================================================================================ PRIVACY POLICY ================================================================================ Effective Date: February 18, 2026 Last Updated: July 28, 2026 INTRODUCTION -------------------------------------------------------------------------------- This Privacy Policy describes how Doculus Lumus Webapp ("we", "our", or "the Application") handles your data when you use our browser-based web application. We are committed to protecting your privacy and ensuring transparency about our data practices. DATA CONTROLLER -------------------------------------------------------------------------------- Application Name: Doculus Lumus Webapp Developer: Doculus Lumus GmbH Versions: 3.x OVERVIEW OF DATA PROCESSING -------------------------------------------------------------------------------- Doculus Lumus Webapp is designed with privacy as a core principle. All data processing occurs locally on your device. We do not collect, transmit, or store any personal data on external servers. TYPES OF DATA PROCESSED -------------------------------------------------------------------------------- 1. CAMERA ACCESS Purpose: The Application requires access to your IPEVO MP-8M camera (or compatible camera device) to provide its core functionality of image capture and processing. Data Processing: - Live camera feed is processed entirely within your browser/application - No video or image data is transmitted to any external server - Camera access is only active when you explicitly grant permission through your browser's permission dialog Legal Basis: Your explicit consent through the browser permission dialog. 2. IMAGES AND METADATA Purpose: To capture, process, and save images with embedded metadata for documentation purposes. Data Processing: - Images are captured from your camera and processed locally - Metadata is embedded directly into image files (JPEG/PNG) including: * Timestamp of capture * Application version * Device configuration (magnification, color settings) - All images and metadata remain on your local device - You have full control over where images are saved and how they are used Storage Location: All captured images are stored locally on your device in locations you choose. Legal Basis: Your explicit action of capturing and saving images. 3. APPLICATION SETTINGS AND PREFERENCES Purpose: To remember your device configuration and preferences for a better user experience. Data Stored: - Device magnification setting (15x or 22x) - Device housing color preference - Last selected camera device Storage Method: Browser cookies and local storage Data Retention: Settings are stored locally until you clear your browser data or uninstall the application. Legal Basis: Legitimate interest in providing a seamless user experience. DATA WE DO NOT COLLECT -------------------------------------------------------------------------------- We explicitly do NOT collect, process, or transmit: - Personal identification information (name, email, phone number, etc.) - IP addresses or device identifiers - Usage analytics or telemetry data - Location data - Any data to third-party services or analytics platforms - Crash reports or error logs to external servers THIRD-PARTY SERVICES -------------------------------------------------------------------------------- This Application does NOT use any third-party services, analytics tools, or external APIs that would have access to your data. DATA SHARING -------------------------------------------------------------------------------- We do NOT share, sell, rent, or disclose any data to third parties because: - All processing occurs locally on your device - No data is collected by us or transmitted from the Application DATA SECURITY -------------------------------------------------------------------------------- Local Processing: All data processing occurs on your local device, which provides inherent security as data never leaves your control. Your Responsibility: As all data remains on your device, you are responsible for: - Securing your device with appropriate passwords/encryption - Managing access to saved images - Backing up important data - Ensuring your operating system and browser are up to date PRODUCT SECURITY & CYBER RESILIENCE ACT (CRA) COMPLIANCE -------------------------------------------------------------------------------- Doculus Lumus Webapp is a product with digital elements within the meaning of Regulation (EU) 2024/2847 (the "Cyber Resilience Act" / "CRA"). Beyond data protection, we design, build and maintain the Application in accordance with the CRA's cybersecurity requirements. This section explains what that means for you as a user. Security by Design and by Default - The Application is developed to be secure by design and is delivered in a secure default configuration. - Because all image and video processing occurs locally and no data leaves your device, the attack surface is minimized in line with the CRA principle of data minimization. - The Application contains no hardcoded or default credentials and requires no elevated system privileges to run; it operates within the standard security sandbox of your web browser. Security Updates and Support Period - We provide security updates for the Application for a defined support period of at least five (5) years from the date it is placed on the market, or for the expected product lifetime, whichever we specify at the time of supply. - Current support period: February 18, 2026 - February 18, 2031. - The Application is served from our server. Security updates are deployed server-side and take effect immediately the next time you open or reload the Application; no action or manual installation is required on your part. - If you use the downloaded offline version, re-download the latest version from https://cam.doculuslumus.com to obtain the most recent