How we comply with the EU General Data Protection Regulation.
Last Updated: April 9, 2026
The General Data Protection Regulation (GDPR), formally known as EU Regulation 2016/679, is one of the most comprehensive data protection laws in the world. It establishes strict rules for the processing of Personal Data of individuals within the European Economic Area (EEA).
Volumetryx Inc. (volumetryx.ai) is committed to upholding GDPR standards where applicable, ensuring that all data processing activities involving EEA individuals meet the regulation's requirements for transparency, security, and accountability.
Volumetryx collects and processes data in two primary contexts:
We collect Personal Data through our website via the following means:
This data is used for the following purposes:
Lawful Bases: We process website data on the basis of legitimate interests (e.g., responding to inquiries, improving our services) and consent (e.g., for marketing communications and non-essential cookies).
Volumetryx acts as a Data Controller for the Personal Data of our client contacts, such as names, email addresses, job titles, and professional details necessary for account management and service delivery.
Lawful Bases: Contract performance (processing necessary to fulfill our service agreements) and legitimate interests (maintaining client relationships, communicating about services).
Our core service involves the analysis of De-identified Medical Data — imaging data from which all personal identifiers have been removed. Properly de-identified data falls outside the scope of GDPR, as it no longer relates to an identifiable natural person.
In cases where clients provide identifiable data for the purpose of de-identification, Volumetryx acts as a Data Processor under a Data Processing Agreement (DPA) in accordance with GDPR Article 28. In this capacity, we:
Volumetryx implements appropriate technical and organizational safeguards as required by GDPR Article 32. These measures are designed to ensure a level of security appropriate to the risk, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.
Access to Personal Data is restricted to authorized personnel only, on a need-to-know basis. All personnel with access to Personal Data are bound by strict confidentiality obligations, whether by contract or statutory duty.
We retain Personal Data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, or support legitimate business needs. We conduct regular reviews of stored data and apply secure deletion or anonymization procedures when data is no longer required.
Our website uses cookies and similar tracking technologies for the following purposes:
We deploy a consent management tool to obtain your explicit opt-in consent before activating any non-essential cookies, in compliance with GDPR requirements.
We use Google Analytics for website analytics. You may opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on or by adjusting your cookie preferences through our consent management tool.
We honor Global Privacy Control (GPC) signals transmitted by your browser as a valid expression of your privacy preferences.
Under the GDPR, if you are an individual within the EEA, you have the following rights regarding your Personal Data:
To exercise any of these rights or for any questions regarding our GDPR compliance, please contact our Privacy Officer:
Privacy Officer, Volumetryx Inc.
Volumetryx Inc., Montreal, QC, Canada
contact@volumetryx.ai
We will respond to data subject requests within 30 days of receipt.
You have the right to lodge a complaint with your local data protection supervisory authority.
A Data Processing Agreement (DPA) is available upon request for all clients.
For the full details of our data processing practices, please refer to our Global Privacy Policy. Any updates to our GDPR compliance practices will be reflected there.