Privacy Policy

1. Overview

This policy applies to all personal data collected through our website, product orders, customer support interactions, and marketing activities. By using our website or services, you consent to the practices described here.

2. Information We Collect

We collect information in three ways: information you provide, information collected automatically, and information from third parties.

2.1 Information You Provide

• Account data: name, email, phone number, organization, job title, password
• Order data: billing and shipping addresses, payment details (processed by PCI-compliant providers), purchase history
• Communications: messages sent through contact forms, email, WhatsApp, or support tickets
• Career data: resumes, cover letters, and application materials when you apply for a role

2.2 Information Collected Automatically

• IP address, browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers and similar tracking technologies
• Approximate geographic location derived from IP

2.3 Information from Third Parties

We may receive limited data from analytics providers, payment processors, and marketing partners to supplement the information we collect directly.

3. How We Use Information

• Fulfilling orders, processing payments, and arranging shipping
• Providing customer support and responding to inquiries
• Sending transactional emails (order confirmations, shipping notifications)
• Sending marketing communications (with your consent, and with easy opt-out)
• Improving our website, products, and services
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal, tax, and regulatory obligations
• Analyzing usage patterns to enhance user experience

4. Legal Bases for Processing (GDPR)

If you are in the European Economic Area, we process your personal data under the following legal bases:

• Contract: to fulfill orders and provide services you requested
• Legitimate interests: to improve our services, prevent fraud, and ensure security
• Consent: for marketing emails and non-essential cookies
• Legal obligation: to comply with tax, accounting, and regulatory requirements

5. Sharing & Disclosure

We do not sell your personal data. We may share information with:

• Service providers: payment processors, shipping carriers, email and analytics providers, all bound by confidentiality agreements
• Business partners: when you request a joint project or referral
• Legal authorities: when required by law, court order, or to protect our rights
• Successors: in connection with a merger, acquisition, or sale of assets

6. Cookies & Tracking

We use cookies and similar technologies to operate our site, remember preferences (including your theme choice), and analyze traffic. For full details, see our Cookie Policy.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account data: until you delete your account, plus 30 days
• Order records: 7 years for tax and regulatory compliance
• Marketing data: until you unsubscribe, then suppressed
• Analytics data: 26 months

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for stored personal data
• Role-based access controls and audit logging
• Regular security assessments and employee training

No system is 100% secure. If we become aware of a data breach affecting your rights, we will notify you and relevant authorities as required by law.

9. International Data Transfers

NanoDx is based in the United States. If you access our services from outside the US, your data may be transferred to and processed in the US, where data protection laws may differ from those in your jurisdiction. Where required, we use Standard Contractual Clauses approved by the European Commission for such transfers.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (the "right to be forgotten")
• Restrict or object to processing
• Port your data to another provider
• Withdraw consent at any time for consent-based processing
• Lodge a complaint with your local data protection authority

To exercise these rights, email privacy@nanodxcorp.com. We will respond within 30 days.

11. Children's Privacy

Our services are not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

12. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA:

• The right to know what personal information we collect, use, and share
• The right to delete personal information we have collected
• The right to correct inaccurate personal information
• The right to opt out of the "sale" or "sharing" of personal information
• The right to limit the use of sensitive personal information
• The right to non-discrimination for exercising your rights

We do not sell personal information. To exercise your California rights, email privacy@nanodxcorp.com with the subject line "CCPA Request".

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our website at least 30 days before they take effect. Continued use of our services after the effective date constitutes acceptance.

14. Contact & Data Protection Officer