How THREEVION handles your information.

01Introduction

This Privacy Notice describes how THREEVION Ltd ("THREEVION", "we", "us") handles personal information in connection with our website at threevion.com, the MYQER platform and its deployments, and any direct communication you have with us by email or otherwise.

THREEVION Ltd is the operating company. MYQER is our product, an emergency information access platform. Education, workforce and individual use are deployments of that same platform. We mention this because some of the practical detail in this notice depends on which deployment applies to you.

Sections 01 to 05 apply to everyone. Parts A to D then cover the specific deployments, so you can read only what applies to you.

We have tried to write this in plain English. If anything in this notice is unclear, please contact us at hello@myqer.com and we will explain.

02Who we are

THREEVION Ltd is a UK private limited company registered in England and Wales (Companies House number 16861658). We are registered with the Information Commissioner's Office as a data controller (registration ZC076886), which can be verified on the public ICO register.

We act as the data controller for personal information that we collect through this website, through direct enquiries, and through commercial conversations. For organisational deployments of MYQER we may act as a controller, a joint controller, or a processor depending on the data flow involved. Part B of this notice explains exactly which role applies in each case for the education deployment.

You can contact us at any time at hello@myqer.com.

03Your rights

Under UK GDPR and the Data Protection Act 2018, you have rights in relation to your personal information. These apply to all parts of this notice. You have the right to:

• Be informed about what we do with your information (this notice is part of how we do that).
• Access the information we hold about you.
• Rectify information that is inaccurate or incomplete.
• Erase information where there is no compelling reason for us to keep it.
• Restrict processing of your information in certain circumstances.
• Portability, meaning a copy of your information in a structured, commonly used, machine readable format where that applies.
• Object to certain uses of your information, including direct marketing.
• Not be subject to automated decision making that has legal or similarly significant effects. MYQER does not make automated decisions about you, but you have this right by law.

To exercise any of these rights, email hello@myqer.com with the words "data protection request" in the subject line. We will respond within one calendar month, as required by UK GDPR Article 12. We may ask you to verify your identity before acting on the request, to protect your information from being released to the wrong person.

04MYQER and its deployments

MYQER is a single emergency information access platform. Its purpose is to give a responder fast access to a small amount of critical health and emergency contact information about a person, in the seconds where it matters. The information is entered by the person, or by their parent or legal guardian where they are a child, and not by the organisation and not by MYQER.

The same platform is deployed in different environments. Which part of this notice applies to you depends on how you encounter it.

Part B is the most detailed part of this notice, because the education deployment involves data about children and therefore the most sensitive processing.

05Commitments across the platform

The following apply to every deployment of MYQER.

Hosting and security

MYQER runs on cloud infrastructure that holds independently audited certifications. The detailed posture is described on our Security and Compliance page, which data protection officers are welcome to review and link to in their own procurement files.

In summary:

• Hosting providers: cloud infrastructure providers that hold ISO/IEC 27001:2022 and SOC 2 Type 2 certifications. We do not publish the names of our infrastructure providers on this page, as a security precaution. They are named in full to organisations under their Data Processing Agreement, and to individual users on request.
• Data region: European Union. Data resides within EU data centres.
• Encryption: TLS 1.2 or higher in transit, AES-256 at rest.
• Access: parents and adults access their profile area through email based magic link authentication. Organisations do not have logins to profile content. Internal administrative access is restricted to named THREEVION personnel and logged in an append only audit trail.
• Honest statement: THREEVION Ltd itself is not currently ISO 27001 certified. Independent certification is on our roadmap. What is verifiable today is that the infrastructure MYQER runs on holds those certifications.

What we never do

We do not sell, rent, or trade personal information. We do not share it for marketing or analytics purposes outside what is needed to operate the platform. We do not pass it to advertising networks, behavioural profiling services, or AI training datasets.

International transfers

MYQER data is stored in the European Union. The UK Government recognises the EU as having adequate data protection standards, so transfers from the UK to our EU data centres take place under the UK GDPR adequacy framework and do not require additional safeguards.

Some of our subprocessors are global companies and may, in limited operational circumstances, route traffic through non EU data centres (for example, Cloudflare's global edge network). Where this happens, the transfer is covered by appropriate safeguards including Standard Contractual Clauses or the equivalent.

AWebsite and direct enquiries

What we collect

When you visit threevion.com or contact us directly, we may collect the following:

• Contact information you provide: name, email address, organisation name, role, phone number where you share it.
• The content of your enquiry: whatever you write in an email, contact form, or message.
• Technical information needed to operate the website: IP address, browser type, pages visited, referrer URL, and standard log data. We keep this for operational and security purposes only.

Why we collect it and our lawful basis

• To respond to your enquiry. Lawful basis: legitimate interests, or steps taken before entering a contract (UK GDPR Article 6(1)(b) or 6(1)(f)).
• To discuss pilots, demos, proposals, and onboarding. Lawful basis: legitimate interests, or pre contract steps.
• To keep the website running securely. Lawful basis: legitimate interests in the security and integrity of our infrastructure (Article 6(1)(f)).
• To comply with legal or regulatory obligations where they apply. Lawful basis: legal obligation (Article 6(1)(c)).

How long we keep it

• Active commercial conversations: for the duration of the conversation plus 24 months, in case you come back to us. After that we delete or anonymise.
• Concluded enquiries with no follow up: 12 months after last contact, then delete.
• Website server logs: 30 days unless retained longer for an active security investigation.
• Anything you ask us to delete sooner: deleted within 30 days of your request, with backups expiring within 90 days under standard rotation.

Who we share it with

We share information from website enquiries with the service providers we use to operate the site and our email systems. The categories of provider are described on our Security and Compliance page, and the named list is available on request. We do not sell, rent, or trade your information. We do not use it for unrelated marketing.

B1Overview

MYQER EDU is the education deployment of the MYQER platform, for UK schools. Its purpose is to give staff fast, scan based access to a small amount of critical health and emergency contact information about a pupil, in the seconds where it matters.

The information about a pupil is entered by the pupil's parent or legal guardian, not by the school and not by MYQER. The parent creates the profile through a secure invite link. The parent then downloads the resulting QR card and emails it to the school office. The school prints the card and displays it where it best supports the child.

In an emergency, any member of school staff can scan the QR card with the phone in their pocket. The emergency view appears on the device, showing the information the parent has chosen to share. It is read only, surfaces only on scan, and does not persist on the scanning device after the session ends.

B2What data we hold about a pupil

The information stored against a MYQER EDU profile is the minimum required to support an emergency response. The parent chooses what to enter. Typical fields include:

What we do not collect

• Date of birth. Age is shown in the emergency view, the date of birth itself is not stored.
• NHS numbers, GP details, or clinical records.
• School performance data, attendance, attainment, or pastoral records.
• Device identifiers or location data beyond what is needed for the platform to function.
• Behavioural data, engagement scoring, or any form of pupil surveillance.
• Special category data beyond what the parent has voluntarily entered for emergency purposes.

B3Our lawful basis

Personal data in MYQER EDU includes special category health data. Two articles of UK GDPR apply:

• UK GDPR Article 6(1)(a), consent. The lawful basis for processing personal data in MYQER EDU is the explicit consent given by the parent or legal guardian when they create the profile and download the QR card.
• UK GDPR Article 9(2)(a), explicit consent for special category data. Where the profile includes health information (allergies, conditions, medication), the parent is asked to give explicit consent at the point of profile creation. This consent can be withdrawn at any time.

For the operational running of the platform itself, we also rely on legitimate interests under Article 6(1)(f) for purposes such as security monitoring, fraud prevention, and the maintenance of the audit log.

B4Controller and processor roles

The roles in MYQER EDU are deliberately structured so that responsibility sits with the right party. We are transparent about this because it matters for a school's own data protection responsibilities.

Each school that goes live with MYQER EDU signs a Data Processing Agreement with THREEVION Ltd, in line with UK GDPR Article 28. This contract sets out our processor obligations to the school in writing, names the subprocessors we use, and covers breach notification.

B5Who we share data with

MYQER EDU shares pupil profile data with a small number of subprocessors that operate the platform. The categories of subprocessor we use are described on our Security and Compliance page. The full named list is provided to each school under its Data Processing Agreement and is updated when a subprocessor is added or removed. Schools using MYQER EDU are notified in advance of any change.

We do not sell, rent, or trade personal information. We do not share it for marketing or analytics purposes outside what is needed to operate the platform. We do not pass it to advertising networks, behavioural profiling services, or AI training datasets.

We will share information where:

• The parent or legal guardian has asked us to.
• The school requires it as part of its own safeguarding response (typically a copy of the profile data the parent has already shared with the school via the QR card).
• Emergency services require it during an active emergency, in line with the safeguarding response.
• We are required to share it by law, regulation, or a valid order from a UK authority.

B6Retention and deletion

• While the profile is active: data is retained for as long as the parent maintains the profile.
• On request to delete: profile data is deleted within 30 days of a verified deletion request from the parent. Backups expire within 90 days under standard rotation.
• On profile inactivity: if a profile has not been accessed by its owner for 24 months, MYQER will contact the registered email address before any retention action is taken.
• School level operational data (monthly readiness reports, anonymised scan counts): retained for the duration of the school's contract plus 12 months for audit purposes, then deleted.
• Audit logs: retained for 24 months for security and integrity purposes, then deleted.

