Privacy Policy

Vatengi Systems LLC ("we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our marketing websites, request a demo, create an account, or use the TracePharma cloud platform and related services (collectively, the "Service").

This Privacy Policy supplements our Terms of Service at https://tracepharma.io/tos. If you do not agree with this Privacy Policy, please do not use the Service.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date.

The Service is operated by Vatengi Systems LLC. TracePharma is a trade name of Vatengi Systems LLC.

For privacy-specific requests (access, correction, deletion, or marketing opt-out), contact us at privacy@tracepharma.io.

For legal notices, contact legal@tracepharma.io. For product support, contact support@tracepharma.io.

This Privacy Policy covers personal information we collect about identifiable individuals—such as account holders, demo requestors, and marketing-site visitors.

When customers use the TracePharma platform to process supply-chain traceability data (including EPCIS events, serial numbers, lot data, trading-partner records, and shipment information), that information is generally Customer Data processed on behalf of the customer organization. Our handling of Customer Data in the Service is also governed by our Terms of Service and any data processing terms in your Order Form. This Privacy Policy focuses on personal information about users and website visitors, not on de-identified or purely operational product data except where noted below.

Depending on how you interact with us, we may collect:

• Identifiers and contact details: name, business email address, phone number, company name, job title, and mailing address.
• Account and authentication data: username, role assignments, login timestamps, password hashes, and multi-factor authentication metadata.
• Demo and sales inquiries: information you submit through demo request forms, contact pages, or email correspondence.
• Usage and device data: IP address, browser type, operating system, pages viewed, referring URL, session duration, and similar analytics from our websites and authenticated application.
• Support and communications: content of support tickets, exception escalations, and email or in-app messages you send to us.
• Integration configuration metadata: connection endpoints, certificate identifiers, and webhook URLs that may contain business contact information.

We use personal information to:

• Provide, operate, secure, and improve the Service.
• Create and administer tenant workspaces and user accounts.
• Respond to demo requests, sales inquiries, and support questions.
• Send service-related notices (security alerts, product changes, billing, and account administration).
• Monitor platform performance, troubleshoot errors, and prevent fraud or abuse.
• Comply with law, enforce our Terms of Service, and protect the rights and safety of Vatengi Systems LLC, our customers, and others.

Customers may upload or transmit traceability and supply-chain data through the Service. In those cases, Vatengi Systems LLC typically acts as a service provider processing data on behalf of the customer. The customer organization controls what data is submitted and is responsible for providing any required notices and obtaining any required consents from its personnel and trading partners.

We process Customer Data and EPCIS payloads only to deliver the Service, provide support, maintain backups, and as otherwise instructed by the customer or required by applicable law.

Personal information contained within Customer Data (for example, operator names in audit logs) is handled under the customer's instructions and our contractual obligations, in addition to the safeguards described in this Privacy Policy.

We do not sell personal information. We may share personal information with:

• Service providers and subprocessors that help us host infrastructure, send email, provide analytics, deliver customer support, or perform security monitoring—under contracts requiring appropriate data protection.
• Professional advisors (lawyers, accountants, insurers) under confidentiality obligations.
• Trading partners or integration endpoints only when you or your organization configure outbound connectivity; we do not independently disclose your personal information to supply-chain partners except as directed through the Service.
• Authorities or other parties when required by law, court order, or to protect rights, safety, and security.
• A successor entity in connection with a merger, acquisition, or sale of assets, subject to this Privacy Policy or a successor policy with notice where required.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you; to restrict or object to certain processing; and to withdraw consent where processing is consent-based.

To exercise these rights, email privacy@tracepharma.io with the subject line "Privacy rights request". We may need to verify your identity before responding. If your information is held on behalf of an employer-customer, we may direct you to contact your organization's administrator.

We will not discriminate against you for exercising privacy rights afforded by applicable law.

We primarily serve US pharmaceutical supply-chain customers. Personal information may be stored and processed in the United States and in other countries where we or our service providers operate.

When we transfer personal information internationally, we implement appropriate safeguards as required by applicable law.

Where applicable privacy laws require a legal basis, we rely on one or more of the following: performance of a contract with you or your organization; legitimate interests in operating and improving the Service (balanced against your rights); compliance with legal obligations; and consent where required (for example, certain marketing communications).

We implement administrative, technical, and organizational measures designed to protect personal information, including access controls, encryption in transit, tenant isolation, and monitoring. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

Voluntary feedback, comments, or ideas you submit through public contact channels may not be treated as confidential unless we agree otherwise in writing.

We retain personal information for as long as needed to provide the Service, maintain business records, comply with legal obligations, resolve disputes, and enforce agreements.

Marketing and demo inquiry records are generally retained for a limited period unless you become a customer or request deletion sooner. Account data is retained while your tenant is active and for a reasonable period afterward, consistent with our Terms of Service and backup schedules.

Contact privacy@tracepharma.io for questions about retention.

Our websites and authenticated application may use cookies, local storage, and similar technologies for session management, security, preferences, and analytics.

Strictly necessary cookies support login sessions and platform security. Where optional analytics or marketing cookies are used, we will obtain consent when required by law.

You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.

With your consent where required, we may send information about TracePharma features, events, or offers by email. You may opt out at any time by using the unsubscribe link in a message or emailing privacy@tracepharma.io with the subject line "Unsubscribe from marketing".

We will continue to send non-marketing service and security communications related to your account even if you opt out of marketing.

The Service may link to third-party websites (for example, FDA references, partner documentation, or integration vendors). We are not responsible for the privacy practices of those sites. Review their privacy policies before providing personal information.

The Service is intended for business users and is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact privacy@tracepharma.io and we will take appropriate steps to delete it.

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CPRA"), including the right to know categories of personal information collected, request access to or deletion of personal information, and correct inaccurate personal information.

We do not sell or share personal information for cross-context behavioral advertising as defined under CPRA.

To submit a verifiable request, email privacy@tracepharma.io with the subject line "California privacy request". We will respond within the timeframes required by California law. You may designate an authorized agent to submit requests on your behalf where permitted by law.

If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act ("VCDPA"), including rights to access, correct, delete, and obtain a copy of personal information we process about you.

Submit requests to privacy@tracepharma.io with the subject line "Virginia privacy request". We will authenticate your request and respond as required by Virginia law.

We may revise this Privacy Policy by posting an updated version at https://tracepharma.io/privacy. If we make material changes, we will provide additional notice through the Service or by email where appropriate.

Your continued use of the Service after the effective date of an updated Privacy Policy constitutes acceptance, unless otherwise required by law.

Questions about this Privacy Policy may be directed to privacy@tracepharma.io.

For Terms of Service inquiries, contact legal@tracepharma.io. For product support, contact support@tracepharma.io.