Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide to us when you:

• Request a demo: Name, email address, company name, trial phase of interest
• Contact us: Name, email, company, and any information you choose to include in your message
• Subscribe to communications: Email address and communication preferences

1.2 Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and usage:

1.3 Information from Third Parties

We do not purchase or collect personal information from third-party data brokers. However, we may receive information from:

• Business partners who refer you to our services
• Publicly available sources relevant to clinical trial operations
• Analytics providers (e.g., Google Analytics) regarding website usage patterns

2. How We Use Your Information

We use the information we collect for the following purposes:

3. How We Share Your Information

We do not sell, rent, or trade your personal information. We may share your information with:

3.1 Service Providers

We work with third-party service providers who perform services on our behalf:

• Cloud hosting providers (e.g., AWS, Google Cloud, Microsoft Azure)
• Email service providers (e.g., SendGrid, Mailchimp, HubSpot)
• Customer relationship management (CRM) platforms (e.g., Salesforce, HubSpot)
• Analytics providers (e.g., Google Analytics)
• Payment processors (if applicable for paid services)

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

3.2 Business Transfers

If Catχi is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, regulatory agencies).

3.4 With Your Consent

We may share your information for any other purpose disclosed to you at the time we collect the information or with your explicit consent.

4. International Data Transfers

Catχi operates globally. Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States.

For EU/EEA Users: When we transfer your personal data outside the EU/EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the European Commission
• Your explicit consent where required

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and track information about your use of our website.

Types of Cookies We Use:

• Essential Cookies: Required for website functionality (cannot be disabled)
• Analytics Cookies: Help us understand how visitors use our site (requires consent)
• Marketing Cookies: Used to deliver relevant advertisements (requires consent)

You can control cookie preferences through our cookie consent banner or your browser settings.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

7. Your Privacy Rights

7.1 Rights Under GDPR (EU/EEA Residents)

If you are located in the European Union or European Economic Area, you have the following rights:

• Right to Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Restriction of Processing: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

7.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of the "sale" of personal information (Note: Catχi does not sell personal information)
• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights

7.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: privacy@catxi.com
• Subject line: "Privacy Rights Request"
• Include: Your name, email address, and specific request

We will respond to your request within 30 days (GDPR) or 45 days (CCPA), as required by law.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (SSL/TLS) and at rest
• Regular security assessments and vulnerability testing
• Access controls and authentication mechanisms
• Employee training on data protection and security
• Secure data storage with reputable cloud providers

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete that information promptly. If you believe we might have information from or about a child, please contact us at privacy@catxi.com.

10. Third-Party Links

Our website may contain links to third-party websites, including clinicaltrials.gov, PubMed, FDA, and EMA. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

11. Do Not Track Signals

Some browsers support "Do Not Track" (DNT) signals. Our website does not currently respond to DNT signals. You can control tracking through our cookie consent banner and your browser settings.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on our website with a new "Last Updated" date
• Sending an email notification to registered users (for significant changes)
• Displaying a prominent notice on our website

Your continued use of our website after such changes constitutes your acceptance of the updated Privacy Policy.

13. Legal Basis for Processing (GDPR)

For EU/EEA residents, we process your personal data based on the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for specific purposes (e.g., marketing emails)
• Contractual Necessity: Processing is necessary to perform a contract with you or to take steps before entering into a contract
• Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our services, provided your interests do not override ours
• Legal Obligation: Processing is necessary to comply with the law