Privacy Notice

This Privacy Notice (“Privacy Notice”) sets forth the policies and practices used by BioStem Technologies, Inc. (“BioStem”) regarding how we collect, use, and disclose any information associated with an identified or identifiable individual (“Personal Information”). It also explains the rights and choices individuals have concerning their Personal Information. BioStem, the owner and operator of https://biostemtechnologies.com/ (the “Website”), is a corporation formed under the laws of the State of Florida.

We collect a variety of information to provide analytics, reporting, and other services to our customers, users of the Website, and the public at large. Below is a breakdown of the types of information we collect:

1. WHAT INFORMATION WE COLLECT
Personal Information may include, but is not limited to:

Account Information.

We may collect information about your account, such as username and password.

Identifying Information.

We may collect identifiers, such as your first and last name, email address (including personal or business), date of birth, and unique identifiers (e.g., IP address, device ID, or session/cookie/browser ID).

Contact Information.

We may collect your contact details, such as your address (including home, work, mailing, shipping/billing, or employer), email address (including personal or work/business), and phone number (including home, mobile, work, or alternate).

Marketing Preferences.

We may collect opt-in and opt-out signals and consent records, communication and notification preferences, marketing analytics and promotional preferences, and newsletter and subscription information.

Employment-Related Information.

We may collect job title and role (current or past), job information (including employer, department, contact details, work address, and work contact information) (current or past), professional memberships, associations, team affiliations, and certifications, and self-employment information (such as tax ID, business registration number, company identifiers, business model, anticipated revenue, and terms agreement status for affiliates or resellers).

Sensory Data.

We may collect sensory data, including call or voice recordings (e.g., customer service calls and transcripts), and/or audio recordings (e.g., user-generated content and game audio chats), and/or video recordings (e.g., CCTV recordings and webcam recordings).

Health Information.

With either HIPAA consent or other permissible legal basis for processing, we may collect medical records and health insurance data.

Location Data.

With your consent, we may collect precise physical location, and/or GPS data, and/or in-store, session, or geofencing location.

Application Information.

We may collect Personal Information submitted as part of an application for employment, including any responses provided to questionnaires about the application.

Customer Records and Payment Information.

We may collect bank account number (including routing number, account type, and institution) and credit or debit card numbers (including expiration date, security code, and cardholder name/address).

Commercial and Financial Information.

We may collect subscription or membership status and event participation (e.g., RSVP and attendance).

Inferences Drawn from Personal Information.

We may draw inferences from the Personal Information described above, including profiles based on inferences and/or consumer segmentation data.

Behavioral and Advertising Data.

We may collect tracking data via cookies and pixels.

Sensitive Information.

With the proper consent or other permissible legal basis for processing, we may collect age, age band, or date of birth, and gender or gender identity/expression.

Device Information.

We may collect device information (such as device model, type, or name, OS version, browser type and version, network provider, time zone, language, screen resolution, plugin types, serial number, and advertising ID) and location data (from device, GPS, or IP).

Client and Log Data.

We may collect interactions with websites and applications (including download errors and crash logs).

Usage Information.

We may collect interactions with websites (such as date and time of access, pages or sections visited, time and duration of visit, navigation path, referring URL, exit pages, clicks and interactions, and ad engagement and performance), interactions with emails (such as opens and clicks), and clickstream data (including reporting cookies, beacons, pixels, and SDK tags), and cookie preferences.

Communications.

We collect information that you provide when you contact us, whether that contact is via phone, mail, text message, email, web form, social media post, or any other form of communication.  Any Personal Information provided in such communications will be processed in accordance with this Privacy Notice.

Other Necessary Information.

We also collect other data that may include Personal Information where we are required or entitled by applicable law to collect and process such data for authentication or identification or for the verification of data we collect.

2. HOW WE COLLECT PERSONAL INFORMATION
We collect the Personal Information described in Section 1 in the following ways:

From You.

