Privacy Policy of Epicore Biosystems

Epicore Biosystems, Inc. (“Epicore Biosystems,” “we,” “us,” “our”) respects your privacy and strives to offer you a safe customer experience. With this Privacy Policy we want to tell you about what data we collect when you use our products and services, and how we use and handle this data. We’ll also tell you where to find out more about how your personal information is handled and what rights you have with respect to this information.

Using Epicore Biosystems Services in Short

When you use Epicore Biosystems websites (including epicorebiosystems.com), products, services, and mobile apps (collectively, the “Services”) we may collect your personal information. That information is used only to offer you the Service in question, nothing else. Epicore Biosystems does not sell your personal information. We may be providing this Service as part of a service with your employer’s (or partnering enterprise) health and services team members. In such a case, they would never see your personal data but only anonymized group statistics to help them improve safety, unless you expressly consent to provide such data to Epicore Biosystems and/or your employer (or partnering enterprise). We will ask you to consent if you wish to share anonymized, statistical data with your employer or partnering enterprise.

Data Access by party: You – own and have access to all of your sensor data and personal information. Epicore Biosystems – access to your sensor data and personal information to provide computations and the Services. Partnering Enterprise/Employer – access to anonymous group statistics such as number of alarms during the week. No access to your personal information, and no access to your individual sensor data, unless you expressly consent to provide access to such data to Partnering Enterprise/Employer.

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY. WHERE REQUIRED BY APPLICABLE LAW, WE WILL OBTAIN YOUR CONSENT BEFORE COLLECTING OR PROCESSING YOUR PERSONAL INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY. YOU CAN CHOOSE NOT TO PROVIDE CERTAIN INFORMATION. IF YOU CHOOSE NOT TO PROVIDE SUCH INFORMATION, HOWEVER, YOU MIGHT NOT BE ABLE TO USE OR TAKE ADVANTAGE OF MANY OF OUR SERVICES.

How We Handle Your Personal Information

When you create a user account for certain Epicore Biosystems Services, we ask for some personal information (for example your name, email address, biological sex at birth, and age). We need this information in order to provide you with a personalized experience with our Services. For example, we use your height, weight and biological sex at birth information to compute your whole body sweat loss which determines your rehydration recommendation. If you give us false information about your height, weight, and biological sex at birth, our algorithms will not calculate correct results for you, and we therefore trust that all the information you provide are accurate.

Our sensors collect sweat loss volume and sweat electrolyte loss, temperature, and motion to generate a hydration recommendation. When you use your phone to log data, GPS coordinates are collected. This happens only if you give consent specifically for geolocation and when you use the Epicore Biosystems app to actively log information to allow for analysis of pertinent weather information and heat wave warnings.

In addition to the uses of personal information identified above, we may use your personal information to ensure the proper function and safety of Epicore Biosystems products, to verify your identity, to provide user support, to investigate fraud and other misuse of the products, and for legal and other purposes. We may, as described below, also process your information as part of our research and product development activities – we are continuously developing new functionalities and improving on existing ones.

We will not rent or sell customer lists that include your personal information. We will not share your personal information except for the limited circumstances described in this Privacy Policy. We may share your personal information (i) for the reasons we tell you when we collect it, or (ii) in the following ways:

  • With Your Consent. We may share personal information when we have your consent.
  • For External Processing. We may engage contractors, service providers, and third-party technicians (collectively, the “Subcontractors”) to assist with some of the data processing, storage and use described in this Privacy Policy, including to help answer your questions. Our Subcontractors may include marketing, operations, and technology vendors. These Subcontractors may also assist with monitoring our servers (including third-party servers used by Epicore Biosystems) for technical problems. These Subcontractors (as well as Epicore Biosystems’ employees) may be given access to certain personal information about you or your account if necessary to provide those services. In no event will these Subcontractors be allowed to use this data for purposes not permitted under this Privacy Policy.
  • As Part of Business Transitions. If Epicore Biosystems participates in the sale or transfer of Epicore Biosystems business and/or all or part of its assets, your personal information may be among the assets transferred. We will require that any purchaser treat our data in accordance with this Privacy Policy.
  • For Legal Reasons. We may share personal information with third parties if we have a good faith belief that access, use, preservation or disclosure of the information is required by Epicore Biosystems to: (i) comply with any applicable law, regulation, legal process or enforceable government request; (ii) enforce Epicore Biosystems’ policies or contracts, including in connection with the investigation of potential violations; (iii) detect, prevent or otherwise address fraud, security or technical issues; (iv) lawfully protect the rights, property or safety of Epicore Biosystems, our customers and users of the Services or the public.

