1. Information collected
The Company collects only the information the Service’s forms request, the contents of quotes and messages, and the records required to operate accounts and to keep the Service safe.
1.1 From Buyers
- Whether the Buyer seeks to buy new equipment, buy preowned equipment or rent equipment; the delivery ZIP code; and the type of system required.
- Where the Buyer provides them: a specialty, a budget range, a timeline, a model, probes, whether financing terms are requested, rental dates and terms, and notes.
- Where the Buyer adds a system for trade-in: its model, year, serial number, probes, condition and scan hours, and up to eight photographs. Photographs are resized on the Buyer’s device before upload, and the resizing removes the location and device details recorded by the camera.
- The Buyer’s name, role and email address, and a telephone number where the Buyer wishes to be called. A new account also requires a password, which the Company stores only in hashed form and cannot read back.
A User should not include patient information in a request, a note or a message. The Service does not require it.
1.2 From Vendors
- The application: the business’s trading name and legal name, a contact name, email address and telephone number, the states it serves, whether it sells new or refurbished equipment, whether it rents equipment, and, where provided, a website and a note.
- The name, email address and hashed password of each member of a Vendor, and the Vendor’s contact address for request email.
- Quotes: the system, its condition and year, the price, warranty, probes, service coverage, delivery and installation, an inspection reference, notes, and the date until which the quote stands.
1.3 From all Users
- Messages between a Buyer and a Vendor, once the Buyer has replied to a quote.
- Sign-in records. For each sign-in, the Company stores a session record with the IP address and browser from which it was made.
- Rate-limit records. To limit abuse, the Company counts recent sign-ins, requests, applications and replies by IP address or by account.
- A log of actions taken on requests and Vendor accounts, such as the submission of a request, the entry of a quote or the approval of a Vendor. The log records which account acted and when, and not what any User wrote.
- A record of the email the Company sends: the recipient address, the type of email, and the details from which it was composed.
- Logs of requests to the Service, kept for a short period by the Company’s hosting provider, which may include IP addresses.
The Company uses Google Analytics, as described in the Analytics section, and no advertising trackers. Email sent by the Company carries no tracking pixels.
2. Use of Personal Information
The Company uses Personal Information for the following purposes:
- To review each request and send it to the approved Vendors the Company selects for it. The Company reviews every request before any Vendor sees it.
- To present quotes to the Buyer, and to deliver the Buyer’s reply and messages to the Vendor to which the Buyer replies.
- To send email concerning the User’s requests and account: a receipt, a notice when a quote arrives, a notice when quoting closes, message notifications and password resets. The Company sends no marketing email.
- To review Vendor applications and to administer Vendor accounts.
- To protect the Service and its Users, through rate limits, spam checks, and the investigation of misuse, fraud and disputes.
- To publish market ranges. A model’s market range is derived from quotes on closed requests, and it is published only when it rests on quotes from at least three different Vendors on at least three closed requests in the last 90 days. No individual quote, Vendor or Buyer can be identified from a market range. Rental quotes are not included.
The Company does not sell or rent Personal Information and does not use it for advertising.
3. Disclosure of Personal Information
3.1 To Vendors, before a reply
The Vendors to which the Company sends a request see it under a six-digit request code. They see the transaction sought, the specialty, the type of system, the model named, probes, the timeline, whether financing terms were requested, the rental term, and the first three digits of the Buyer’s ZIP code.
They do not see the Buyer’s name, email address, telephone number or role, budget, the remaining digits of the ZIP code, or the rental start date, minimum rental period, delivery choice or purchase option. Vendors never see one another’s quotes.
Where a Buyer submits notes with the request form’s statement that Vendors will read them, the Vendors to which the Company sends the request may see those notes once the Company releases it, unless the Company withholds them. Notes submitted without that statement, including notes submitted before it existed, are seen by the Company only.
Where a Buyer adds a trade-in, the Company decides whether to send its details and photographs to the Vendors already on the request. Those Vendors receive the model, year, probes, condition and scan hours, and links to the photographs that expire after 30 days. The serial number is never sent to Vendors in this way.
3.2 To the Vendor to which a Buyer replies
A reply is at the Buyer’s discretion and cannot be withdrawn. Once quoting has closed, the Buyer may reply to any quote that still stands. The Vendor to which the Buyer replies receives the Buyer’s name, email address and any message the Buyer adds. The Buyer’s telephone number is not disclosed. The Buyer and that Vendor may then exchange messages on the Service.
No other Vendor on the request receives anything. A Vendor that receives a Buyer’s details may use them only to deal with that Buyer about that request, as the vendor terms provide.
3.3 To the Company
The Company sees all information a User submits, including contact details, in order to review requests, send them to Vendors, and telephone a Buyer where a request requires it.