We collect Personal Information from you when you voluntarily provide such information, such as when you contact us, or use our Website or Digital Properties. We collect the following categories of Personal Information directly from you: identifiers; contact information; marketing preferences; employment-related information; sensory data; health information; location data; job applicant data; customer records and payment information; commercial and financial information; inferences drawn from personal information; behavioral and advertising data; sensitive information; device information; client and log data; and usage information.

Automatically When You Use Our Website.

When you interact with the Website or Digital Properties, we automatically collect the following categories of information about you: identifiers; contact information; marketing preferences; behavioral and advertising data; device information; client and log data; and usage information.

We use cookies as part of our process for collecting data automatically. See our Cookie Policy https://biostemtechnologies.com/cookie-policy/ for further information.

From Other Sources.

We may receive or collect information from a variety of third parties in the normal course of serving you and operating our business. For example, we collect information from:

  • Service Providers
  • Marketing companies that help us learn about consumer interests and trends
  • Social media platforms
  • Public records resources
  • Service providers that operate on our behalf and collect information
  • Physician Specialty Societies
  • Other professional societies and organizations
  • Public databases

If we do so, this Privacy Notice governs how we use that information, whether such use is independent of or in combination with information you have provided.

From Job Applicants.

If you apply for a job through our Website or an external job board, your application and any additional information that you provide may be used to assess your skills and interests as they relate to any career opportunities with BioStem, and for any reporting purposes that may be required by applicable law. We may also use your information to communicate with you and to inform you of career opportunities.

Information Related to Services and Registering Interest in Clinical Trials.

We collect Personal Information from you through and related to our Services, for example, when you register interest in or sign up for a clinical trial, attend our events, or subscribe to our email updates. If you enroll in a clinical trial, you will receive detailed information about any data processing, including the collection and use of Personal Information related to that clinical trial, from the entity conducting the clinical trial during the initial registration process.

Sensitive Personal Information.

We collect certain categories of sensitive Personal Information as part of our operation of our company and our Website and/or Digital Properties.

Sensitive Personal Information (as defined by applicable law, including the CPRA) may include precise geolocation; racial or ethnic origin; health and genetic data (e.g., in clinical trial contexts); and government identifiers where legally required. If you submit such information to us or we collect for another legitimate business purpose, it will be governed by this Privacy Notice. We do not use or disclose Sensitive Personal Information for purposes other than those permitted by law, and you have the right to limit certain uses and disclosures as described below.

Where we process sensitive Personal Information (also known as "special category data" under the GDPR), we do so only with your explicit consent or on another lawful basis permitted by applicable law, such as where processing is necessary: (i) to protect your vital interests or those of another person; (ii) for the establishment, exercise, or defense of legal claims; (iii) for reasons of substantial public interest; or (iv) for purposes of preventive or occupational medicine. We implement enhanced security measures and access controls for sensitive Personal Information, and we limit access to authorized personnel on a need-to-know basis. We will inform you at the time of collection about the specific legal basis we rely upon for processing your sensitive Personal Information.

3. HOW WE USE YOUR PERSONAL INFORMATION.
We use your Personal Information in order to operate, provide, maintain, develop, and promote our Website and Digital Properties, as permitted by law, for the following business purposes:

To Provide You With the Website and/or Digital Properties.

This includes the operation and maintenance of the Website and/or Digital Properties; and providing you with user support; and fulfilling or meeting the reason the individual provided the information (e.g., process orders, provide information); and processing or fulfilling orders and transactions. We use the following categories of Personal Information for this purpose: identifiers; contact information; marketing preferences; sensory data; location data; customer records and payment information; commercial and financial information; inferences drawn from personal information; behavioral and advertising data; device information; client and log data; and usage information.

To Process Payments and Perform Financial Transactions.

This includes processing, completing, and administering payment card and other financial transactions. We use the following categories of Personal Information for this purpose: identifiers; contact information; customer records and payment information; and commercial and financial information.

To Communicate with You.

