Privacy Policy

1. Introduction and Scope

Yashara Biosciences, Inc. ("Yashara," "we," "our," or "us") is committed to protecting the privacy of individuals who interact with our website and use our products. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information in connection with: (a) our corporate website at yashara.us; (b) the FluorocellAI software platform; (c) the ComplianceCall compliance management platform; and (d) the PuroChem chemical hazard intelligence platform (collectively, our "Services").

This Policy applies to personal information collected from: visitors to our website; individuals who submit inquiries through our contact forms; licensed users of our software products; and authorized users designated by institutional licensees.

By using our Services, you agree to the collection and use of information as described in this Policy. If you do not agree with the terms of this Policy, please do not use our Services.

2. Information We Collect

2.1 Information You Provide Directly. When you submit an inquiry through our website contact form, request a product demonstration, or establish a user account, we collect information you provide directly, which may include:

• Name, institutional email address, professional title, and institutional affiliation
• The nature of your inquiry or the product of interest
• Billing and payment information for paid subscriptions (processed by our third-party payment processor; we do not store full payment card data)
• Communications you send to us by email or through in-platform messaging

2.2 Information Collected Automatically. When you visit our website, we collect certain technical information automatically, including your IP address (truncated for anonymization), browser type and version, operating system, referring URL, pages viewed, and the date and time of your visit. This information is collected through standard web server logs and, where applicable, cookies or similar technologies as described in Section 5 below.

2.3 Product Usage Data. For licensed users of our software products, we may collect anonymized and aggregated usage telemetry — feature utilization patterns, error reports, and performance metrics — to inform product improvement. This telemetry does not include the content of the scientific data processed by our software (image files, compliance records, chemical inventory data). Users may opt out of usage telemetry through the product settings panel.

2.4 Scientific Data Processed by Our Products. FluorocellAI processes fluorescence microscopy image files on the user's local hardware or institutional infrastructure. By default, image data does not leave the user's environment. If a user elects to use the optional cloud inference feature, image data is transmitted to Yashara's secure processing infrastructure and deleted within 24 hours of processing completion. ComplianceCall and PuroChem, as web-based platforms, process data within our secure cloud infrastructure as described in Section 7.

3. How We Use the Information We Collect

We use personal information for the following purposes:

• To respond to inquiries and provide customer support. Personal information submitted through our contact form or support channels is used solely to respond to the specific inquiry and, where appropriate, to follow up with additional information the inquirer may find relevant.
• To administer product licenses and user accounts. Account information is used to provision and manage licensed access to our products, process renewals, and communicate essential service information.
• To improve our products. Anonymized and aggregated usage data is used to identify areas for improvement, prioritize development resources, and diagnose technical issues.
• To comply with legal obligations. We may process personal information as required by applicable law, regulation, or lawful government request.
• To protect the security and integrity of our Services. We use technical and operational information to detect and respond to security incidents, abuse, or unauthorized access.

We do not sell personal information to third parties. We do not use personal information for behavioral advertising or share it with advertising networks.

4. Legal Basis for Processing (EEA and UK Users)

For individuals in the European Economic Area (EEA) or the United Kingdom, our legal basis for collecting and using personal information is as follows:

• Contract performance: Processing necessary to administer a product license or respond to a service request
• Legitimate interests: Processing for product improvement, security monitoring, and fraud prevention, where our interests are not overridden by your privacy rights
• Legal obligation: Processing required by applicable law or regulation
• Consent: Where we request your consent for specific processing activities (such as optional usage telemetry), and which you may withdraw at any time

5. Cookies and Tracking Technologies

Our website uses a limited number of cookies strictly necessary for core functionality, including session management for authenticated users. We do not use advertising cookies, cross-site tracking technologies, or third-party analytics services that collect personally identifiable information.

A session cookie is set when you log in to a Yashara product account and is deleted when you close your browser session. No persistent tracking cookies are set on visitors who do not log in to an account. You may configure your browser to refuse cookies, though this may affect the functionality of authenticated product interfaces.

6. Information Sharing and Disclosure

We share personal information only in the following limited circumstances:

• Service providers. We engage third-party service providers for specific functions including payment processing, cloud hosting infrastructure, and transactional email delivery. These providers access personal information only to perform services on our behalf and are contractually obligated to protect it and not use it for independent purposes.
• Institutional administrators. For products licensed on an institutional basis, designated account administrators within the licensee institution may have access to user account information within their organization's account. Yashara does not grant institutional administrators access to individual users' scientific data.
• Legal requirements. We may disclose personal information if required to do so by law, court order, or regulatory authority, or if we believe in good faith that such disclosure is necessary to protect our rights, the safety of our users, or to respond to an emergency.
• Business transfers. In the event of a merger, acquisition, or sale of all or a portion of our assets, personal information may be transferred to the acquiring entity. We will notify affected users in advance of any such transfer and of any material changes to this Privacy Policy.

7. Data Security

We implement technical and organizational security measures appropriate to the nature of the data we process and the risks associated with its unauthorized access, disclosure, alteration, or destruction. For our web-based products (ComplianceCall and PuroChem), these measures include:

• Encryption of data at rest using AES-256
• Encryption of data in transit using TLS 1.3
• Role-based access controls with principle-of-least-privilege enforcement
• Comprehensive audit logging of all data access events
• Regular penetration testing by qualified third-party security firms
• SOC 2 Type II compliance (current report available to enterprise licensees under NDA)

No security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable legal requirements.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Account information and associated data are retained for the duration of the active license plus a reasonable period thereafter to facilitate account reactivation, audit purposes, and legal compliance. Upon written request for account deletion, we will delete or anonymize your personal information within 30 days, subject to applicable legal retention obligations.

Anonymized and aggregated data derived from usage telemetry may be retained indefinitely for product improvement purposes, as it cannot reasonably be used to identify individual users.

9. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access: The right to request a copy of the personal information we hold about you
• Correction: The right to request correction of inaccurate personal information
• Erasure: The right to request deletion of your personal information, subject to applicable legal retention obligations
• Portability: The right to receive your personal information in a structured, machine-readable format
• Restriction: The right to request that we restrict processing of your personal information in certain circumstances
• Objection: The right to object to processing of your personal information on the basis of legitimate interests
• Withdrawal of consent: Where processing is based on consent, the right to withdraw that consent at any time

To exercise any of these rights, please contact us at privacy@yashara.us. We will respond to all requests within 30 days.

10. HIPAA and Clinical Data

ComplianceCall is designed for deployment in clinical laboratory environments. To the extent that ComplianceCall is used in connection with protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA), Yashara operates as a Business Associate and is prepared to execute a Business Associate Agreement (BAA) with covered entities and other business associates. Please contact us at compliance@yashara.us to request a BAA.

11. Children's Privacy

Our Services are directed exclusively to professional users in academic, clinical, and industrial laboratory settings. We do not knowingly collect personal information from individuals under 18 years of age. If we become aware that we have collected personal information from a minor, we will take prompt steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our products, or applicable law. We will notify active account holders of material changes by email and will post the revised Policy on this page with an updated effective date. Your continued use of our Services after the effective date of a revised Policy constitutes your acceptance of the revised terms.

13. Contact

Questions, concerns, or requests regarding this Privacy Policy or our data practices should be directed to:

Yashara Biosciences, Inc.
Privacy Office
privacy@yashara.us

For EEA/UK data protection inquiries, you may also contact our data protection representative or lodge a complaint with your local supervisory authority.