Privacy Policy
Effective date: 6 November 2026
This Privacy Policy explains how Summit Imaging, Inc., a Missouri corporation doing business as "NewCura" (founded in 1999) ("NewCura," "we," "us") collects, uses, shares and protects personal information when you visit newcura.com (the "Site"), fill in a form on it, book a demo, or receive our marketing email. It also explains the choices and rights you have.
In short:
- We make software for healthcare organizations (endoscopy imaging, reporting and scope tracking). The Site is for business visitors.
- We don't collect patient information (PHI) on the Site. Please don't put any patient information in our forms or emails.
- When you fill in a form, what you send is delivered by email to our sales or support team so they can reply. Our team may then record your inquiry in our customer relationship management system, Microsoft Dynamics 365.
- We use Google Analytics only if you accept analytics cookies in our cookie banner. We don't use advertising cookies or trackers.
- We send marketing email only if you opt in, and you can unsubscribe at any time.
This policy covers the Site and the communications that come from it. It does not cover patient or other data that our customers process using NewCura products (EndoManager® EMS, EndoManager Reporting, ScopeCycle®). For that data, our customer (the healthcare organization) decides how it is used, and we act on its instructions under our contract with it.
1. Who we are (data controller)
For personal information collected through the Site, the controller (under GDPR and UK GDPR) and the "business" or "controller" (under US state privacy laws) is:
Summit Imaging, Inc. d/b/a NewCura 200 Unity Cir, Suite A Lee's Summit, MO 64086 United States Email: privacy@newcura.com
Data protection officer: NewCura has not appointed a data protection officer because one is not required. Privacy questions go to our Privacy Officer at privacy@newcura.com.
2. Information we collect
2.1 Information you give us
| When | What we collect |
|---|---|
| Demo, quote and contact forms | Name, work email, phone number, organization, your message, and, if you choose to tell us, facility type, number of procedure rooms, scope brands in use, records system (EHR), image archive, current/legacy endoscopy system, buying timeline, topic, preferred contact time. You also confirm that your message contains no patient information. |
| Support case form (existing customers) | Name, facility, callback number, email, product, a description of the issue and, optionally, how many rooms are affected. |
| Demo booking (a short form, then a Microsoft Bookings calendar shown on our page) | The demo request form collects your name, work email, facility or health system, role (job title) and records system (EHR). The Bookings scheduler loads only after you click to pick a time, and collects the details Microsoft Bookings asks for (such as name, email and the time you choose). Appointments are kept in Microsoft 365 and are not added to our CRM automatically. |
| Marketing email opt-in (we have no separate newsletter sign-up; our forms include an unchecked marketing-email checkbox) | Your email address and your choice. |
| Email or phone | Whatever you choose to send or tell us. |
We ask you not to send us patient information (names, dates of birth, medical record numbers, images or other protected health information). The Site is not designed to receive it. Our forms automatically reject messages that appear to contain medical record numbers or dates of birth. If patient information still reaches us, we will delete it and let the sender know.
We do not intend to collect "sensitive" personal information (as defined by GDPR Art. 9 or US state laws) through the Site.
2.2 Information collected automatically
- Analytics (only with your consent). If you click "Accept" in our cookie banner, we use Google Analytics 4, provided by Google LLC, to understand how visitors use the Site (for example, pages viewed, referring site, browser and device type, approximate location such as country or city, and events such as form submissions). Google Analytics sets first-party cookies (see section 2.3). Until you accept, Google Analytics does not set cookies; we use Google Consent Mode v2 with analytics and advertising storage set to "denied" by default. Google Analytics 4 does not log or store full IP addresses; Google uses the IP address to derive approximate location and then discards it. We have turned off Google Signals and ads personalization, and we do not link analytics data to Google advertising products. Google's handling of this data is described at https://policies.google.com/privacy (opens in a new tab) and https://support.google.com/analytics/answer/6004245 (opens in a new tab).
- Server and security logs. Our hosting provider, Vercel Inc., records request logs (IP address, time, URL, browser type, response status) to deliver the Site and protect it from abuse, and keeps them for a short period set by Vercel, typically no more than 30 days.
- Cookies. We use a strictly necessary cookie to remember your cookie choice, and analytics cookies only if you accept them (see section 2.3). We don't use advertising cookies. Demo scheduling works differently: after you fill in the demo request form, you can click to load Microsoft's Bookings scheduler on our page. The scheduler is provided by Microsoft and sets Microsoft cookies, which Microsoft needs to run it. It doesn't load, and sets no cookies, until you choose to open it. If you'd rather not, you can call us at 866.578.5713 to schedule instead. Microsoft's handling of this information is described in the Microsoft Privacy Statement (opens in a new tab).
