Privacy Notice (United States)

Last updated: 5/27/2026
Effective date: 5/27/2026
Version: 1.0

1. Who this notice applies to

This notice applies to United States users of the Service. The Service is a private, invitation-only system used by clinical trial site staff to place orders for nutritional products. Accounts are provisioned at the request of clinical trial sponsors or sites.

The Service is not publicly accessible. It is not directed to consumers, to children, or to clinical trial participants.

2. Personal information we collect

In the past 12 months, we have collected the following categories of personal information from users of the Service:

3. How we collect it

We collect personal information from these sources:

• Directly from you, when you use the Service or contact us.
• From your employer, clinical site, or the trial sponsor, when an account is provisioned for you.
• Automatically, from your use of the Service (login activity, audit logs, technical telemetry).

4. How we use it

We use personal information for these business purposes:

• To provide you with access to the Service and to authenticate you
• To process and fulfill orders placed through the Service
• To maintain audit logs required by clinical trial sponsors and applicable regulations
• To secure the Service, detect and prevent fraud or abuse, and investigate incidents
• To diagnose technical issues, monitor performance, and improve the Service
• To communicate with you about your account or the Service (e.g., service notices, security alerts)
• To comply with legal obligations and respond to lawful requests

We do not use personal information for advertising, marketing, profiling for targeted advertising, or any automated decision-making that produces legal or similarly significant effects.

5. How we share it

We disclose personal information only to:

• Clinical trial sponsors and clinical sites, as needed to operate the Service and fulfill orders.
• Service providers who help us operate the Service under written contracts that restrict their use of personal information. These currently include:
  • Microsoft Corporation (Microsoft Azure — cloud hosting, database, application monitoring)
• Fulfillment partners who deliver products to clinical sites.
• Professional advisors such as auditors and attorneys, bound by confidentiality.
• Government authorities or other parties, when required by law, subpoena, or court order, or to protect our legal rights.
• Successors in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

6. Sale and sharing of personal information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA or similar laws in other states. We have not done so in the past 12 months.

We also do not knowingly sell or share the personal information of consumers under the age of 16.

7. How long we keep it

We retain personal information only as long as necessary for the purposes described in this notice, or as required by our contracts with clinical trial sponsors and by applicable law.

8. How we protect it

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit (TLS) and at rest
• Hosting with Microsoft Azure in secured data center environments
• Multi-factor authentication for user accounts
• Role-based access controls and least-privilege principles
• Audit logging of access and changes
• Regular security reviews, patching, and vulnerability management
• Workforce training and confidentiality obligations
• A documented incident response and breach notification process

No system is perfectly secure. If you have reason to believe your account or information has been compromised, please contact us immediately at the address in section 13.

9. Your privacy rights

Depending on the state where you live, you may have some or all of the following rights with respect to personal information we hold about you:

• Right to know what personal information we collect, use, disclose, and (where applicable) sell or share
• Right to access a copy of the personal information we have about you
• Right to correct inaccurate personal information
• Right to delete personal information, subject to legal and contractual exceptions (including records we are required to retain for clinical trial purposes)
• Right to opt out of the sale of personal information or sharing for cross-context behavioral advertising (we do not engage in either)
• Right to limit the use of sensitive personal information (we only use it to provide and secure the Service)
• Right to non-discrimination for exercising these rights

To exercise any of these rights, contact us using the details in section 13. We will verify your identity by confirming information associated with your account before responding. We will respond within the time required by applicable law (generally 45 days, extendable once where permitted).

10. California residents — additional disclosures

10.1 Categories and sources

The categories of personal information we collect, the sources we collect from, the purposes we use it for, and the categories of third parties we disclose to are listed in sections 2, 3, 4, and 5 above.

10.2 No sale or sharing

We do not sell personal information and do not share personal information for cross-context behavioral advertising. We have not done so in the past 12 months.

10.3 Sensitive personal information

We collect account login credentials, which California law treats as "sensitive personal information." We use this information only to authenticate you and secure your account. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit its use under Cal. Civ. Code § 1798.121.

10.4 How to submit a request

You can submit a request to exercise your California privacy rights by:

• Emailing us at alex@getepicured.com
• Writing to us at the postal address in section 13

We will acknowledge your request within 10 business days and respond substantively within 45 days, with one possible extension as permitted by law.

10.5 Authorized agents

You may use an authorized agent to submit a request on your behalf. The agent must provide written, signed authorization from you, and we may ask you to verify your identity directly with us before processing the request.

10.6 Appeals

If we deny your request, you may appeal by replying to our response or by contacting us at alex@getepicured.com. We will respond to appeals within the time required by applicable law.

10.7 Shine the Light

California Civil Code § 1798.83 ("Shine the Light") permits California residents to request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not make such disclosures.

10.8 Notice of financial incentive

We do not offer financial incentives in exchange for personal information.

11. Cookies and tracking

The Service uses only strictly necessary cookies required to operate the site and keep you signed in securely:

We do not use cookies or other technologies for advertising, marketing, third-party analytics, or cross-site tracking. Because we do not engage in targeted advertising or sale of personal information, we do not act on Global Privacy Control (GPC) signals; there is no opt-out to apply.

12. Changes to this notice

We may update this notice from time to time. When we make material changes, we will notify users through the Service and update the "Last updated" and "Effective date" above. Your continued use of the Service after the effective date indicates you have read the updated notice.

13. Contact us

Print this notice