Quartet Super App Privacy Policy

1. Who this policy covers

Quartet Engineers Corporation (Quartet, we, us) provides Quartet Super App for approved employees, contractors and other authorized participants in company project, work-order and sample-handover activities. This policy explains how we handle personal information through the app and its supporting services. It also covers information about people named in work records, even if they do not use the app themselves.

The app requires an approved Microsoft sign-in and an active Quartet profile. Installing it or receiving a TestFlight invitation does not grant access to company records. This app policy is separate from the privacy notice for our website.

2. Information we process

Account and access information. Name, email address where supplied, company user and Microsoft account identifiers, application roles, permitted actions, and assigned lab or site. Microsoft handles the sign-in process. Quartet does not ask you to enter your Microsoft password into a Quartet-created password field.

Projects and work orders. Project names and identifiers, client information entered in the app, location descriptions, notes, work instructions, requested tests, schedules, assignment details and acknowledgment records.

Samples and custody. Sample identifiers and descriptions, source and receiving locations, collection and receipt times, names of collectors and people handing over samples, receiving employees, condition, quantity, storage observations, photographs, corrections and related audit history. A person recording an event may be different from its physical recipient.

Technical information. Authentication and security information, app or operating-system details, device information and request or error identifiers processed by the app, Microsoft sign-in and service infrastructure. Local recovery records can contain the original business details needed to retry or reconcile a save.

3. Photographs and location information

You choose whether to take a photograph or select an image through the iPhone photo picker. Camera access requires your device permission. The app does not automatically scan your photo library. Photographs can reveal people, labels, addresses and other personal information, so include only information needed for the work.

The current app prepares photographs as JPEGs and removes embedded location metadata during that preparation. This does not remove location clues or personal information visible in the picture. Project and receipt photographs can be uploaded through the authenticated Quartet API. Work-order and collection photographs currently remain on the phone; attaching them does not itself upload them. Local copies can remain after an upload.

Current project and receiving workflows use location descriptions entered by users or supplied in project records. They do not collect device GPS positions or track the phone continuously in the background. This policy must be updated before a future location-tracking feature is introduced.

4. How we use information

We use this information to verify identity and access, coordinate project work, assign and acknowledge work orders, document sample custody and receiving, maintain records and audit history, and provide authorized operational reporting. We also use it to preserve drafts, reconcile interrupted saves, support users, investigate errors or misuse, and meet applicable contractual and recordkeeping obligations.

A phone-only draft or proposed project edit is not a confirmed company record. The app identifies local and confirmed server outcomes separately. Current project-detail edits are local proposals rather than updates to the shared project.

We do not sell personal information or use app information for targeted advertising or advertising profiles. The current app does not include an advertising network or a cloud AI feature that processes sample information. These statements do not mean that authentication services or TestFlight collect no technical information.

5. Who can receive information

Authorized Quartet personnel can access information according to their responsibilities and approved permissions. Project information may also be included in authorized client deliverables or disclosed when required by law, a contract or a valid legal process. We limit disclosures to information appropriate to the purpose.

We use Microsoft Entra for authentication and Microsoft Azure services for the company backend, database and photograph storage. Company records may be used in authorized reporting through Databricks where configured. Approved service providers supporting these functions are required to handle personal information for authorized purposes with appropriate confidentiality and protection. They are not authorized to use our app data for their own advertising.

6. TestFlight and support

During the beta, Apple collects crash and usage information through TestFlight and shares information with Quartet as the app provider. This can include invitation information, device and operating-system details, installed app versions, sessions and crashes. Feedback or screenshots you submit can also be associated with your name or invitation email. Apple says automatic TestFlight crash and usage collection cannot be opted out of while testing.

We use TestFlight information to improve and troubleshoot the app, subject to Apple's restrictions, and do not share that TestFlight information with third parties. Do not include passwords, verification codes or unrelated customer information in feedback. Apple explains its handling at https://www.apple.com/legal/privacy/data/en/test-flight/. Microsoft explains its privacy practices at https://privacy.microsoft.com/privacystatement.

7. Storage security and retention

The app communicates with the company API over HTTPS and uses iOS-protected storage for local drafts, recovery records and attachments. Microsoft authentication uses protected credential storage. Access controls and audit records support the protection of company data, but no system can guarantee absolute security.

Local drafts, recovery records and photographs may remain on the phone after sign-out. The maintained app excludes those protected stores from device backups; do not assume they will transfer to another phone. Removing the app may destroy local-only or unfinished records and does not delete company records already saved on the backend.

We retain company records for the purposes described here and for applicable project, laboratory, contractual, legal and audit obligations. Retention depends on record type, the status of the project and any legal hold. When retention is no longer required, we arrange deletion or de-identification under the approved records process. Deletion from active systems may not immediately remove copies from backups or reporting systems. We do not promise automatic deletion on sign-out or after a fixed number of days.

Our initial pilot is intended for United States users. That does not, by itself, guarantee United States-only processing by every service provider. Contact us for information about the approved locations and safeguards relevant to your data.

8. Your choices and privacy requests

You can manage camera and photo permissions through iPhone settings; declining optional access may limit the related photo feature. You can stop using the app or ask your company administrator to disable access. Neither action automatically deletes business or custody records.

Contact us to ask about information associated with you or to request access, correction or deletion, as applicable. We may verify your identity and authority. Records needed for legitimate business, audit or legal purposes may need to be retained, and corrections may preserve the original history. Your statutory rights depend on applicable law and the context of the information. The app is intended for authorized professional use, not for children.

9. Contact and policy updates

Privacy requests: services@quartet-eng.com. App and pilot support: acquartet@icloud.com. Please identify Quartet Super App in your message and do not send passwords or verification codes. We will update the published policy and its effective date when practices change and provide additional notice where required.