Aggregate Information. We may share non-personal information (for example, aggregated or anonymized customer data) publicly and with our partners. We will take steps to ensure that this non-personal information does not identify you, and we require any of our partners who have access to that non-personal information to do the same. We may also use information collected from you or the Services in a non-personally identifiable or aggregate form to help us improve the Services, make sales, marketing, and business decisions. This information is not personal information because it does not identify you or any particular individual or disclose your or any particular individual’s data.

Legal Bases for Processing (EEA/UK Users).  If you are located in the European Economic Area or United Kingdom, we process your personal information on the following legal bases:

  • Performance of a contract: We process your name, email address, and biometric profile data (height, weight, biological sex at birth, age) to create and maintain your account and deliver the Services you have requested.
  • Legitimate interests: We process error log data, IP addresses, and aggregated usage data to maintain the security and proper functioning of our Services and to improve our products. We have assessed that our legitimate interests in maintaining Service security and integrity are not overridden by your interests or fundamental rights, taking into account the limited nature of the data processed for these purposes and the safeguards we apply.Under certain conditions you have the right to object to processing based on legitimate interests by contacting us at [email protected].
  • Consent: We process your geolocation data, marketing communications preferences, and any data shared with your employer or partnering enterprise on the basis of your consent. You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
  • Special category data: Sweat electrolyte and volume data, skin temperature, motion data, and related biometric measurements collected by our sensors may constitute health data under applicable data protection law. We process this data only on the basis of your explicit consent, which we obtain during account creation and onboarding. You may withdraw this consent at any time, though doing so may prevent us from delivering core features of the Services.

Security

There are always risks associated with providing personal information, whether in person, by phone or via the internet or other technologies, and no system or technology is completely safe or “tamper”/”hacker” proof. We use industry-standard methods and procedures to keep your personal information safe and secure when it is transmitted over your home network and through the Internet to Epicore Biosystems’ servers, including any third-party servers utilized by Epicore Biosystems, where your information is processed.

Where do we process your information?

All information collected by the Services will be processed in and subject to the laws of the United States of America. If you are not located in the United States of America, such laws may not provide the same level of protection for your personal information as those in your home country. If you are located in the European Economic Area or United Kingdom, transfers of your personal information to the United States are made pursuant to Standard Contractual Clauses approved by the European Commission. Under certain conditions you may request a copy of the applicable Standard Contractual Clauses by contacting us at [email protected].

Your Rights

Where Epicore Biosystems uses personal data in research and development activities, we do so on the basis of your explicit consent. Where such activities involve health or biometric data, we process that data only on the basis of your explicit consent. You may withdraw your consent at any time by contacting us at [email protected], though withdrawal will not affect the lawfulness of processing carried out prior to withdrawal. Where research and development activities are conducted by Epicore Biosystems using aggregated or anonymized data from which you truly cannot be identified, such data falls outside the scope of this Policy. You can choose not to share certain information with Epicore Biosystems. However, if you choose not to share such information, you might not be able to use or take advantage of many of our Services.

You always have the right to prohibit direct marketing. If you have given your consent to receive marketing messages from Epicore Biosystems, you can stop receiving them by following the “unsubscribe” instructions within each email communication. If you have created a user account, you can do this directly via our Service. Epicore Biosystems will not provide or share any mailing lists to third parties for promotional purposes. Emails related to services (to confirm a purchase, etc.) generally do not offer an option to unsubscribe as they are necessary to provide the service you requested. Such emails also include notifications about changes to our Privacy Policy.