- Form spam protection. Our forms use Cloudflare Turnstile to check that a person, not an automated bot, is sending them. Turnstile looks at technical signals from your browser and device (such as IP address and browser characteristics) to make that check, and Cloudflare handles that information under the Cloudflare Privacy Policy (opens in a new tab). Turnstile is confirmed in use and runs on our forms regardless of your cookie choice, because it is needed to secure the forms.
2.3 Cookies and your cookie choices
When you first visit the Site, a cookie banner asks whether you accept analytics cookies. "Accept" and "Reject" are shown with equal prominence, and closing the banner without choosing counts as reject. You can change your choice at any time using the "Cookie settings" link in the footer of every page. If your browser sends a Global Privacy Control (GPC) signal, we treat it as "Reject" for analytics cookies (and as an opt-out of sale and sharing), and we don't load Google Analytics for that browser.
| Cookie | Provider | Category | Purpose | Expires |
|---|---|---|---|---|
| `nc_cookie_consent` | NewCura (first party) | Strictly necessary | Remembers your cookie choice so we don't ask on every page (stores only "granted" or "denied" and an expiry date) | 365 days |
| `_ga` | Google LLC (Google Analytics 4), set as first party | Analytics (consent only) | Distinguishes visitors so we can count unique users | 2 years |
| `_ga_<container-id>` | Google LLC (Google Analytics 4), set as first party | Analytics (consent only) | Keeps the state of your visit (session) | 2 years |
| `NID` | Google LLC (Google Maps embed on our Contact page) | Functional (set only after you click "Accept" or click to show the interactive map) | Remembers map preferences | About 6 months |
| `__cf_bm` | Cloudflare, Inc. | Strictly necessary | Bot and abuse protection | 30 minutes |
| `cf_clearance` | Cloudflare, Inc. | Strictly necessary | Records that a security check was passed | About 30 minutes |
| `_cfuvid` | Cloudflare, Inc. | Strictly necessary | Rate limiting and abuse protection | Session |
| `ClientId` (on bookings.cloud.microsoft) | Microsoft | Functional (set only after the scheduler loads, which happens only if you click to open it) | Runs the demo scheduler. Microsoft may set other cookies. | About 1 year |
Cloudflare Turnstile on our forms is a security tool; see "Form spam protection" above. We do not use advertising or social-media cookies. Google Analytics data is kept for 2 months and then deleted by Google.
2.4 Information from other sources
We don't buy contact lists or add data about you from other sources.
3. How we use information and our legal bases
GDPR and UK GDPR require us to state a legal basis for each use. We rely on the following:
| Purpose | Information used | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Replying to your inquiry, demo request or quote request, and following up about it | Form and booking data, emails | Taking steps at your request before entering into a contract (Art. 6(1)(b)), and our legitimate interest in responding to business inquiries (Art. 6(1)(f)) |
| Keeping a record of our relationship with your organization in our CRM (Microsoft Dynamics 365) | Form data, correspondence history | Legitimate interest in managing business relationships and sales (Art. 6(1)(f)) |
| Providing support to existing customers | Support case data | Performance of our contract with your organization (Art. 6(1)(b), where you are the contracting party) and legitimate interest in supporting our customers (Art. 6(1)(f)) |
| Sending marketing email | Email address, name, consent record | Your consent (Art. 6(1)(a)). You can withdraw consent at any time. |
| Understanding Site usage and improving the Site (Google Analytics 4) | Analytics cookie data, pages viewed, device and approximate location | Your consent (Art. 6(1)(a)), given through the cookie banner; withdraw anytime via "Cookie settings". Consent also satisfies ePrivacy/PECR for the cookies. |
| Remembering your cookie choice | Consent cookie | Legal obligation to record consent (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)); strictly necessary under ePrivacy/PECR |
| Keeping the Site and our systems secure, preventing spam and fraud | Server logs, form metadata | Legitimate interest in security (Art. 6(1)(f)) |
| Meeting legal obligations, enforcing our terms, and handling legal claims | Any relevant information | Legal obligation (Art. 6(1)(c)) and legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for more information about that assessment and you have the right to object (see section 8).
We do not use Site data for automated decision-making that has legal or similarly significant effects on you, and we do not sell it, rent it, or use it for targeted advertising.
