What happens to anything you send us.

3.1Requests your browser makes

When you load a page here, your browser is asked to contact the following origins, other than probitysciences.com itself.

The typefaces are the part people usually assume is an exception, so: they are downloaded, subsetted and bundled when the site is built, and served from this site's own domain. Your browser does not ask Google, or anyone else, for them.

3.2What is stored in your browser

The two cookies are set by Google Analytics, described in 3.3. We do not show a cookie banner: United States law does not require one for analytics cookies, and we would rather this page tell you plainly what is set than make you dismiss a box. There is no login, no password, no account, no session and no profile, and any browser setting or extension that blocks Google Analytics stops the cookies without breaking the site.

Your answers to the contact form live in your browser's memory while you are filling the form in, and are gone when you close the tab. Nothing is saved on your device, so a half-finished form is not recoverable and closing the tab discards it.

The one exception on this site is the self-check on the ISO 11607 transition page. If you tick an item or type a note there, your ticks and your notes are saved in your own browser under the name in the table above, so that they survive the page being closed. They stay on your device: they are never sent to us, never sent to anybody else, and we cannot read them. The page carries a control that erases them, and clearing your browser's site data does the same thing. Section 3.9 describes the tools themselves.

3.3Measurement, and protection against automated submissions

Usage measurement in use: Google Analytics 4, turned on 6 August 2026. It counts page views and tells us which pages are read, roughly where in the world visitors are, and what kind of device and browser they use. It sets the two cookies listed in 3.2, loads from the two Google origins listed in 3.1, and sends each page view to Google, which acts as our processor and receives your IP address (see 3.6). We do not enable Google Signals, advertising features or cross-site tracking, so the data is not used to build an advertising profile of you or to follow you to other sites. We use it only to see which of our pages are useful.

Bot protection in use: two things, on the contact form only, neither of which identifies you.

A hidden field

The form contains one field positioned off-screen that a person never sees and never fills in. Automated scripts fill it in. If it comes back filled, the submission is discarded immediately and nothing about it is recorded: not the answers, not the email address, nothing. Only a fixed warning line goes into the log, with no content in it.

A timing token

When the form loads, our server issues a short signed timestamp. It contains a time and a signature and nothing else: no identifier, no IP address, no fingerprint, no data about you. It is not a cookie and is not stored on your device. On submit we check it, which lets us reject submissions made faster than a human can type, and submissions whose token does not carry a valid signature. If that check fails, the submission is discarded and nothing about it is recorded. If the token is instead missing or out of date, the submission is accepted and a one-word note recording that fact is kept beside it. It is not a score, and it changes nothing about how we treat you or your inquiry.

No bot-detection service is called, from your browser or from our server. A challenge service is wired into the form and is switched off: no key is set, so no script loads in your browser and no call is made from our server. If it is ever switched on, it appears in the table in 3.1 and in this subsection first.

We do not use any of this to build a picture of you, and none of it produces an automated decision about you.

3.4The forms on this site, field by field

There is one form on this site, in the sense of something that sends what you type to us. It is on the contact page, it has nine questions in two steps, and this is the complete list. Four other pages carry controls that look like a form and are not one: two calculators, a self-check and a readiness questionnaire, all of which run entirely in your browser and send nothing anywhere. Section 3.9 describes them.

3.5Where a submission goes

When you submit the contact form, two things happen. Our code sends the submission to GoHighLevel, which creates a contact record holding your name, your work email, your six answers about the device and program, your free-text note if you wrote one, and the time of submission. Our code also writes the complete submission to a Vercel log line: all nine answers, including your name, your work email and the full text of anything you wrote in the free-text box, plus the time of submission, the one-word anti-spam note described in 3.3, and the consent record set out in 5.6, whether the box was ticked or not.

The log line is there deliberately, as a backstop. If a submission ever failed to reach GoHighLevel, the log is the thing standing between an inquiry and being lost. It is not analyzed and it is not used for anything except recovering an inquiry that did not arrive any other way.