This includes responding to your comments or inquiries and fulfilling your requests; providing you with user support and customer care; sending you administrative communications, such as confirmation emails, technical notices, policy updates, or security alerts; and soliciting and responding to user feedback, reviews, survey responses, and product evaluations. We use the following categories of Personal Information for this purpose: identifiers; contact information; marketing preferences; employment-related information; device information; and usage information.

To Send You Marketing and/or Promotions.

This includes sending you promotional information, such as newsletters and advertisements, including information and advertisements from our affiliates and on behalf of our promotional and strategic partners. We use the following categories of Personal Information for this purpose: identifiers; contact information; marketing preferences; inferences drawn from personal information; behavioral and advertising data; and usage information.

For Analytics, Research, and Product and Service Improvements.

This includes tracking and measuring the performance of the Website and/or Digital Properties; and performing quality control of our Website and/or Digital Properties; and conducting aggregated or de-identified research and statistical reporting for business purposes or regulatory/royalty reporting. We use the following categories of Personal Information for this purpose: identifiers; contact information; marketing preferences; behavioral and advertising data; device information; client and log data; and usage information.

For Personalization and Advertising.

This includes analyzing usage data for ad measurement, segmenting, and campaign optimization; and building or sharing user audiences (custom audiences, look-alike audiences, audience matching). We use the following categories of Personal Information for this purpose: identifiers; contact information; marketing preferences; inferences drawn from personal information; behavioral and advertising data; device information; and usage information.

To Ensure the Security and Integrity of the Services.

This includes securing our systems; protecting our business, our employees, and you by preventing, detecting, investigating, and securing against unauthorized or illegal activity and other security-related technical issues; and conducting risk analysis, risk management, and compliance with security best practices. We use the following categories of Personal Information for this purpose: identifiers; contact information; sensitive information; device information; client and log data; and usage information.

To Comply with the Law and Enforce Our Terms.

This includes the use of Personal Information as we believe to be necessary or appropriate for certain essential purposes, including: meeting our legal or regulatory obligations; complying with valid legal process; and protecting rights, safety, and property; to enforce our Terms of Service and all other applicable terms and policies; and enforcing any legal terms that govern our business and commercial relationships. We use the following categories of Personal Information for this purpose: identifiers; contact information; employment-related information; health information; customer records and payment information; commercial and financial information; sensitive information; device information; client and log data; and usage information.

For Other Business Purposes.

This includes processing Personal Information in connection with a job application or inquiry, to evaluate an individual for employment consideration, conduct background checks, verify employment eligibility, and other similar manners; preserving and managing records of employment, business relationships, and performance for legal/commercial purposes; sharing personal information with service providers, contractors, business partners, affiliates, and parent/subsidiary companies for business-related functions; and executing business transfers (mergers, sales, acquisitions, bankruptcy, or dissolution). We use the following categories of Personal Information for this purpose: identifiers; contact information; marketing preferences; employment-related information; health information; job applicant data; customer records and payment information; commercial and financial information; and sensitive information.

Use of AI, ML, and Automated Decision-Making.

To the extent permitted by law, we may use Artificial Intelligence (“AI”), or Machine Learning (“ML”), or Automated Decision-Making (“ADM”) as part of our processes that use your Personal Information. Such uses include:

Recommendations.

We use AI and ML technologies to analyze your preferences and behaviors to provide recommendations based on your unique personal profile.

Functionality/Operation.

We use AI and ML technologies to enable normal operation of the Website, and perform analysis to help us understand how you use the Website and/or Digital Properties in order to improve upon your experience.

Communication.

We use AI and ML technologies to provide marketing and informational messages, personalized for the specific individual, based on a profile, inferences, and/or likely interests.

Automated Decision-Making.

Certain decisions regarding our services may be made automatically using ADM processes. These decisions are based on data analysis and are designed to improve service efficiency and accuracy.

Vendor Use of AI.

