Last updated: October 8, 2026
This policy explains what personal information OVA Solutions collects through ovasolutions.com, why we collect it, who else touches it, and what you can ask us to do with it. The short version: we collect what you send us, we count page visits unless you say no, we do not run ads, and we do not sell anyone’s data.
Who we are
OVA Solutions LLC, 430 Park Ave, New York, NY 10022, USA (“OVA Solutions”, “we”, “us”) runs this website and decides how the information collected here is used. OVA Solutions is part of a group of companies that work under one quality management system, including Canyon Medical Inc. and Alnicko Lab OÜ (Estonia). For any privacy question or request, write to info@ovasolutions.com or call +1 (862) 682-4568.
What we collect
Information you give us
- Contact form. Your name, email, phone number, company name, and what you tell us about your project: description, stage, goals, approximate budget, timeline, notes, and how you heard about us. Only fill in what you are comfortable sharing. Please do not send patient data or other health information about identifiable people through the form.
- Newsletter. If you subscribe to our newsletter (No Mercy MedTech) or request a free resource, we receive your email address.
- Booking a call. If you book a call through our Calendly link, Calendly collects the details you enter and shares them with us.
- Emails and calls. Whatever you send us directly by email or tell us on a call.
Information collected automatically
- Analytics. Unless you decline cookies, Google Analytics 4 records which pages you view, how you arrived (for example from a search engine or an AI assistant), your approximate location (country and city level), device and browser type, and events such as starting or submitting a form. Google Analytics 4 does not log or store IP addresses.
- Spam protection. The contact form uses Google reCAPTCHA v3, which looks at how the page is used to tell people from bots.
- Server and security logs. Our hosting provider and its content delivery network process technical data such as IP address, browser type, and the pages requested, to deliver the site and protect it from attacks.
How we use it
| Purpose | Information | Legal basis (EU, UK, Brazil) |
|---|---|---|
| Answer your inquiry, prepare a proposal, run a project | Contact form, emails, calls, bookings | Steps you asked for before a contract; performing a contract |
| Send the newsletter or a resource you requested | Email address | Your consent, which you can withdraw at any time |
| Understand which pages are useful and improve the site | Analytics data | Our legitimate interest; you can switch it off with “No cookies, thanks” |
| Keep the site and forms secure, block spam | reCAPTCHA signals, server logs | Our legitimate interest in security |
| Meet legal, tax, and accounting obligations | Business records | Legal obligation |
We do not use your information for advertising, we do not build advertising profiles, and we do not make automated decisions that have legal or similarly significant effects on you.
Cookies
When you first visit, a notice tells you that we use cookies. Analytics cookies are on unless you click “No cookies, thanks”. After that, Google Analytics is switched off for your browser and its cookies are deleted. If your browser sends a Global Privacy Control signal, we treat it as a “no” automatically. Change your cookie choice.
| Cookie | Set by | What it does | Kept for |
|---|---|---|---|
| ova_cookies | OVA Solutions | Remembers your cookie choice | 1 year |
| _ga, _ga_* | Google Analytics | Tells visits apart for statistics | up to 13 months |
| pum-* | Popup Maker | Remembers that you closed a pop-up, so it does not reappear | 1 month |
| pll_language | Polylang | Remembers the site language you chose | 1 year |
| _GRECAPTCHA | Google reCAPTCHA (google.com) | Spam and bot protection on the contact form | up to 6 months |
| hcdn | Hostinger | Content delivery and protection against bots | until you close the browser |
The embedded newsletter form from Beehiiv sets its own security cookies (bot protection), and the Calendly booking page follows Calendly’s cookie policy.
Who we share it with
We do not sell personal information and do not share it for cross-context behavioral advertising. We share it only with service providers that work for us under contract, and only as much as they need:
- Hostinger: website hosting, content delivery network, and security.
- Google: Analytics, reCAPTCHA, and email and office tools.
- Beehiiv: newsletter sending and subscriber management.
- Calendly: call scheduling.
- Our group companies and engineers who work on your inquiry or project, bound by confidentiality.
We may also disclose information when the law requires it, to protect our rights or the safety of others, or as part of a merger or sale of the business, in which case this policy continues to apply.
International transfers
Our team works from the United States, Estonia, and Ukraine, and our service providers may process data in the United States and other countries. When information about people in the European Economic Area, the United Kingdom, or Brazil leaves those regions, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-U.S. Data Privacy Framework.
How long we keep it
- Inquiries that do not turn into a project: up to 3 years after our last contact, so we can pick up the conversation if you come back.
- Client project records: as long as the contract and medical device regulations require. Design history files can have retention periods tied to the life of the device.
- Newsletter: until you unsubscribe. Every email has an unsubscribe link.
- Analytics: event-level data for the retention period set in Google Analytics, no longer than 14 months; after that only aggregated reports remain.
Your rights
Depending on where you live, you can ask us to tell you what we hold about you, give you a copy, correct it, delete it, restrict or object to how we use it, or move it to another provider. You can withdraw consent at any time without affecting what happened before. Specifically:
- EU and UK (GDPR, UK GDPR): all the rights above, and the right to complain to your local data protection authority.
- California (CCPA/CPRA) and other US states with privacy laws: the right to know, delete, and correct, the right to opt out of sale or sharing (we do neither), and the right not to be treated differently for using these rights.
- Brazil (LGPD): confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and withdrawal of consent; you can also contact the ANPD.
- Mexico (LFPDPPP): the rights of access, rectification, cancellation, and opposition (ARCO).
To use any of these rights, email info@ovasolutions.com with the subject “Privacy request”. We may ask you to confirm your identity and will answer within the time the law sets, usually 30 days or less.
Security
The site runs over HTTPS, access to our systems is limited to people who need it, and our engineering work follows an ISO 13485:2016 certified quality management system. No system is perfectly secure; if a breach affects your information, we will tell you and the authorities as the law requires.
Children
This site is for businesses and professionals. We do not knowingly collect information from anyone under 16.
Changes to this policy
If we change how we handle personal information, we will update this page and the date at the top. Significant changes will be announced on the site.