4. Who we share information with
We share personal information only as described here.
Service providers (processors). These vendors process information for us under contracts that limit their use of it to providing services to us:
| Provider | What they do for us | Data involved |
|---|---|---|
| Microsoft Corporation (Microsoft Dynamics 365) | Customer relationship management: stores records of inquiries our team enters, and sends marketing email to people who opted in | Form data, correspondence, consent and unsubscribe records |
| Microsoft Corporation (Microsoft Bookings) | Demo scheduling (the Microsoft Bookings calendar on our demo page, loaded only after you click) | The details Microsoft Bookings asks for (such as name, email and the time you choose) |
| Microsoft Corporation (Microsoft 365) | Business email | Emails you send us |
| Our email service provider | Delivering website form submissions to our team by email | Form data |
| Google LLC (Google Analytics 4) | Site analytics, only if you accept analytics cookies | Analytics cookie identifiers, pages viewed, device and browser data, approximate location (IP used transiently, not stored) |
| Cloudflare, Inc. (Cloudflare Turnstile) | Spam and bot protection on our forms | IP address, browser and device signals |
| Vercel Inc. | Hosting and delivering the Site | Server logs, form traffic in transit |
| Vercel Inc. (Vercel Web Analytics) | Cookieless page-view counts (no cookies or device identifiers; runs regardless of the cookie choice) | Page URL, referring site, browser and device type, approximate country |
| Google LLC (Google Maps) | Map embed on our Contact page, loaded only after you accept cookies or click to show the map | IP address, browser data, map cookie |
Other disclosures. We may also disclose information: (a) if required by law, regulation, court order or valid legal process; (b) to protect the rights, property or safety of NewCura, our customers or others; (c) to professional advisers (such as lawyers and auditors) under confidentiality obligations; and (d) as part of a merger, acquisition, financing or sale of all or part of our business, in which case the recipient will be bound to handle the information consistently with this policy.
No sale or sharing. We use Google Analytics as a service provider for our own analytics, with Google Signals and ads personalization turned off. We do not sell personal information and do not "share" it for cross-context behavioral advertising (as those terms are defined in the California Consumer Privacy Act), and we do not process it for targeted advertising (as defined in other US state laws). We have not done so in the past 12 months. See Your Privacy Choices.
5. International transfers
NewCura is based in the United States, and the Site and our CRM are operated from or hosted in the United States. The Site is hosted by Vercel in its US East region (iad1), and cached pages are delivered from Vercel's edge network worldwide. Our CRM (Microsoft Dynamics 365) is hosted in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your information will be processed in the United States, which does not have an EU "adequacy decision" for all organizations.
Where a transfer mechanism is required, we rely on:
- where required, safeguards such as the European Commission's standard contractual clauses in our vendor agreements; and
- where applicable, the derogations in GDPR Art. 49 (for example, where the transfer is necessary to take steps you requested before entering into a contract).
You can ask for a copy of the relevant safeguards by contacting us (section 12).
6. How long we keep information
We keep personal information only as long as we need it for the purposes in this policy:
- Sales inquiries (Leads) are kept while we are in active contact with you or your organization. If there has been no engagement (such as a reply, meeting, form submission or request) for 24 months, we delete or anonymize the Lead.
- Contacts at customer organizations are kept for the life of the customer relationship and then for 7 years after the relationship ends to meet contractual, tax and legal obligations.
- Website support requests are kept for 24 months.
- Marketing consent and unsubscribe records are kept for as long as you are subscribed and for 3 years afterwards to show we had consent. If you unsubscribe, we keep the minimum needed (for example, your email address on a suppression list) so we don't email you again.
- Analytics data in Google Analytics is kept for 2 months, then deleted automatically. Analytics cookies expire after about 2 years.
- Server and security logs are kept for a short period set by our hosting provider, Vercel, typically no more than 30 days.
We may keep information longer where the law requires it or where it is needed for a legal claim.
7. How we protect information
We use administrative, technical and physical safeguards appropriate to the information we handle, including encryption in transit (HTTPS/TLS), role-based access to Dynamics 365 and multi-factor authentication. NewCura's controls are independently audited. Our SOC 2 Type 2 report is available on request under NDA. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8. Your rights (EEA, UK and Switzerland)
If GDPR, UK GDPR or the Swiss FADP applies to you, you have the right to:
- access your personal information and get a copy;
- correct inaccurate information;
- delete your information ("right to be forgotten");
- restrict our processing;
- object to processing based on legitimate interests, and to object at any time to direct marketing;
- data portability, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, without affecting processing that took place before; and
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where an alleged infringement occurred. In the UK this is the Information Commissioner's Office (ico.org.uk).