You have the right to request deletion of any of your personal information by sending a request to our privacy team at [email protected]. If you want to have your personal information deleted, we will, under certain conditions, delete your user credentials and all personal information and personal data. This includes personal data in all Epicore Biosystems Services that you have used. The deleted data is not retrievable. After we’ve deleted your information, you can only use the service by creating a new user account. Additionally, you have the following rights:

  • Request access to your personal data. The right to access, update or delete the information Epicore Biosystems holds about you. This also enables you to receive a copy of the personal data Epicore Biosystems holds about you. We may charge you a small fee for this service.
  • Right to correct/rectify your personal data. You have the right to have any incomplete or inaccurate information Epicore Biosystems holds about you corrected. You also have the right to request Epicore Biosystems to complete the information you believe is incomplete.
  • Request the transfer of your personal data. Under certain conditions we will, upon request, provide to you or a third party you have chosen your personal data in a structured, commonly used, machine-readable format. This right may apply only to automated information which you initially provided consent for Epicore Biosystems to use, or where Epicore Biosystems used the information to perform a contract with you.

In some of our Services we request your consent. We request consent only in cases when it is necessary for offering the Service. You have the right to withdraw your consent at any time. The consent can be withdrawn within the Service, or by contacting Epicore Biosystems directly at [email protected]. Note that for some Services, if you choose not to provide your consent, you might not be able to use or take advantage of some of our Services.

Additional Rights for EEA/UK Residents

If you are located in the European Economic Area or United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

Using User Data for Research and Development

Epicore Biosystems focuses on personalized hydration and metabolic health management solutions. We have in-house experts specializing in material science, microfluidics, bioelectronics, chemistry, physiology, sports training, health and data science, and we carry out studies pertaining to wearable technologies, sports training, heat illness and nutrition on a regular basis.

Types of Research

Epicore Biosystems continuously studies human physiology and hydration to develop new technologies, products and services but also improve on existing ones. New algorithms are being developed and tested, and customer mass data is used to, for example, find anomalies in the features or to find devices that may not be working properly. These results are not shared outside of the company. They only support the in-house development work.

Some of the research is performed in cooperation with third-party research partners. The aim of research collaboration is to produce a scientific publication of the results. In these instances, the research work is conducted according to research study protocols and ethical requirements imposed on the study. In these studies, no customer data is given to the third-party research partners, but instead all data is processed within Epicore Biosystems and by our research team. If any customer personal data is used in the research, Epicore Biosystems must first obtain the customer’s separate informed consent to use their personal data for the specific research project.

Marketing research aims to better understand users of Epicore Biosystems’ devices and services, inform how the devices are being used in the field, and gauge what new features customers may want in future products. Marketing research is performed by analyzing data from users who have given their consent for marketing purposes.

Error Logs and Log Data

To offer the best possible service in the event of a problem, we store error data on our devices (“Error log”). When you synchronize your device with Epicore Biosystems’ service, the Error log is copied onto our server and saved there for a period of two years at maximum. The Error log is only used for error analysis and statistical purposes on the basis of our legitimate interest. It can be used, for example, when you contact our customer service about an error or when you report a bug in your device software.

When you visit our websites, we automatically receive and record certain information from your computer (or other device) and your browser. This may include such data as your IP address, the pages you visit on our websites, the date and time of your visit, the URLs from the websites you visit before and after navigating to the our websites, and certain cookie information (see below). To obtain such information, we may use web logs or applications that recognize your computer and gather information about its online activity.

Cookie Policy and Third-Party Services.

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. We use both session and persistent cookies on our website to improve your online experience. Session cookies are stored on your device during a single visit to the website, and they are deleted as soon as you close your browser. Persistent cookies remain on your device until they expire or you choose to delete them from your browser cache, and they are reactivated each time you visit the website that created them.