Everything else our code writes to a log contains no personal information at all: a fixed warning when the hidden field is filled, a short reason code when a token fails a check, and nothing else. Our code never logs an IP address, a browser user-agent string or a referring page. The one URL path it ever writes is the page a consent was given on, which is part of the consent record in 5.6 and is written only when a form is submitted.

3.6Your IP address

This site's own code never stores, logs or transmits your IP address. There is one point in the submission handler where the address is read from the request and passed to the bot-check function described in 3.3, which is switched off and returns before making any outside call. The value is discarded without being used. It is not written to any log or record we keep.

As noted in 3.5, Vercel sees IP addresses at the network layer, as every host does, and they appear in the platform request logs. That is outside this site's code and is governed by Vercel's own terms.

Google Analytics also receives your IP address, because your browser sends each page view directly to www.google-analytics.com, as described in 3.3. Google uses it to estimate the rough location of a visit and does not expose it to us: we never receive your IP address from Google and we never store it ourselves. If you would rather Google did not receive it, blocking Google Analytics in your browser stops the page view being sent at all.

3.7Email you send us

If you email info@probitysciences.com, we receive your message, your email address, your name as your mail client presents it, and anything you attach. The message is delivered and stored by a third-party email provider in the ordinary way that any business mailbox works, and we keep it so we can reply and so there is a record of the exchange.

Email is also how the supplier qualification pack is requested, and how a call is arranged. Anything you send us that way is covered by this subsection.

We have not named the email provider here because we would rather leave it out than name the wrong one. Ask us and we will tell you which one it is.

3.8Things we are told rather than things we can prove

Everything else in section 3 is a fact about code we control and can show you. The following are not. They are set inside other companies' systems, and the honest thing to do is say who confirmed them and when, rather than present them with the same confidence as the rest.

Section 10.2 explains why these are separated out and what the limit of our own checking is.

3.9The calculators, the self-check and the questionnaire

Four pages carry controls you can type into. None of them is a form, none of them sends anything anywhere, and none of them is watched.

All four compute in your browser, using code that arrived with the page. There is no request to us and no request to anybody else while you type or when a result appears, nothing is computed on our servers, and no event is recorded anywhere. We do not know that you used one, what you entered, or what came out.

The transition self-check is the only one of the four that keeps anything, and it keeps it on your own device: your ticks and your notes, under the name given in 3.2, so they are still there if you come back. Its own page says so beside the controls, it carries a control that erases them, and nothing about them ever reaches us. The readiness questionnaire keeps nothing: close the tab and the answers are gone.

The printable and downloadable output these tools offer is generated in your browser. The calculators and the self-check hand the page to your browser's own print function; the questionnaire builds a plain text summary your browser saves to your machine. No file is generated by us, nothing is uploaded, and neither printing nor downloading tells us anything.

4.1What we may add

Within the boundaries below, adding something is an update to this page and not a departure from it:

• a challenge on a form, if the form starts attracting automated submissions;
• typefaces, diagrams or other assets served by another company;
• a way to book a call directly on the contact page;
• further forms, collecting the same kinds of business contact detail already listed in 3.4;
• the optional phone field and text message consent described in 5.4.

Each of those would appear in section 3, with the company involved named, before it went live.

4.2What we will never add

These are not descriptions of our current setup. They are rules, and they do not change.

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising. Because we do neither, a Global Privacy Control signal has nothing here to switch off. That stays true whatever else we add, because sale and sharing are on this list.
• No advertising, no retargeting, no conversion pixels.
• No session recording and no keystroke capture.
• We do not buy personal information from data brokers, and we do not use bought, rented or shared contact lists.
• No third party will be allowed to collect information about your activity on other websites through this site. That is a rule we hold ourselves to, not a description of a current configuration.
• Nobody is cold-called, and nobody is sent a text message who has not asked to be.
• Nothing goes to a testing laboratory unless you engage us and we have agreed together which laboratory, and what is being sent.