Our service providers may use techniques like AI and/or ML to help us improve our Website and/or Digital Properties. When our service providers use such tools, it either: (1) still has a human being involved in the process, and thus is not fully automated; or (2) uses such tools in ways that do not have significant privacy implications (e.g., reordering how products might appear when you visit an online store) and does not produce any legal or similarly significant effects.

4. HOW AND TO WHOM WE DISCLOSE PERSONAL INFORMATION.
We may disclose Personal Information in certain circumstances as part of our general business practices. This section discusses those circumstances.

Disclosures for Business Purposes.

To the extent permitted by law, your Personal Information may be disclosed with the following categories of third parties:

Parent Companies and Affiliates.

For business-related functions, we may share Personal Information with a parent company, any subsidiaries, or other companies under a common control (collectively, our “Affiliates”), but only to the extent that such information is afforded an equal or greater level of protection as provided by this Privacy Notice.

Business Transfers.

If we sell or transfer all or part of our business assets, Personal Information may be included. We will make every effort to ensure that any transferred Personal Information receives protection equal to or greater than that provided by this Privacy Notice. In the event of such a transfer, you are encouraged to contact the recipient with any questions about their applicable privacy practices.

Agents, Consultants and Related Third Parties.

For business-related functions (such as mailings, database maintenance, and payment processing), we may share Personal Information with third parties, but only to the extent necessary to perform their designated function.

When Legally Required.

We may share Personal Information with law enforcement authorities, regulators, courts and tribunals, governmental or public bodies, and other relevant third parties as we believe necessary or appropriate to protect people or property, to protect our services, rights or property, to comply with legal or regulatory requirements and to respond to legal process, law enforcement requests and requests from other public and government authorities.

Third Party Vendors.

We share Personal Information with vendors and service providers. Each third-party vendor's privacy notice explains their use of your Personal Information. These include the following categories of vendors:

General Service Providers:

We use third party vendors to provide operational, administrative, technical, professional, and customer-facing services that support our business. These vendors may process personal information to help us operate our services, manage customer relationships, respond to requests, maintain records, improve our offerings, and perform other services on our behalf.

CRM Providers.

We use third party vendors, including SalesForce, to manage customer relationships, sales pipelines, contact records, lead information, customer interactions, and account-management activities. These vendors may process names, contact details, company information, communications history, preferences, purchase history, and related business records.

We utilize third-party vendors to manage customer interactions and data, which may be enriched or updated by the vendor to ensure accuracy and relevance.

Analytics Providers:

We use third party vendors to help us understand how individuals interact with our websites, applications, products, services, communications, and advertisements. These vendors may collect or process device information, usage information, cookies, pixels, IP addresses, browser information, app activity, engagement data, and similar information to measure performance, troubleshoot issues, and improve user experience.

Google Analytics: Privacy Notice

Google Analytics Opt-Out. You can prevent Google from collecting and using data (cookies and IP address) by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout. The Google Analytics opt-out add-on is designed to be compatible with Chrome, Edge, Safari, Firefox and Opera. In order to function, the opt-out add-on must be able to load and execute properly on your browser.

Advertising And Marketing Providers:

We use third party vendors to deliver, personalize, target, retarget, and measure advertising and marketing communications across our services and third-party websites, apps, platforms, and media channels. These vendors may process contact information, hashed identifiers, cookies, advertising IDs, device information, browsing activity, purchase or engagement data, and campaign-performance information.

Email Marketing & Newsletters.

We utilize third-party vendors, including HubSpot, to conduct email-based marketing. Through third-party vendors, we collect information related to our communication effectiveness and the impact of our email marketing, including tracking the actions you take that assist us in measuring the performance of our Website, our Services, and our Email Marketing. These vendors may process contact information, audience information, campaign data, preferences, survey responses, and engagement metrics.

Upon subscription, our email marketing vendors track the pages you visit on the Website. If you are or become a subscriber, information about user engagement and path is provided to these vendors to assist in this function.

Our marketing emails and/or newsletters contain tracking pixels, allowing us to analyze the success of our marketing emails and/or newsletters. These tracking pixels allow us to see if and when you opened an email, which links you click in the email, and which pages of the Website you visit.

