Privacy Notice

1. Introduction

Evidexa, Inc. ("Evidexa", "we", "our", "us") operates getevidexa.com, a healthtech validation platform that generates simulation-grade evidence for digital therapeutics and healthcare applications. We are committed to protecting your privacy and complying with applicable data protection laws including the EU General Data Protection Regulation (GDPR), UK Data Protection Act, and US state privacy laws.

This Privacy Policy explains how we collect, use, protect, and share information when you use our services.

2. Scope and Definitions

This policy applies to:

• Customers: Organizations that purchase and use our platform
• Website Visitors: Individuals who visit getevidexa.com
• Interview Participants: Individuals who participate in AI-conducted interviews

Key Terms:

• Personal Data: Any information relating to an identified or identifiable person
• Pseudonymization: Processing personal data so it can no longer be attributed to a specific person without additional information
• Processing: Any operation performed on personal data

3. Information We Collect

3.1 Customer Information

Data collected:

• Account information: company name, contact person, email, phone
• Authentication data: email, hashed passwords
• Billing information: processed by our payment provider
• Usage data: feature usage, session information, support interactions

Legal basis: Contract performance and legitimate interests

3.2 Interview Data

Important Privacy Protection: We pseudonymize interview data by stripping all direct identifiers. Audio is deleted immediately after transcription, and transcripts are stored without speaker metadata.

Data processed:

• Simulation parameters: Study design specifications and parameters
• Synthetic data: AI-generated patient profiles without real identifiers
• Analysis results: Aggregated insights with no personal identifiers

AI Processing: We use AI services via APIs that do not train on or retain your data.

Legal basis: Legitimate interests of our customers in conducting validation research

3.3 Website and Technical Data

Data collected automatically:

• IP address and approximate location
• Browser type, device information, operating system
• Pages visited, referring sites, interaction data
• Cookies and similar technologies

Legal basis: Legitimate interests in security and service improvement

4. How We Use Your Information

4.1 Primary Purposes

We process data to:

• Provide our simulation-grade evidence platform services
• Manage customer accounts and billing
• Ensure platform security and prevent fraud
• Improve our services and develop new features
• Comply with legal obligations

4.2 Synthetic Data

We may use synthetic simulation data to:

• Generate aggregated research insights
• Improve our AI models and algorithms
• Create industry benchmarks and reports

4.3 No Automated Decision-Making

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects on individuals.

5. Data Sharing and Disclosure

5.1 Service Providers

We share data with carefully selected service providers:

• AI language model providers (for simulation and analysis)
• Cloud infrastructure providers
• Payment processors
• Analytics providers

AI Service Data Protection:

• API providers do NOT use data to train models
• Data is NOT retained after processing
• These protections are standard for all API usage

5.2 Legal Obligations

We may disclose data when required by:

• Law enforcement requests with proper legal authority
• Court orders or legal proceedings
• Protection of our rights, safety, or property

We never sell personal data.

6. Data Security

6.1 Technical Measures

• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Multi-factor authentication for system access
• Regular security assessments and penetration testing
• Access controls based on least-privilege principle

6.2 Organizational Measures

• Data protection training for all staff
• Confidentiality agreements
• Incident response procedures
• Regular security audits

7. Your Privacy Rights

7.1 Rights by Jurisdiction

GDPR Rights (EU/UK Residents):

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Withdraw consent

US Privacy Rights (California, Virginia, Colorado, Connecticut, Utah):

• Know what personal information we collect
• Delete personal information
• Opt-out of sale (we don't sell data)
• Non-discrimination
• Correct inaccurate information

7.2 Exercising Your Rights

• Email: privacy@getevidexa.com
• Response time: Within 30 days (GDPR) or 45 days (CCPA)
• Verification: We may request information to verify your identity
• No fee unless requests are excessive or unfounded

8. Children's Privacy

Our service is not intended for anyone under 18. We do not knowingly collect data from minors. If we learn that we have collected personal data from a child under 13, we will delete such information.

9. Updates to This Policy

We may update this policy to reflect changes in our services or legal requirements. Material changes will be notified via email to customers with 30 days notice.

10. Contact Information

For Privacy Inquiries:

Evidexa, Inc.

Email: privacy@getevidexa.com

General Contact: workwithus@getevidexa.com