5.1Answering your inquiry

Sending the form, or emailing us, is asking to be contacted back. Replying to you, and following up about the same subject, is not marketing and does not need a marketing consent. It is the thing you asked for. Concretely, sending the form means:

• we read it and reply to the email address you gave;
• a record of the inquiry is created in the systems named in 3.5;
• we may follow up about that inquiry if you go quiet. The boundary is a number, not a mood: at most three follow-ups, within 90 days of the last message you sent us, about the subject you raised and nothing else. Any new message from you restarts that window. Every follow-up carries one line telling you how to make it stop;
• nothing else. No list, no sequence, no text message, no call unless you ask for one.

Sending the form does not sign you up for anything, and submitting a form is never treated as consent to marketing. The checkbox described in 3.4 is the only way to ask us for anything beyond a reply, and leaving it alone costs you nothing.

5.2Occasional email about standards work

This is a separate checkbox, unticked when the page loads, that you have to tick, with the description of what arrives written next to it. It is never a condition of getting a reply, of getting a document, or of anything else. Every message will carry a working way to stop it, and stopping takes effect immediately.

As at the date at the top of this page the checkbox is on step 2 of the contact form, and no such email has been sent to anyone. See 3.4.

5.3Text messages

As at the date at the top of this page, this site collects no phone number and we send no text messages. We are not registered to send business text messages in the United States and we do not send any. Nothing on this site should be read as saying otherwise.

The rest of 5.3 describes the rules we have set for that program if it ever runs, so that you can see them before rather than after. Section 5.4 sets out what would have to be true first.

Scope, deliberately narrow

Text messages would be for two things only: a short reply about your own inquiry, and messages about a call you have arranged, such as a confirmation, a change of time or a reminder. No promotional or marketing text messages, at all.

How consent would be given

By ticking a checkbox that is unticked when the page loads, next to a phone number you typed in yourself. The description sits next to the box, not behind a link, and it names us, says what the messages are about, says that frequency varies, says that message and data rates may apply, says how to stop and how to get help, and says in the same breath that consent is not required to contact us or to get a reply. The box is never pre-ticked, never bundled with anything else, and never a condition of anything. Leaving it alone costs you nothing.

How you would stop it

Reply STOP to any message. You can also just say so, in any words, by any route that reaches us, including email. STOP is not the only way out, and a reply like "please take me off this" is treated exactly the same as the word STOP. We would stop as soon as we saw it, and in any case within ten business days. You would get one plain confirmation message and nothing else.

5.4What would have to be true before any of that happened

We are setting this out because a page that describes a program should say plainly whether the program exists. This one does not.

Every one of those steps would appear in section 3 and in the change log in 10.3 as it happened. Nothing on this site claims that any of it is done.

5.5Stopping, and what a consent never covers

Tell us to stop, in any words, by any route, and we stop. Reply STOP to a text if you ever get one, click the unsubscribe link in any email that carries one, or just email info@probitysciences.com and say so. We do not require a particular form of words and we do not require you to use a particular channel.

5.6What we record to show you agreed

If you ever tick a consent box on this site, we record what you agreed to and when, so that in two years it is possible to say exactly what you saw. That record is:

• the fact of the consent, and which one it was;
• the date and time;
• the exact wording that was on the screen at the moment you ticked it, saved word for word rather than as a pointer to whatever the page says now;
• a version identifier for that wording;
• which page you were on;
• how it was given, which for this site means a checkbox on a web form;
• the phone number a text message consent attaches to, if it is that one;
• your IP address, only if it is a text message consent, for the reason given in 3.6;
• if you later stop it: the date and time you did, and how you told us.

No consent record is ever deleted when you withdraw. Withdrawal marks the record; it does not remove it. The record is the evidence that we contacted you because you asked us to, and that we stopped when you told us to. Section 6 says how long we keep it and is honest about the fact that this is longer than we keep most things.

