Draft · the highlighted sections still need the client's legal details before this page can go live.

Privacy

Last updated 14 September 2026

This page explains what happens to the details you send through the request form, and what this site measures while you read it. It covers rebellionx.health only.

Who is responsible

Pending — client The legal entity that decides how these details are used (the data controller), its registered address and company number. Likely Coba Biomedical, possibly jointly with Kingfisher Medical as distributor — that relationship needs confirming, because a joint arrangement has to be described here.

Requests sent through this site are handled on that entity's behalf by Good Fortune, its agency, which receives the notification email.

What we collect

When you request a demo

The form asks for five things, and records a little context alongside them:

Name: So we know who we are replying to.
Hospital or company: To understand the setting you operate in.
Country: Rebellion X is not available in every market; this tells us whether we can help.
Email: The only way we contact you. We do not ask for a phone number.
What you are asking about: Evaluation unit, hospital order or distribution.
Page and referrer: The address of the page you sent the form from, and the site you arrived from, if any.
Campaign tags: If you arrived through a link carrying utm_ or click-id parameters, those are recorded so we know which campaign reached you.

We do not ask for, and have no use for, any information about patients, procedures or health. Please do not put any in the form.

While you read the page

If you agree to it, Google Analytics records which pages were opened, roughly where in the world from, and which link brought you here. It is set up for measurement only: advertising and personalisation signals are switched off everywhere, for everyone.

Our host records ordinary server logs — IP address, browser, time of request — as every web server does, to serve the page and to spot abuse.

Why we are allowed to hold it

Your request. When you ask us to send an evaluation unit, we use your details to answer — the step before a contract, at your own initiative.
Your consent. Analytics runs only if you agree, and you can change your mind at any time, below.
Our legitimate interest. Keeping the site up, and keeping spam and abuse off the form.

Cookies and analytics

The site sets no cookies of its own. Two things are stored in your browser:

rbx-consent: Remembers whether you accepted or declined analytics, so you are not asked twice. Stored in your browser only; it never reaches us.
Google Analytics: Sets its own cookies, and only after you accept. Decline, and none are written.

In the EEA, the UK and Switzerland nothing is stored until you say yes — that is enforced by Google against your IP address, not just by the banner. Everywhere else, analytics is on by default and you can turn it off here:

Checking your current choice…

Your choice applies to this browser on this device.

Who else sees it

We do not sell your details, and we do not share them for anyone else's marketing. Four services process them so the site can work:

Nexus Communications: Receives the form, stores the submission and passes it on as a sales lead.
Vercel: Hosts the site and serves these pages.
Google Analytics: Measures page usage, if you agreed to it.
Google Fonts: Serves the two typefaces this page uses. Your browser fetches them from Google, which means Google sees your IP address when the page loads.

Pending — client Whether to keep serving fonts from Google or self-host them. Self-hosting removes the last third party that sees a visitor's IP before any consent is asked for, and is a half-hour change. Worth deciding before this page is published, because whichever way it goes has to be described accurately here.

Where it goes

Pending — client All four processors above are US-headquartered, so requests sent from Europe involve an international transfer. This section has to name the safeguard actually in place for each one — Standard Contractual Clauses, the EU–US Data Privacy Framework, or both — and that means checking the signed agreements rather than assuming.

How long we keep it

Pending — client A retention period for form submissions and for the CRM lead they become. "Until you ask us to delete it" is not a period. A concrete figure is needed — for example two or three years after the last contact — along with what happens at the end of it. Google Analytics has its own retention setting in the property, which should be set to match rather than left at the default.

Your rights

If you are in the EEA or the UK, you can ask us to show you what we hold about you, correct it, delete it, limit what we do with it, hand it over in a portable form, or stop using it altogether. Where we rely on your consent, you can withdraw it at any time without affecting what was done before. Asking costs nothing, and we will answer within one month.

If you think we have handled your details badly, you can complain to your national data protection authority.

Our replies

When we answer your request, the reply carries this notice:

Private and Confidential: the whole contents of this email are intended for the sole attention of the original addressee/s only. Further propagation of this email or its contents in any form may result in legal action against the responsible individual/s. The Company is hereby indemnified from any reliance on the information contained in this email by any person to whom this email was not intentionally addressed. If this email was not addressed to you or received in error kindly inform the sender and/or Company to void personal liability.

It applies to our correspondence with you, not to this page, which is public.

Pending — client The notice says "the Company" without naming one, which is the same gap as Who is responsible above: whichever entity is named there has to be named here. Worth knowing too that a disclaimer appended after the fact binds nobody who has not agreed to it — it signals intent, it is not a contract — so it is no substitute for simply not putting anything confidential in an email.

Contact

Pending — client A published address for privacy requests. This has to be a mailbox somebody actually monitors and can act on within the one month the law allows — a generic info@ that nobody owns is where these requests go to die. Also: whether a Data Protection Officer or an EU representative has been appointed, because if so, naming them here is mandatory.

Changes

If this page changes, the date at the top changes with it. Material changes will be flagged on the site rather than made quietly.