Last updated: 25 October 2026
In short. TwiceOn is in a closed pilot. This notice covers this website, the sign-in accounts of invited people, and email you send us. It does not cover medical documents: the dossier service is not open yet, and before anyone uploads a medical document we publish a separate notice and ask for a separate, explicit consent. The site sets no analytics or tracking. Questions: privacy@twiceon.com.
Who we are
TwiceOn is run by DEVITGROUP LTD, a company registered in England and Wales (company number 12709920), registered office 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom. This is our registered address, not an office open to visitors; email is the quickest way to reach us. We decide how your data is used, so in law we are the "controller". Our registration number with the UK Information Commissioner's Office (ICO) is ZC078036.
Our representative in the European Union and EEA is DataRep (Data Protection Representative Limited, registered in Ireland, company number 616588). If you live in the EU or EEA, you can write to them instead of us: by email to datarequest@datarep.com with "TwiceOn" in the subject line, through the form at datarep.com/data-request, or by post marked for the attention of "DataRep" to The Cube, Monahan Road, Cork, T12 H1XY, Ireland, or to DataRep's office in your country.
We have not appointed a data protection officer. Write to privacy@twiceon.com about anything in this notice.
Visiting the site
We do not use analytics, advertising or tracking tools, and the pages load nothing from other companies' servers. Your browser sends its IP address to our server with every request; this is how the internet works. Our web server keeps a technical log with IP addresses for 7 days to keep the site secure, then deletes it.
If you choose a language with the language switcher, the site stores one small file (a cookie) called tw_lang in your browser. It holds only the language code, lasts one year, and is used only to show the site in your language next time. You can delete it at any time in your browser settings, and the site works without it.
Your account
If we invite you to the pilot, you can sign in with an email and password, or with your Google account. We store:
- your email address, your name, and a scrambled form of your password (we cannot read your password);
- if you use Google: your Google account identifier, your name, your email address and whether Google has verified it, and your profile picture address. Google learns that you signed in to TwiceOn;
- whether you confirmed your email address, and when you signed in.
Why: to create your account, keep it secure and let you sign in. Legal basis: the contract with you for the account (UK GDPR and EU GDPR Article 6(1)(b)). Providing these details is needed for an account; without them we cannot create one.
When you sign in, the app uses cookies and similar browser storage that keep you signed in and protect the sign-in against forgery. They are needed for sign-in and are not used for tracking.
We send you emails only for the account: the confirmation link, a password reset and a notice if the account is deleted. We do not send marketing email.
Writing to us by email
If you write to help@twiceon.com or privacy@twiceon.com, we use your address and message to answer you. Legal basis: our legitimate interest in answering messages (Article 6(1)(f)). Please do not send medical documents by email. We delete messages about privacy requests once the request is closed and keep only a note that the request was handled, without your name or address. We delete other messages 12 months after the conversation ends.
Who else handles your data
- Hetzner Online GmbH, Germany, hosts our server and its database. Your account is stored on that server in Germany.
- Cloudflare, Inc. runs our domain name records and keeps an encrypted copy of the database, in a storage bucket in the EU, for up to 29 days. The key is not held by Cloudflare, so it cannot read the copy.
- SMTP2GO sends the emails we send you (confirmation, password reset, account deleted) through its EU servers.
- Google: if you choose "Sign in with Google", Google handles that sign-in under its own terms. Our email is hosted by Google Workspace (Google Cloud EMEA Limited).
They act only on our instructions under data processing agreements, except Google for the sign-in you choose. We share your data with nobody else unless the law requires it.
Transfers outside the UK or the EU
Your account is stored in Germany, in the EU. We work from the United Kingdom and access it from there. The European Commission has decided that the UK protects personal data adequately, so no extra safeguards are needed for this. Google may process email and sign-in data in the EU, the UK and other countries; where that is a transfer out of the UK or the EU, Google relies on standard contractual clauses or another lawful transfer mechanism.
How long we keep it
- Technical web server log: 7 days.
- Your account: until you delete it. After you close it we delete your account details within 30 days. A copy can remain in an encrypted backup for up to 29 days more.
- Email: as described above.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to object, or to receive it in a portable form. Where we rely on your consent you can withdraw it at any time. To delete your account, write to privacy@twiceon.com. We answer within one month. If a request is complex we may need up to two more months, and we tell you within the first month. It is free. No decisions about you are made automatically, and we do not build profiles.
Complaints
Please write to us first, so that we can put it right. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority in the EU country where you live, work, or where you think the problem happened.
Changes
If we change this notice, we update the date at the top. When the dossier service opens, we publish its own notice before any medical document is accepted.