Subscription and Membership.

We use third party vendors to handle sign-up and/or enrollment, including all necessary consent documentation. These vendors may process contact information, audience information, campaign data, preferences, survey responses, and engagement metrics.

Surveys and Forms.

We utilize third-party vendors to create and manage online surveys and other forms, facilitating the collection and organization of information. Personal Information may be collected and maintained as a result of interacting with any surveys or forms.

Geofencing (for Direct Marketing Purposes).

We utilize third-party vendors to deliver location-based direct marketing through geofencing technology. Geofencing allows us to define virtual geographic boundaries and deliver targeted advertisements to users whose devices enter or are detected within a designated area. Personal Information that may be disclosed to these vendors includes precise geolocation data. These vendors process your Personal Information on our behalf for the sole purpose of delivering and measuring location-based marketing campaigns. For more information on our collection of precise geolocation data, or your right to opt out of such collection, see Section 5.

Events.

We use third-party vendors to create in-person events. If you sign up for, attend, or purchase tickets to any of our in-person or online events, you will be required to submit Personal Information to register and log in. You may also receive emails with reminders, playback links, and other information from us or our third-party vendors. The vendor stores all the information you submit, which is subject to the vendor’s privacy policy.

Webinars.

We host webinars through third-party vendors. If you elect to participate, you will be required to submit Personal Information to register and log in. You may also receive emails containing reminders and playback availability. All information you submit is stored by the vendor hosting the webinar, and is subject to their respective privacy policies.

Data Brokers, Data Enrichment Providers, And Market-Data Providers:

We use third party vendors to supplement, verify, update, analyze, or enrich information we maintain about customers, users, prospects, businesses, or audiences. These vendors may provide or process demographic information, business contact information, interest data, audience segments, identity-matching data, or other commercially available or inferred information for marketing, analytics, personalization, fraud prevention, or business development.

Business Partners And Joint-Marketing Providers:

We use third party vendors to offer, administer, promote, or support products, services, events, programs, rewards, referrals, co-branded offerings, sponsorships, and joint-marketing activities. These partners may process contact information, account information, preferences, eligibility information, transaction data, participation records, and engagement information depending on the nature of the partnership.

Platform, Integration, and App Marketplace Partners:

We use third party vendors to enable integrations with third-party platforms, applications, APIs, plug-ins, marketplace apps, developer tools, and connected services. These vendors may process account information, authentication data, permissions, configuration settings, content, usage data, and other information that users or administrators choose to connect, transmit, or authorize through the integration.

Logistics, Fulfillment, and Delivery Providers:

We use third party vendors to fulfill orders, ship products, deliver services, manage inventory, process returns, coordinate pickups, clear customs, track shipments, and support transportation or delivery operations. These vendors may process names, addresses, contact information, order details, delivery instructions, tracking numbers, shipment contents, signature information, and related logistics records.

Professional Advisors:

We use third party vendors to obtain legal, accounting, audit, insurance, tax, consulting, financial, and other professional services. These advisors may process personal information when necessary to provide advice, conduct audits, manage claims, support compliance, evaluate transactions, resolve disputes, or protect our legal and business interests.

Government, Legal, and Regulatory Recipients:

We use third party vendors to disclose information when required or permitted by law, legal process, regulation, court order, subpoena, governmental request, public-health obligation, tax obligation, or similar requirement. These disclosures may involve personal information necessary to comply with legal obligations, protect rights and safety, investigate suspected misconduct, enforce agreements, cooperate with authorities, or support regulatory reporting.

Industry-Specific Recipients:

We use third party vendors to provide industry-specific products, services, compliance functions, customer support, transactions, or operational activities that are necessary for the nature of our business. Depending on the industry, these parties may include hotel franchisees or property owners, healthcare providers or labs, payors or health plans, clearing firms or product sponsors, automobile manufacturers or warranty providers, EdTech vendors, travel suppliers, hosts, moderators, creator payout vendors, or similar specialized third parties.