The Company can read the messages between Buyers and Vendors. The Company takes no part in those conversations. It reads them to resolve disputes, to investigate fraud or misuse, and to maintain the integrity of the marketplace.
3.4 Within a Vendor
The members of a Vendor can see one another’s names and email addresses, and each of them can see the requests sent to that Vendor.
3.5 Where required by law
The Company may disclose information where the law requires it, or where disclosure is necessary to protect the rights or safety of the Users of the Service.
4. Service providers
The Company engages service providers to operate parts of the Service. Each handles information on the Company’s behalf:
- A hosting provider operates the Service and stores the photographs submitted with trade-in requests. Such photographs are held in private storage accessible only to the Company.
- A database provider holds the accounts, requests, quotes, messages and other records described in this Privacy Policy.
- An email delivery service delivers the Company’s email.
- A content system holds the catalog: model pages, specifications and images. It holds no Personal Information. Catalog images are served by the content system’s image service, which receives the User’s IP address and browser information in the course of serving them.
- Google provides Google Analytics, which measures use of the Service as described in the Analytics section. Google also provides Google reCAPTCHA, which distinguishes persons from automated programs on the Service’s forms and receives the User’s IP address and interaction signals for that purpose. Google reCAPTCHA loads when the User opens one of the Service’s forms and may remain loaded on other pages of the Service until the browser tab is closed or reloaded.
The Service does not serve advertising. No other third party receives Personal Information from the Service.
6. Analytics
The Company uses Google Analytics 4 to measure use of the Service: the pages visited, how visitors arrive, and whether they begin and submit a request. Google Analytics sets analytics cookies in the User’s browser and collects the pages visited, the User’s approximate location, device and browser, and the referring site. The approximate location is derived from the User’s IP address, which Google Analytics does not store. Google Analytics receives the words a User types into the search box, after any text resembling an email address, a telephone number or a long number has been removed. It does not receive the User’s name or email address, any other text typed into a form, or the contents of a request. The Company has turned off Google’s advertising features. A User may block these cookies in the browser’s settings, or install Google’s opt-out browser add-on.
7. Retention
Requests, quotes, replies and messages are the record of the marketplace, and the Company retains them. Because a Buyer and a Vendor who have dealt with each other both rely on that record, messages, and the details disclosed when a Buyer replied, are retained even if an account is closed. The log of actions and the record of sent email are also retained.
The following records are retained for shorter periods:
- Rate-limit counts are deleted about one minute after their window ends, and within the hour.
- Trade-in photographs uploaded to a request that is never submitted are deleted after 72 hours.
- A Vendor’s link to trade-in photographs expires after 30 days, and the Company may revoke it sooner.
- Password-reset links are valid for one hour.
- A sign-in session expires about seven days after the User last uses the Service.
8. Accounts and requests concerning Personal Information
A Buyer may change the account’s email address and password in the dashboard’s settings. A change of email address takes effect once it is confirmed from the new address.
A User may close an account by email to support@buyultrasound.com from the address on the account. On closure, the Company removes the User’s name, email address, role and telephone number from the account, closes it, deletes its password and signs it out of every session. The following are retained, as set out in the Retention section: the requests the User made and the quotes on them, the messages, the records of actions and sent email, any information already disclosed to a Vendor to which the User replied, and the Company’s notes on the User’s requests. Email already queued when the account closes is still delivered. Trade-in photographs remain with their request, and a Vendor’s link to them remains valid for up to 30 days. Where the User applied as a Vendor, the application is retained. The Company also retains a record that the account was closed.
A User who is a member of a Vendor may instead close the account from the account page of the Vendor portal, once no request the User made as a Buyer is still awaiting review, in review or open for quotes. Closure from the account page has the same effect as closure on request.
A User may also ask, at the same address, what Personal Information the Company holds about the User, or ask the Company to correct it.
9. Security
Passwords are stored in hashed form, and the Service is served only over an encrypted connection. Access to records is limited by account: a Vendor can read only the requests sent to it and only its own quotes, and a Buyer’s contact details are not part of the request a Vendor reads. Trade-in photographs are held in private storage and reach Vendors only through links the Company sends, and each opening of such a link is logged.
No system is perfectly secure. A User who believes that the account has been used by another person should notify the Company at support@buyultrasound.com.
10. United States only
The Service is for Buyers and Vendors in the United States, and it is not directed at persons anywhere else.
11. Children
The Service is for persons buying and selling medical equipment in the course of their work. It is not intended for anyone under 18, and the Company does not knowingly collect Personal Information from children.
12. Changes to this Privacy Policy
If the Company changes this Privacy Policy, it will change the date at the head of this page. The version in force is always the one at buyultrasound.com/privacy.
13. Contact
Buyultrasound.com LLC. Questions and requests concerning Personal Information, and all other matters: support@buyultrasound.com.