We may use cookies for the following purposes:

We will not rent or sell customer lists that include your personal information. We will not share your personal information except for the limited circumstances described in this Privacy Policy. We may share your personal information (i) for the reasons we tell you when we collect it, or (ii) in the following ways:

We may use cookies for the following purposes:

We will not rent or sell customer lists that include your personal information. We will not share your personal information except for the limited circumstances described in this Privacy Policy. We may share your personal information (i) for the reasons we tell you when we collect it, or (ii) in the following ways:

  • Analytics. To collect information about how you use our website, such as which pages you visit and if you experience any errors. These cookies collect only aggregate information and we use them to improve how our website works, and measure how effective our content is.
  • Marketing. To measure how you interact with our marketing communications to determine, among other things, how effective a marketing campaign is. We may use other similar data collection technologies (like web beacons, flash cookies, or pixels) to track how you use our Services and to help us manage content on our Services by informing us what content is effective.

You can manage and block cookies by adjusting the settings in your web browser. Each browser works differently, so please refer to your browser’s help menu. Essential cookies necessary for the operation of the website do not require your consent and will be placed automatically. Unless you have adjusted your browser settings, our system will issue cookies as soon as you visit our websites. Please note that if you set your browser to block cookies, either immediately or at a later time, you may not be able to access secure areas of the Services and other parts of the Services may also not work properly or may be limited. For further information, visit allaboutcookies.org.

Third-Party Websites and Services. When using the Services you may come across links or references to third-party websites and services that we do not operate or control. If you provide your personal information to that third party through its websites or services, you will be subject to that third party’s privacy practices and policies and terms of use. This Privacy Policy solely applies to personal information collected by Epicore Biosystems. Except as specifically indicated, Epicore Biosystems does not review or endorse those third parties, and is not responsible for the privacy practices of these third-party organizations.

Policy Changes. Please note that this Privacy Policy may change from time to time. When we make material changes to this Privacy Policy, we will give you notice by posting an alert through the Services or by sending you an email to the email address we have on file.

Connected Hydration Worker Safety Cloud and App

Epicore Biosystems’ Connected Hydration Worker Safety Cloud (the “Cloud”) is the associated cloud-based worker safety service that helps workers proactively hydrate and effectively recover during their work shift. The Cloud is connected to a weather reporting service to provide workers with real-time alerts. The Cloud also analyzes sweat loss, water and electrolyte intake, and temperature to provide recommendations and information to keep you physically and cognitively safe. Information is conveyed to you via the mobile app.

Before you can start using the Cloud, you must create a user account. You have the option to use your Connected Hydration device in a stand-alone mode with limited functionality (such as receiving real-time hydration recommendations); however, any historical data, trend analysis, proactive hydration recommendations based on weather would not be enabled. Where your employer or partnering enterprise has deployed the Services, data sharing may occur pursuant to your employer’s or partnering enterprise’s instructions as data controller. Your employer or partnering enterprise is responsible for establishing the lawful basis for such sharing, responding to data subject access requests and ensuring compliance with applicable data protection law with respect to such processing. Epicore Biosystems processes such data solely on your employer’s or partnering enterprise’s documented instructions and does not independently determine the legal basis for such directed data sharing. Anonymized group statistics, such as the number of hydration alerts triggered across workers during a given period, do not contain personal information and may be shared with your employer or partnering enterprise without restriction. Epicore Biosystems does not share your personal information or identifiable individual sensor data with your employer or partnering enterprise except where your employer, acting as data controller, has established a lawful basis for such sharing pursuant to a Data Processing Agreement with Epicore Biosystems, as described above.

Discovery Patch®

The Discovery Patch® Sweat Collection System is designed to collect sweat during on-body wear for biomarker research. The Discovery Patch® is intended for use by researchers and healthcare professionals for the collection of sweat in home and professional healthcare settings for biomarker research. Guidance for data privacy is governed by study protocols and informed consent.