Healthcare Providers.

We use third party vendors to coordinate, provide, support, bill for, or administer healthcare-related services. These providers may process patient information, appointment details, treatment information, insurance information, billing records, prescriptions, test results, and other information necessary to provide care.

Laboratories.

We use third party vendors to perform testing, analysis, diagnostics, research, quality-control review, or other laboratory services. These vendors may process patient or participant identifiers, specimens, test orders, test results, health information, device data, and related records.

Payors and Health Plans.

We use third party vendors to verify coverage, process claims, obtain payment, coordinate benefits, support care management, and administer health-plan or insurance-related functions. These vendors may process identity information, insurance information, treatment or service information, billing records, claims data, and eligibility information.

Other Third Parties.

We send your Personal Information to third parties at your direction or with your consent.

Advertisers.

We partner with demand-side platforms who buy our ad placements through third-party vendors. We share your information with those vendors in a de-identified and/or aggregated form for monitoring and reporting the effectiveness of the campaign delivery to our business partners and for internal business analysis.

Sale and “Sharing” of Personal Information.

We do not sell your Personal Information to third parties in exchange for monetary compensation. However, we may disclose certain categories of Personal Information to third parties, such as our affiliates, subsidiary companies, and business partners. These third parties may receive other valuable consideration or benefit from the use of the disclosed information for their own purposes, such as improving or enhancing their own products, records, or services, which may qualify as a “sale” or “sharing” of Personal Information as those terms are defined under the CCPA and other applicable U.S. state privacy laws.

Categories of Personal Information that may be disclosed in this manner include: identifiers and contact information, such as your name, and email address, and telephone number, and postal address; and online and technical information, such as IP address, and device identifiers, and cookie identifiers, and information regarding your interaction with our Website; and commercial information; and geolocation data; and professional or employment-related information; and inferences or profiles derived from the foregoing. We do not sell or share the Personal Information of consumers we know to be under 16 years of age unless we receive affirmative authorization as required by applicable law.

You have the right to opt out of such sales and sharing. To exercise this right, please visit the "Do Not Sell or Share My Personal Information" link available on our Website, or submit a request pursuant to Section 5 of this Privacy Notice. We also honor browser-based opt-out preference signals, such as the Global Privacy Control ("GPC"), as required by applicable law.

Disclosure of Other Information.

In addition to collecting Personal Information, we may collect information that does not identify you and is not associated with your Personal Information. We may also de-identify, anonymize, or aggregate information so it no longer identifies you. When we use or disclose de-identified information, we keep it in de-identified form, do not attempt to re-identify it unless allowed by law, and require recipients to do the same through contractual agreements.

Analysis of Website Performance.

We may collect and combine such information with other data to monitor, for example, the total number of visitors to our Website, the number of visitors to each page, and the domain names of our visitors’ Internet service providers. It is important to note that no Personal Information is involved or used in this process.

Customer Research.

To better serve and understand the needs of the Website’s users, we may conduct research on their demographics, interests and behavior using the Personal Information and other data we collect. This research may be compiled and analyzed in the aggregate, and we may share this aggregated data with our affiliates, agents and business partners. This aggregate information does not identify you personally. BioStem may also disclose aggregated user statistics to describe our services to current and potential business partners, as well as to other third parties for lawful purposes.

Legal Basis for Processing Your Personal Information.

Some jurisdictions require that companies tell you about the legal grounds that allow your data to be used or disclosed. Below are the types of lawful bases that we will rely on to process your Personal Information:

Legitimate Interest.

We may process your Personal Information where we have a legitimate interest in conducting and managing our business to enable us to provide you with the best service, products, and a secure experience. We balance the potential positive and negative impacts on you and your rights. If the impact on your rights outweighs our legitimate business interests, we do not use or disclose your Personal Information without your consent, unless required or permitted by law. You can obtain further information about how we evaluate our legitimate interests against any potential impact on you for specific activities by contacting us at [email protected].

