Privacy Policy

Last Updated Date: Apr 20, 2026

This Privacy Policy describes how Codimite PTE LTD (“Codimite,” “we,” “our,” or “us”) handles information in connection with your organization’s use of VLauncher, a ChromeOS-optimized solution that enables secure and seamless launching of virtualized desktops and applications in enterprise healthcare environments.

VLauncher is designed to operate fully within your organization’s managed infrastructure. This policy follows privacy-by-design principles and reflects our commitment to security, transparency, and regulatory compliance.

This Privacy Policy applies to the entire VLauncher ecosystem, distinguishing clearly between our web-based administrative systems and the on-premise execution software. This includes our cloud-hosted administrative properties—the Customer Portal, Licensing Server, and Website—as well as the strictly on-premise VLauncher Product (comprising the Backend, Admin Studio, Configurator, and Chrome Extension). For the cloud administrative services, Codimite acts as the Data Controller regarding your subscription and billing data. For the on-premise VLauncher Product, your organization remains the exclusive Data Controller of all enterprise data.

The on-premise VLauncher Product enforces an architecturally mandated strict data isolation perimeter. Under no circumstances does Codimite access, store, receive, process, intercept, or transmit the following via our cloud infrastructure:

VLauncher processes only minimal, non-sensitive device-level metadata required to register ChromeOS devices and support secure virtual desktop launching. This includes:

Account & Billing Data (Customer Portal): We collect names, business email addresses, domain names, and payment/billing information (processed securely via our payment partners) to manage subscriptions, upgrades, and downgrades.

Telemetry & Licensing Data (Runtime & Extension): To enforce subscription tiers (e.g., Freemium limits), we securely transmit and validate Client IDs, Device IDs, and anonymized performance metrics (process start/end times).

Infrastructure & Configuration Data (Configurator/Admin Studio): Note on Security: VLauncher requires connection details for Active Directory (AD), LDAPS Service Accounts, and VDI providers (Citrix/Omnissa). This sensitive configuration data is strictly stored and encrypted locally within your cluster’s ETCD and Patroni infrastructure. We do not transmit, view, or store your AD passwords or VDI administrative credentials on our cloud servers.

We use the information we collect for various purposes, including:

VLauncher operates on a strictly bifurcated processing model. All core execution, Active Directory bridging, and virtual desktop launching operations occur locally and exclusively within your firewalled enterprise environment. The VLauncher Product communicates strictly via local ChromeOS policies and your internal virtualization infrastructure (Citrix or Omnissa). The cloud-hosted Licensing Server functions only as a subscription validation endpoint. VLauncher does not route your internal enterprise data through third-party cloud data lakes or external processing engines.

VLauncher is designed as a secure launcher infrastructure that brokers connections to VDI environments (like Epic on Citrix). VLauncher does not collect, process, transmit, or store Protected Health Information (PHI).

VLauncher is designed as a secure launcher infrastructure that brokers connections to VDI environments (like Epic on Citrix). VLauncher does not collect, process, transmit, or store Protected Health Information (PHI).

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have specific rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, or erase your personal data, restrict or object to processing, and lodge a complaint with your local data protection authority.

Codimite processes your personal data only when necessary for the performance of a contract (providing the VLauncher service), compliance with legal obligations, and legitimate business interests. We have established Data Processing Agreements (DPAs) with our subprocessors and use EU Standard Contractual Clauses (SCCs) to ensure lawful data transfers outside the EEA. No data is stored by default beyond what is strictly necessary to maintain your subscription, and you may request deletion of your account at any time.

VLauncher is developed and maintained following industry security standards, including secure coding practices, access control principles, SAST scanning, dependency checks, and code signing. We use commercially reasonable administrative, technical, and physical security measures (e.g., TLS in transit, AES-256 at rest) to protect your personal information.

Data Retention: We retain cloud-based billing and portal data as long as your account is active, or as required by financial compliance laws. Once uninstalled, all locally stored VLauncher data, including audit logs and ETCD configurations, are purged from your environment.

Codimite enforces robust Data Subject Access Request (DSAR) protocols in compliance with the GDPR, UK GDPR, Swiss FADP, and applicable US State jurisdictions (e.g., CCPA/CPRA). DSAR routing is strictly determined by the data subject’s relationship to the product:

To deliver enterprise services, Codimite utilizes vetted sub-processors (e.g., SOC 2 Type II compliant payment gateways like Stripe) to securely process financial transactions. Codimite does not store full Primary Account Numbers (PAN). The on-premise VLauncher Product interfaces with your proprietary deployments of Citrix or Omnissa; Codimite disclaims liability for the privacy practices, vulnerabilities, or operational continuity of these independent third-party architectures.

This Privacy Policy is subject to annual review by our security and legal teams. We reserve the right to deploy updates reflecting architectural enhancements, threat landscape shifts, or evolving regulatory mandates. For material changes affecting data processing scopes within the Customer Portal, Codimite will provide a minimum of thirty (30) days’ conspicuous prior notice via portal alerts or direct administrative email communication.

If you have any questions or concerns about this Privacy Policy, please contact us. Codimite will acknowledge and respond to privacy-related inquiries within 30 days, in accordance with applicable data protection regulations.