B7Children's data

MYQER EDU profiles describe children, but children do not interact with the platform. The parent or legal guardian creates and controls the profile in the child's interest. The child does not sign up, does not have a login, does not receive marketing, and is not the data controller of their own profile while a minor.

We follow the ICO's Age Appropriate Design Code as guidance where it applies, even though MYQER EDU is not a service used directly by children. This includes minimising data collection, defaulting to high privacy settings, and avoiding the use of dark patterns to encourage parents to share more data than necessary.

When a child turns 18, or when the parent decides to transfer profile ownership at an earlier date, the profile can be moved to the data subject themselves and the original parent's consent role ends.

CMYQER for individuals

MYQER for individuals applies the same minimum data, self controlled, privacy first design principles described in Part B. The person creates and maintains their own profile, decides what it contains, and can change or delete it at any time.

Our lawful basis

• UK GDPR Article 6(1)(a), consent. The lawful basis for processing personal data in an individual profile is the data subject's own explicit consent, given when they create the profile.
• UK GDPR Article 9(2)(a), explicit consent for special category data. Where the profile includes health information, the person is asked to give explicit consent at the point of profile creation. This consent can be withdrawn at any time.

For the operational running of the platform itself, we also rely on legitimate interests under Article 6(1)(f) for purposes such as security monitoring, fraud prevention, and the maintenance of the audit log.

Controller and processor roles

THREEVION Ltd is the data controller for platform operational data such as logs, security events and the audit trail. For the content of an individual profile, the person is the controller of their own information and THREEVION Ltd processes it on their behalf.

Retention and deletion

The retention and deletion terms set out in Part B, section B6, apply equally to individual profiles, read as referring to the person rather than to a parent. Profile data is deleted within 30 days of a verified deletion request, with backups expiring within 90 days under standard rotation.

The hosting, security, international transfer and rights commitments in sections 03 and 05 apply in full. For any question about an individual profile, contact hello@myqer.com.

DMYQER Workforce

MYQER Workforce operates on the same principles described elsewhere in this notice: minimum data, employee controlled profiles, privacy first design, no behavioural tracking, and no automated decision making.

Who controls the profile

The employee creates and maintains their own profile and decides what it contains. The employer does not enter, edit or read profile content through an administrative login. The employer's role is to invite people to the platform, to issue cards, and to see organisational readiness information rather than individual emergency information.

Our lawful basis

• UK GDPR Article 6(1)(a), consent. The lawful basis for processing personal data in a Workforce profile is the employee's own explicit consent, given when they create the profile. Participation is voluntary.
• UK GDPR Article 9(2)(a), explicit consent for special category data. Where the profile includes health information, the employee is asked to give explicit consent at the point of profile creation. This consent can be withdrawn at any time.

For the operational running of the platform itself, we also rely on legitimate interests under Article 6(1)(f) for purposes such as security monitoring, fraud prevention, and the maintenance of the audit log.

Controller and processor roles

Employers using MYQER Workforce sign a Data Processing Agreement with THREEVION Ltd in line with UK GDPR Article 28. This sets out our processor obligations in writing, names the subprocessors we use, and covers breach notification. For the content of an employee profile, the employee is the controller of their own information and THREEVION Ltd processes it on their behalf.

Retention and deletion

The retention and deletion terms set out in Part B, section B6, apply equally to Workforce, read as referring to the employee rather than to a parent and to the employer rather than to the school. Profile data is deleted within 30 days of a verified deletion request, with backups expiring within 90 days under standard rotation.

The hosting, security, international transfer and rights commitments in sections 03 and 05 apply in full. For any question about Workforce, contact hello@myqer.com.

06Cookies and analytics

The threevion.com website uses a minimal set of cookies and similar technologies. We do not use behavioural advertising cookies, cross site tracking, or third party advertising networks.

Essential cookies

These are necessary for the website to function: session handling, security, and remembering your acceptance of cookies. They do not require consent under UK law.

Analytics

We do not use analytics on this website. There is no third party tracking, no fingerprinting, and no behavioural profiling. If we introduce analytics in future, it will be a privacy respecting provider, and we will update this notice and its version number before doing so.

You can control cookies through your browser settings. If you disable essential cookies, some site functions may not work properly.

07Changes to this notice

We may update this Privacy Notice from time to time. The most likely reasons are: a change to one of our subprocessors, a change to the services we offer, a change to applicable law, or an improvement in how we describe what we do.

When we update the notice, we will change the version number and date in the header. For material changes that affect parents or schools, we will also notify the affected schools and parents directly by email.

08Complaints

If you have a concern about how we handle your personal information, we would always prefer the chance to address it directly. Email hello@myqer.com with the words "privacy complaint" in the subject line and we will respond within five working days.

You also have the right at any time to complain to the Information Commissioner's Office, which is the UK supervisory authority for data protection. You do not need to come to us first.

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF