Complydome Privacy Policy

1. Scope of this policy

This Privacy Policy applies to personal information processed by Complydome LLC (“Complydome,” “we,” “us,” or “our”) through www.complydome.com and its subdomains, our compliance platform, assessments, and related communications, events, and support (together, the “Services”).

Complydome LLC is the company responsible for your personal information under this policy. Complydome operates the Services under a license from its parent company, MillaNovaHoldings Inc., a Delaware corporation (“MillaNova”), which owns and maintains the underlying technology platform.

This policy does not apply to:

• Customer Data. Information that our business customers upload to or process through the platform (“Customer Data”). We process Customer Data on our customers’ behalf and under their instructions, as described in our agreements with them. If you are an employee or patient of one of our customers, please contact that organization with questions about how your information is handled.
• Third-party services. Websites, products, or services operated by others, even if you reach them through a link on our Services.

2. Information we collect

Information you give us

• Contact and business details such as your name, work email address, phone number, organization name, job title, practice type, and state, when you request access, book a consultation, complete an assessment, join a program, or contact us.
• Account information such as login credentials and profile settings, when you create an account.
• Communications such as the content of messages, form submissions, survey responses, and feedback you send us.
• Billing information such as billing contact and address. Payment card details are collected and processed directly by our payment processors; we do not store full card numbers.

Information we collect automatically

• Device and log information such as IP address, browser type and version, operating system, referring URL, pages viewed, links clicked, and the date and time of your visit.
• Approximate location derived from your IP address (for example, state or region) so we can show content and programs relevant to where you operate. We do not collect precise geolocation.
• Cookie and analytics data as described in Cookies & similar technologies.

Information from other sources

We may receive business contact information from publicly available sources, professional networks, event partners, and referral partners, and combine it with information we already hold, to the extent permitted by law.

3. How we use information

We use the information we collect to:

• Provide and operate the Services, including creating accounts, delivering assessments, and processing requests.
• Communicate with you, including responding to inquiries, sending service notices, and, where permitted, sending updates about regulatory developments, products, and events. You can opt out of marketing messages at any time.
• Maintain and improve the Services, including understanding how visitors use our website, fixing errors, and developing new features.
• Protect our users and Complydome, including detecting, investigating, and preventing fraud, abuse, security incidents, and other harmful activity.
• Meet legal obligations, including complying with applicable law, responding to lawful requests, and enforcing our agreements.

We do not use Customer Data or protected health information to train generalized artificial intelligence models, and we do not use it for advertising.

4. Protected health information

Where Complydome creates, receives, maintains, or transmits protected health information (“PHI”) on behalf of a HIPAA covered entity or business associate, we do so as a business associate under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (“HIPAA”). That processing is governed by a Business Associate Agreement (“BAA”) with the customer, which controls over this policy if the two conflict.

5. Cookies & similar technologies

Cookies are small text files stored on your device. We and our service providers use cookies and similar technologies, such as pixels and local storage, for the purposes below.

We use Google Consent Mode, so analytics and advertising storage stay disabled unless you click “Accept” on our cookie banner. You can also block or delete cookies in your browser settings, and you can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. Learn more about how Google uses information from sites that use its services.

Global Privacy Control. Where required by law, we treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale of personal information and targeted advertising for that browser. Because there is no common industry standard for “Do Not Track” signals, we do not respond to them.

6. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money. We share information only in the following circumstances:

• Our parent company and platform licensor. With MillaNova, which owns and maintains the technology platform that powers the Services and processes information on our behalf to host, secure, and operate it. MillaNova processes this information only for those purposes, under written confidentiality and security obligations and, where protected health information is involved, a HIPAA subcontractor Business Associate Agreement.
• Service providers. With vendors who process information on our behalf and under contractual confidentiality and security obligations, such as cloud hosting (Amazon Web Services), form processing (Formspree), analytics (Google), IP-based location lookup, email delivery, and payment processing.
• At your direction. When you ask us to share information, for example with a partner program or integration you enable.
• Legal and safety reasons. When we believe in good faith that disclosure is reasonably necessary to comply with law, regulation, legal process, or an enforceable governmental request; to enforce our agreements; or to protect the rights, property, or safety of Complydome, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to standard confidentiality protections. We will notify affected users before personal information becomes subject to a different privacy policy.
• Aggregated or de-identified information that cannot reasonably be used to identify you. De-identified health information is handled only as permitted by HIPAA and our BAAs.

7. How we protect information

We build security into our Services from the start. Our safeguards include:

• Hosting on Amazon Web Services HIPAA-eligible infrastructure, located in data centers that maintain SOC 2 Type II attestations.
• Encryption of data in transit using TLS and at rest using 256-bit AES encryption.
• Role-based access controls, least-privilege access, and logging of administrative activity.
• Workforce confidentiality obligations, security training, and vendor due diligence.
• Documented incident response procedures, including breach notification as required by law and our agreements.

No method of transmission or storage is completely secure. If you believe your interaction with us is no longer secure, please contact us immediately at support@complydome.com.

8. Data retention

We keep personal information only as long as needed for the purposes described in this policy, including to provide the Services, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it. Customer Data is retained and deleted as set out in the applicable customer agreement and BAA. HIPAA-required documentation may be retained for at least six years where applicable.

9. Your choices

• Marketing emails. Use the “unsubscribe” link in any marketing email, or contact us. We will still send service-related messages.
• Cookies. Accept or reject non-essential cookies through our cookie banner or your browser settings.
• Account information. If you have an account, you can review and update certain information in your account settings.

10. Your privacy rights

Depending on where you live, including under the Texas Data Privacy and Security Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and other U.S. state privacy laws, you may have the right to:

• Know and access the personal information we hold about you;
• Correct inaccurate personal information;
• Delete personal information we collected from or about you;
• Obtain a portable copy of your personal information;
• Opt out of the sale of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• Not be discriminated against for exercising these rights.

How to make a request. Email support@complydome.com with the subject line “Privacy Request.” We will verify your identity before acting on a request, and we will respond within the time required by applicable law (generally 45 days). You may use an authorized agent where permitted by law; we may ask for proof of the agent’s authority.

Appeals. If we decline your request, you may appeal by replying to our decision with the subject line “Privacy Appeal.” If your appeal is denied, you may contact your state attorney general, such as the Texas Attorney General at texasattorneygeneral.gov.

If you are in the European Economic Area, the United Kingdom, or Switzerland, you may also have the right to object to or restrict processing and to lodge a complaint with your local data protection authority. Where those laws apply, we rely on legitimate interests, performance of a contract, consent, and legal obligation as our legal bases for processing.

11. Children’s privacy

Our Services are intended for business use and are not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Data location & transfers

Complydome is based in the United States, and we store and process information in the United States. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. Where required, we use appropriate safeguards for such transfers.

13. Third-party sites

Our Services may link to websites and services operated by others, such as LinkedIn, X, and our partners. Their privacy practices are governed by their own policies, and we encourage you to review them.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post any changes on this page and update the “Last updated” date above. If changes are material, we will provide more prominent notice, such as an email or a notice on our website, before they take effect. Your continued use of the Services after the effective date means you accept the updated policy.

15. Contact us

If you have questions about this Privacy Policy or our privacy practices, please contact us: