where personal data is transferred across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and our providers' data processing terms, and we comply with any restrictions notified under the DPDP Act.

9. How long we keep it

Enquiries: for as long as needed to respond and follow up, and no longer than 24 months after our last contact unless you become a customer.
Customer data: for the duration of the customer's agreement, in line with the customer's retention instructions. GMP records are retained by design for the periods regulations require. At the end of the agreement, we return the customer's data in an agreed format and then delete it, except where law requires us to keep it.
Server logs: for the limited period set by our hosting provider for security and troubleshooting.

10. How we protect it

We apply technical and organisational measures appropriate to the sensitivity of regulated data, including a separate database and storage bucket for each customer, encryption in transit (HTTPS with HSTS) and at rest, server-side enforcement of every access rule, strong password policy and account lockout, re-authentication for every electronic signature, and audit trails of user and administrator actions. More detail is on our Compliance & Security page. If a personal data breach occurs, we will notify the affected customer without undue delay so that it can meet its own notification duties, and we will notify authorities and individuals where the law requires us to.

11. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you and obtain a copy;
have inaccurate data corrected and incomplete data completed;
have data erased, or its processing restricted (subject to section 5);
object to processing based on legitimate interests, and withdraw consent at any time (this does not affect processing before withdrawal);
receive your data in a portable format;
nominate another person to exercise your rights in the event of death or incapacity (DPDP Act);
complain to a data protection authority — for example your local supervisory authority in the EU/UK, or the Data Protection Board of India.

To exercise a right, e-mail support@onexpro.com or use our contact form. If your request concerns data in a customer's account, we will pass it to that customer and assist it in responding. We may need to verify your identity before acting, and we respond within the time limits set by applicable law.

12. Cookies and local storage

This website and the Services do not use advertising, analytics or tracking cookies. When you sign in, our authentication provider stores a session token in your browser's local storage so that you stay signed in, and we store your display preferences (such as light or dark theme). These are strictly necessary for the Services to work and are removed when you sign out or clear your browser data.

13. Children

The website and the Services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.

14. Changes to this policy

We may update this policy to reflect changes to the Services or the law. The date at the top shows when it was last changed. We will notify customers of material changes in advance through the Services or by e-mail.

15. Contact and grievances

For questions, requests or complaints about personal data, including grievance redressal under the DPDP Act, contact our privacy team at support@onexpro.com. We will acknowledge your message and work to resolve it promptly. If you are not satisfied with our response, you may complain to the relevant data protection authority.