security updates. - We recommend always using the latest available version. The Application's version is embedded in captured image metadata for traceability. Reporting a Security Vulnerability (Coordinated Vulnerability Disclosure) - If you discover a potential security vulnerability in the Application, we encourage you to report it to us so we can address it responsibly. Please contact: Security contact: office@doculuslumus.com - Please include a description of the issue and, where possible, steps to reproduce it. We will acknowledge your report, investigate, and, where appropriate, provide a remediation or update. - We handle reports confidentially and in line with a coordinated vulnerability disclosure approach. Software Bill of Materials (SBOM) - We maintain a Software Bill of Materials documenting the components used in the Application. It is available to competent authorities upon request in accordance with the CRA. Conformity and CE Marking - We have carried out the applicable conformity assessment and have drawn up an EU Declaration of Conformity for the Application under the CRA. - The CE marking for the Application is affixed to the EU Declaration of Conformity and to the accompanying documentation through which the Application is made available, as is customary for products supplied in software form. YOUR RIGHTS -------------------------------------------------------------------------------- Since all data processing occurs locally on your device, you have complete control over your data: - Right to Access: All data is directly accessible on your device - Right to Deletion: You can delete any images, settings, or application data at any time - Right to Modify: You can change settings and preferences at any time within the Application - Right to Withdraw Consent: You can revoke camera permissions through your browser settings at any time How to Exercise Your Rights - Delete Application Data: Clear your browser cache and cookies, or delete the Application - Revoke Camera Access: Use your browser's settings to revoke camera permissions - Delete Images: Manually delete saved image files from your file system CHILDREN'S PRIVACY -------------------------------------------------------------------------------- This Application is not directed at children under the age of 16 (or the lower age set by your jurisdiction, e.g. 14 in Austria). We do not knowingly collect data from children. Since all processing is local, parents/guardians should supervise children's use of the Application if applicable. COOKIES AND LOCAL STORAGE -------------------------------------------------------------------------------- The Application uses browser cookies and local storage exclusively for: - Remembering your device configuration (magnification, color) - Storing application preferences Type: First-party cookies only Purpose: Functional (essential for application operation) Duration: Persistent until manually cleared or application is uninstalled You can clear these cookies through your browser settings at any time. CHANGES TO THIS PRIVACY POLICY -------------------------------------------------------------------------------- We may update this Privacy Policy from time to time. When we make changes: - The "Last Updated" date at the top will be revised - Significant changes will be communicated through the Application or our website - Continued use of the Application after changes constitutes acceptance of the updated policy OFFLINE VERSION -------------------------------------------------------------------------------- The Application offers an offline version that can be downloaded and used without internet connectivity. The same privacy principles apply: all processing remains local, and no data is transmitted externally. TECHNICAL DETAILS -------------------------------------------------------------------------------- For transparency, here are technical details about data storage: Image Metadata Format: - JPEG: Metadata stored in COM (Comment) segment with prefix "DoculusLumusMetadata:" - PNG: Metadata stored in tEXt chunk with keyword "DoculusLumusMetadata" Both methods are standards-compliant and preserve image compatibility with other software. CONTACT INFORMATION -------------------------------------------------------------------------------- If you have questions about this Privacy Policy or our data practices, please contact: Doculus Lumus GmbH Email: office@doculuslumus.com Website: https://www.doculuslumus.com COMPLIANCE -------------------------------------------------------------------------------- This Privacy Policy is designed to comply with: - General Data Protection Regulation (GDPR) - EU - Regulation (EU) 2024/2847 - Cyber Resilience Act (CRA), for product cybersecurity and vulnerability handling - California Consumer Privacy Act (CCPA) - USA - Other applicable data protection laws Because the Application itself neither collects nor transmits personal data, our own regulatory footprint is minimal. Note that any personal data contained in the documents you scan is processed locally, under your control and responsibility as the user. SUMMARY -------------------------------------------------------------------------------- In short: Doculus Lumus Webapp processes all data locally on your device. We do not collect, transmit, or store any of your data on external servers. You have complete control over your images, settings, and camera access at all times. The Application is developed and maintained in line with the EU Cyber Resilience Act, including security-by-design, a defined security-update support period, and a channel for reporting vulnerabilities. ================================================================================ Your privacy is important to us. By keeping all processing local, we ensure that your data remains yours. ================================================================================