To use these rights, contact us (section 12). We will respond within one month, which may be extended by two further months for complex requests, as GDPR allows. We may need to verify your identity first.
9. Your rights (United States)
9.1 California
This section is our notice at collection and privacy policy disclosure under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"). It applies to California residents, including people acting in a business capacity.
Categories of personal information we collect:
| CCPA category | Examples | Source | Business purpose | Disclosed to | Sold or shared? |
|---|---|---|---|---|---|
| Identifiers | Name, email, phone, IP address (including the IP address checked by Cloudflare Turnstile) | You; your device | Responding to inquiries, sales, support, security | Service providers (section 4) | No |
| Professional or employment-related information | Organization, facility type, role (job title) | You | Responding to inquiries, sales, support | Service providers | No |
| Commercial information | Products of interest and scoping answers (number of rooms, scope brands, records system, image archive, legacy system, buying timeline) | You | Sales, quoting | Service providers | No |
| Internet or other electronic network activity | Pages viewed, referring site, browser type (Google Analytics, only after you click "Accept"; Vercel cookieless analytics; server logs) | Your device | Site analytics, security | Service providers | No |
| Geolocation (approximate) | Country or region derived from IP address by Google Analytics, only after you click "Accept" | Your device | Site analytics | Service providers | No |
We do not collect sensitive personal information as defined by the CCPA, and we do not use or disclose any for purposes that would give rise to a right to limit. We do not knowingly sell or share the personal information of consumers under 16.
Retention: see section 6.
Your California rights: to know what personal information we collect, use and disclose (including specific pieces); to delete it; to correct it; to opt out of sale or sharing (we do neither); to limit use of sensitive personal information (we collect none); and not to be discriminated or retaliated against for using these rights.
How to make a request: email privacy@newcura.com. We accept privacy requests by email only. We will confirm receipt within 10 business days and respond within 45 calendar days (extendable by another 45 days with notice). We verify requests by matching the information you give us with what we hold, including by confirming that you control the email address on file. You may use an authorized agent; we may ask the agent for signed permission and ask you to verify your identity directly.
Global Privacy Control: we honor GPC signals as a request to opt out of sale and sharing. If your browser sends GPC, we treat it as rejecting analytics cookies, and we won't record marketing consent from a form you submit. See Your Privacy Choices.
Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.
Do Not Track: browsers' "Do Not Track" setting has no agreed standard, so we don't respond to it. We do honor Global Privacy Control: a GPC signal is treated as rejecting analytics cookies and as an opt-out of sale and sharing. We do not track visitors across third-party sites and do not use advertising cookies.
9.2 Other US states
Residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas and Oregon, may have some or all of these rights, depending on the state:
- to confirm whether we process your personal data and to access it;
- to correct inaccuracies;
- to delete it;
- to get a portable copy;
- to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do none of these); and
- in some states, to get a list of the third parties to which we have disclosed personal data.
Many of these laws do not apply to information about individuals acting in a commercial or employment context, which covers most Site visitors. We extend the rights above to all US residents who contact us, whether or not a state law strictly requires it.
How to make a request: as described in section 9.1. We will respond within 45 days (extendable by another 45 days where permitted).
Appeals: if we decline to act on your request, you can appeal by emailing privacy@newcura.com with the subject line "Privacy request appeal" within 45 days of our decision. We will respond in writing within the period your state law requires (generally 45 or 60 days) and explain our decision. If you are not satisfied, you can contact your state attorney general.
10. Marketing email
We send marketing email only to people who have opted in. Every marketing email includes an unsubscribe link, and you can also unsubscribe by emailing privacy@newcura.com. We will process unsubscribe requests within 10 business days. Even if you unsubscribe, we may still send you service or transactional messages, such as replies to your inquiry or support updates.
11. Children
The Site is intended for business users and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.
12. Contact us
For privacy questions or requests:
Summit Imaging, Inc. d/b/a NewCura Attn: Privacy Officer 200 Unity Cir, Suite A, Lee's Summit, MO 64086, United States Email: privacy@newcura.com Phone: 866.578.5713 (toll-free) or 816.246.5777
13. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a new "last updated" date and, if the changes are significant, we will give more prominent notice by posting a notice on the Site and updating the "last updated" date.
Last updated: 6 November 2026