Privacy Policy

Chestwise ("we", "us") provides a software tool for managing ship medicine-chest inventory, expiry tracking and comparison against requirements profiles defined by our customers. This policy explains how we process personal data when you use our website and application.

Controller contact: privacy@chestwise.com

• Account data: name, work email address, password (stored only in hashed form), role and organization.
• Security data: two-factor authentication settings, sign-in timestamps and audit log entries of actions you perform.
• Customer content: vessels, requirements profiles, inventory items, inspections, notes and uploaded files entered by your organization.
• Technical data: IP address, browser type and error logs needed to operate and secure the service.

We do not intentionally collect health data about crew members. Please do not enter patient or crew medical information into the application.

• To provide the service under our contract with your organization (Art. 6(1)(b) GDPR).
• To keep the service secure, maintain the audit trail and prevent abuse (legitimate interest, Art. 6(1)(f) GDPR).
• To meet legal obligations, e.g. accounting and tax (Art. 6(1)(c) GDPR).
• To send service emails such as account confirmation, password reset and team invitations.

For data your organization enters into the application, your organization is the data controller and we act as a data processor, processing it only on your organization's instructions.

If you use the optional follow-up suggestions, the inspection notes and issue list you submit are sent to an AI model provider solely to generate the suggestions. The suggestions are not stored by us and are not used to train models.

We use trusted service providers for hosting, database, authentication, file storage, email delivery and AI processing. They process data only on our behalf under data processing agreements. We do not sell personal data.

Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

Account and customer data are kept for as long as your organization's account is active. After termination, data is deleted or anonymized within a reasonable period, unless we must keep it longer by law. Audit records are retained as part of the organization's records.

Data is encrypted in transit, access is restricted per organization, and sensitive actions are recorded in an append-only audit log. Two-factor authentication is available for every account.

You have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). To exercise your rights, contact us at the address above.

We use only cookies and local storage that are strictly necessary for signing in and remembering your interface settings. We do not use advertising cookies.

We may update this policy. Material changes will be announced in the application or by email.