Privacy Policy

The short version

We collect the information you give us, such as your name, work email, and organization when you ask for a demo, plus basic technical information about how our website is used. We use it to respond to you, run and improve our website and services, and keep them secure. We don't sell your personal information, we don't share it for cross-context behavioral advertising, and we don't use advertising cookies. Patient information that our customers process in the Centrova platform is handled under separate agreements and the law that governs health information, not under this policy.

What this policy covers

This policy applies to personal information we collect through our website, our marketing and sales communications, and events or meetings with prospective customers and partners.

It does not apply to information that hospitals, research sites, and other customers upload to or process in the Centrova platform. We process that information on our customers' behalf and under their instructions, as described in section 7. If you are a patient, the hospital or research site that holds your records controls how they are used, and its privacy notice applies.

Information we collect

Information you provide to us:

• Contact details, such as your first name, work email address, and organization, when you fill in our contact form, request a demo, or join our waitlist.
• Anything you choose to include in a message to us, such as your role, your site, or the trials you run.
• Records of our correspondence and meetings with you.

Information collected automatically when you use our website:

• Device and connection information, such as your IP address, browser type, operating system, and approximate location derived from your IP address.
• Usage information, such as the pages you view, the page that referred you, and the date and time of your visit.

We do not ask for, and ask that you do not send us through the website, sensitive information such as health information, government identifiers, or financial account details.

How we use information

• To respond to your enquiries, arrange demos and pilots, and communicate with you about Centrova.
• To send you updates about our products, events, or waitlist status. You can opt out at any time using the link in our emails or by writing to us.
• To operate, maintain, and improve our website and services, including understanding which pages are useful.
• To detect, prevent, and respond to security incidents, fraud, and abuse.
• To comply with our legal obligations and to establish, exercise, or defend legal claims.

Cookies, analytics, and Do Not Track

Our website does not use advertising or cross-site tracking cookies. We may use analytics services that measure aggregate traffic, such as page views and referring pages, to help us understand how the site is used. Our hosting provider also records standard server logs, which include IP addresses, to deliver the site and keep it secure.

Because we don't track visitors across other websites, our practices are the same whether or not your browser sends a "Do Not Track" signal. We also treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of your personal information, although we do not sell or share it.

How we share information

We share personal information only as described here:

• Service providers that work on our behalf, such as website hosting, analytics, email, scheduling, and customer-relationship tools. They may use the information only to provide services to us, under contracts that restrict other uses.
• Professional advisers, such as lawyers, accountants, and auditors, where needed.
• Authorities or other parties when we believe disclosure is required by law, or necessary to protect the rights, property, or safety of Centrova, our customers, or others.
• A buyer or successor in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this policy.
• Anyone else, with your consent or at your direction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.

Patient information in the Centrova platform

Hospitals and research sites use Centrova to identify patients who may be eligible for clinical trials. When they do, we process patient information on their behalf as a service provider and, where the Health Insurance Portability and Accountability Act (HIPAA) applies, as a business associate under a business associate agreement. That information is governed by those agreements, HIPAA, and applicable state law, including California's Confidentiality of Medical Information Act. It is not covered by this policy.

We use patient information only to provide the services our customers configure. We never sell it, use it for marketing, or use it to train shared models. Questions about a patient's records should go to the hospital or research site that holds them; we will assist our customers in responding.

How long we keep information

We keep personal information only for as long as we need it for the purposes described in this policy, unless the law requires or permits a longer period. As a guide:

• Contact, demo, and waitlist information: for as long as we have an active relationship with you or your organization, and up to 24 months after our last contact with you.
• Website server logs and analytics data: typically no longer than 13 months, and in aggregated or de-identified form after that.
• Records we must keep for legal, tax, or contractual reasons: for the period that obligation requires.

How we protect information

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and limiting access to the people who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), gives you the following rights, subject to certain exceptions:

• Right to know: to request the categories of personal information we have collected about you, the categories of sources, our purposes for collecting it, the categories of third parties we disclose it to, and the specific pieces of personal information we hold about you.
• Right to delete: to request that we delete personal information we collected from you.
• Right to correct: to request that we correct inaccurate personal information about you.
• Right to opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of, but you may still contact us with questions.
• Right to limit the use of sensitive personal information: we do not collect or use sensitive personal information through our website for purposes that would give rise to this right.
• Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

In the past 12 months, we have collected the following categories of personal information, from the sources and for the purposes described in sections 3 and 4:

We do not collect sensitive personal information through our website, and we do not sell or share any category of personal information. Retention periods for each category are described in section 8.

How to make a privacy request

To exercise your rights, email team@centrova.ai with the subject line "California privacy request" and tell us which right you would like to exercise. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you why, and we may extend the response period by up to another 45 days as the law allows.

To protect your information, we will verify your identity before acting on a request, usually by matching the email address you write from with information we hold and, if needed, asking for a few further details. We will use the information you give us for verification only for that purpose.

You may use an authorized agent to make a request for you. We may ask the agent for proof that you gave them signed permission, and may ask you to verify your identity directly with us.

Other California notices

Shine the Light: California Civil Code section 1798.83 lets California residents ask for information about personal information a business has disclosed to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Minors: our website and services are intended for professionals and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe we have, please contact us and we will delete it.

Visitors outside the United States

Centrova is based in the United States, and we process and store information in the United States. If you visit our website from elsewhere, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

Changes to this policy

We may update this policy from time to time. When we do, we will post the new version on this page and change the "Effective" date at the top. If we make material changes, we will take additional steps to let you know, such as emailing you if we have your address.

Contact us

If you have questions about this policy or how we handle personal information, contact us at team@centrova.ai.