As at the date at the top of this page no consent record exists for anyone, and the checkbox described in 3.4 is the only one that could create one.

One clarification, because the number appears elsewhere on this site

Other pages state that records are retained for seven years. That figure is about project records for engaged clients, kept under our own quality procedures. It is not a retention period for website inquiries, and this page does not extend it to anyone who fills in the contact form.

7.1California

California law gives residents rights over their personal information, including rights to know, to access, to correct, to delete, and to opt out of the sale or sharing of personal information. Some of those rights sit in statutes that apply only to businesses above certain size thresholds. Rather than argue about where this practice sits, we offer the rights in section 2 to everyone. The rest of what you would want to know:

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. That is in section 4.2 and it does not change, so there is nothing here for you to opt out of.
• No third party collects information about your activity across other websites through this site. Section 3.1 is the evidence and section 4.2 is the rule.
• The categories we collect are: identifiers (your name, your work email, and a phone number if you give us one for a call you arranged); commercial or professional information (your answers about a device and its packaging, and anything you volunteer in the free-text box or in an email, including attachments); and internet or other electronic network activity information (an IP address, the pages you view, timestamps, and general device and browser information), collected through Google Analytics as described in 3.3 and present in the platform request logs kept by Vercel rather than by us. We collect all of it directly from you, and only from you: Google Analytics gathers the network-activity information on our behalf as a processor, and even so it comes from your visit and from no other source. We do not buy personal information from data brokers or obtain it from any other source.
• We use it to reply to you and to run the work, and nothing else.

7.2Washington

Washington's My Health My Data Act regulates consumer health data. This site does not collect consumer health data. Every field on every form on this site is listed in 3.4, and none of them asks about anyone's health. They ask what the product is, its class, how it is sterilized, how it is packaged, whether the sealing process is validated, and when you plan to submit.

The free-text box is the one place where we cannot control what arrives. We ask you in 3.4 not to put health information in it. If health information about you or anyone else reaches us anyway, we do not want it, we will not use it for any purpose, and we will delete it from the records we control as soon as we notice it.

7.3Outside the United States

This practice is based in Washington State and operates in the United States. Vercel and our customer relationship management provider are United States companies, and we have not asked either to process your information outside the United States. Where their infrastructure physically sits is governed by their own terms, not by us.

We do not target visitors in the European Economic Area or the United Kingdom, and this page is written to United States law. We do not claim compliance with the GDPR or the UK GDPR, because claiming a compliance program we have not built would be exactly the kind of statement this page exists to avoid.

If you are outside the United States and you have a question about information you have sent us, email info@probitysciences.com. The rights in section 2 are offered to you the same as to anyone else.

Two honest limits

We do not hold, and do not claim, any security certification such as SOC 2 or ISO 27001. And no method of transmitting or storing information is completely secure, so we cannot promise absolute security.

If something happened that exposed information you sent us, we would tell you. That is a commitment we are choosing to make: the law does not require notification for every kind of information, and we would rather you heard it from us.

10.1The commitments

1

This page is updated before something is switched on, not after. That is how Google Analytics arrived: the cookies, the Google scripts and the measurement in section 3 were disclosed in the same change that turned them on, on 6 August 2026. The same rule holds for whatever is next: a challenge on the form, a second form, a phone field, a single text message.

2

If the inquiry records described in 3.5 are connected, this page is updated on the same day.

3

If we ever start sending email that is not a reply to your own inquiry, this page will say so, and you will have had to tick a box first.

4

The date at the top moves whenever section 3 moves, and the change is listed in 10.3.

10.2Where the limit of our own checking is

Some things are set in our hosting platform and in the systems we use rather than in our code, and a check that reads our code cannot see those. Section 3.8 lists them, says who confirmed them, and says when. We would rather draw that line clearly than imply a machine is checking something it cannot see.

Everything else in section 3 is a fact about our own code, in a repository one person controls, and the same person writes both the code and this page in the same change.

10.3Change log