Privacy Policy

Policy Updates

We periodically review and update this Privacy Policy to reflect operational, regulatory, or compliance adjustments related to our research distribution processes. All updates will be posted to this Site with a revised effective date.

Information Collected

To operate our research partner network and maintain secure institutional access, NovaForm Biohealth collects limited business contact and operational information.

Collected data may include:

• Organization or business name
• Professional contact details (email, phone number, address)
• Verification credentials (account ID, tax or license documentation, and institutional affiliation)
• Order and logistical details necessary for research material shipment
• Support communications or compliance-related correspondence

Information Source and Use

We collect and process this information to:

• Verify research account eligibility and maintain secure access to restricted products
• Comply with applicable recordkeeping and quality system requirements
• Facilitate communication with verified partners, distributors, and laboratories
• Ensure proper traceability for materials classified as "Research Use Only (RUO)"
• Support logistics and technical support processes consistent with institutional contracts

Cookies and Technical Tracking

The Site may use limited session-based cookies for functionality and authentication within partner accounts. NovaForm Biohealth does not use cookies for behavioral advertising, retargeting, or consumer tracking. Technical logs are used solely to enhance system security and functionality.

Information Sharing and Disclosure

We may share necessary business or transactional data with service providers who perform operational or compliance functions on our behalf (e.g., logistics providers, payment processors, third-party testing facilities). These entities are contractually bound to handle information in accordance with this Policy and applicable law.

Legal and Compliance Obligations

NovaForm Biohealth retains institutional data solely for the duration required by applicable regulatory or quality management standards. Data may be disclosed if required to comply with lawful requests by public authorities or to enforce internal compliance policies.

Marketing and Communications

NovaForm Biohealth does not engage in consumer marketing or public advertising. Communications are limited to research account verification, order processing, compliance updates, or partner-related information.

Data Protection and Retention

NovaForm Biohealth implements administrative, physical, and technical safeguards consistent with ISO and GMP-aligned security protocols. Data retention is limited to operational and compliance purposes necessary for audit traceability or regulatory adherence.

How We Disclose Personal Information

We disclose limited business contact and operational data to third parties only where necessary to support research-focused operations, regulatory compliance, secure account access, logistics, or quality management, as described below:

• With service providers performing operational or compliance functions on our behalf (e.g., secure hosting/IT, payment processing, restricted-access account management, third-party testing logistics, documentation, fulfillment, and research shipment coordination).
• We do not share information with consumer marketing partners and we do not engage in behavioral advertising or cross-context ad targeting.
• When you direct us to share information for verified institutional purposes (e.g., coordinating delivery to a qualified research facility) or when required to enable secure account authentication integrations consistent with institutional use.
• Within our corporate group where necessary to operate secure, RUO-only manufacturing and distribution workflows, subject to this Policy.
• In connection with lawful requests, corporate transactions, or enforcement of our agreements, and to protect the integrity and security of our systems and partners.

Disclosures in the Past 12 Months

In the past 12 months, we have disclosed limited business contact and operational data for the purposes set out in this Policy:

We do not use or disclose sensitive personal information to infer characteristics about any individual.

"Sale" or "Sharing" of Personal Information

We do not "sell" or "share" personal information (as defined by applicable law) for advertising or cross-context behavioral targeting.

Third-Party Websites and Links

Our Site may contain links to third-party websites or platforms. Please review their privacy and security policies before interacting with those sites. We are not responsible for third-party content, security practices, or data handling. Information shared on public or third-party platforms may be accessible to others according to those platforms' terms.

Children's Data

The Site and partner portals are intended for institutional and professional use only. We do not knowingly collect information from children. If you believe a minor has provided information, please contact us so we can delete it. As of the effective date, we do not "sell" or "share" personal information of individuals under 16 years of age.

Security and Retention

We implement administrative, technical, and physical safeguards consistent with ISO/GMP-aligned practices to protect business contact and operational data. No system is impenetrable; transmissions over the Internet may carry risk. Do not transmit sensitive or confidential information through insecure channels.

We retain information only as needed for secure access control, institutional fulfillment, quality/audit traceability, and legal or regulatory purposes, after which data is deleted or de-identified consistent with our retention schedule.

Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a copy of certain information we maintain about your institution or account, and to limit certain processing. You may exercise these rights using the contact methods below. We may request information to verify your identity and authority before fulfilling a request.

Your rights may include:

• Access
• Deletion
• Correction
• Portability (where applicable)
• Restriction (where applicable)
• Withdrawal of consent where processing relies on consent
• Appeal of a denied request (where applicable)

Communications relate to account verification, fulfillment, compliance, and partner updates. You may adjust non-essential communications preferences at any time using the methods below.

We will not discriminate against you for exercising any rights afforded by law. Authorized agents may submit requests with documentation demonstrating authority; we may require direct verification.

Complaints

If you have a concern about our data practices, contact us using the details below. Where available by law, you may also contact your local supervisory authority.

International Users

We may transfer, store, and process information in the United States and other jurisdictions. Where required for transfers from the EEA/UK, we rely on recognized transfer mechanisms (e.g., Standard Contractual Clauses) or other lawful bases.

Contact

For privacy inquiries, data correction, or deletion requests related to institutional accounts, contact:

Compliance Disclaimer