Performance of Contract.

We may process your Personal Information where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply With a Legal or Regulatory Obligation.

We may process your Personal Information where it is necessary for compliance with a legal or regulatory obligation.

Consent.

You have given express permission for a particular use of your Personal Information. Where we rely on your consent as the legal basis for processing your Personal Information, you may withdraw your consent at any time by contacting us at [email protected].

Phone Numbers & SMS Marketing.

Collection and Purpose.

If you provide your mobile number to BioStem (e.g., when creating an account, submitting a form, or otherwise opting in), BioStem may use your mobile number to send you SMS/text messages, including marketing information about trade shows, transactional information, professional communication, and other news. Consent to receiving messages is not a condition of purchase, lease, or sale.

How Messages are Sent.

Messages may be sent using an automated dialing system to the mobile number you provide. Message frequency varies. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

Opt-Out (“STOP”).

You may opt out of marketing texts at any time by replying “STOP” to any message we send. After you send STOP, you may receive a one-time confirmation text, and then you will no longer receive marketing texts to that mobile number unless you re-opt in. For assistance, reply “HELP.”

Transactional Texts.

If you are in an active transaction or have requested a specific service, you may still receive those transactional texts; to opt out of those messages, reply “STOP” on the relevant text thread.

Sources.

BioStem collects phone numbers directly from you and, where permitted, via branded or co-branded sign-ups and referral programs. BioStem does not buy, sell, or rent phone or mobile numbers for third-party marketing.

Sharing with Service Providers.

BioStem may disclose your phone or mobile number to SMS platform providers, delivery vendors, mobile carriers, or other marketing or communication services platforms to send texts on our behalf. BioStem does not permit these parties to use your phone or mobile number for their own marketing. BioStem does not “sell” or “share” your phone or mobile number for cross-context marketing or behavioral advertising.

Lawful Basis and Other Rights.

BioStem’s lawful basis for use of your phone or mobile number for SMS marketing is your consent. Withdrawal of consent does not affect the lawfulness of BioStem’s use of your phone or mobile number for such purposes before such withdrawal. For all other purposes, the general terms of this Privacy Notice apply.

5. YOUR RIGHTS RELATED TO YOUR PERSONAL INFORMATION.
We provide several ways for you to exercise certain privacy choices about your Personal Information that we process. We are committed to respecting your privacy rights under all applicable data protection and privacy laws. Some privacy laws require us to give specific details about individual rights to consumers, which we have set forth in Section 11 of this Privacy Notice.

Marketing.

You may opt out of marketing-related communications from us at any time by contacting us through the contact information provided in this Privacy Notice or by using the unsubscribe mechanism contained in each email or responding “STOP” to automated text messages. We will make efforts to honor your request as soon as reasonably possible. Please note that even if you opt out of marketing emails, we may still send you important administrative messages, which you cannot opt out of.

Interest-Based Advertising.

We may partner with third-party advertising networks, analytics companies, and measurement services (collectively, "Ad Partners") to serve advertisements on our Website and/or Digital Properties and on third-party websites, mobile applications, and online services. These Ad Partners may use cookies, and/or pixel tags, and/or similar technologies to collect information about your activities across different websites, mobile applications, and services to provide you with advertising that is relevant to your interests ("Interest-Based Advertising").

To opt out of Interest-Based Advertising, you may use the following tools:

Please note that opting out of Interest-Based Advertising does not mean you will no longer see advertisements; rather, the advertisements you see may be less relevant to your interests. These opt-out mechanisms are specific to the browser or device on which they are exercised, and you will need to opt out on each browser and device for which you wish to limit Interest-Based Advertising.

Cookies Preferences.

To review and update your preferences for most types of cookies (other than those that are necessary) for our Services, click the “Cookie Preferences” link in the footer of the Website.

Location Information.

You can choose whether or not to allow the Website and/or Digital Properties to collect and use real-time information about your device's location information from your device in your device's privacy settings. If you block the use of location information, some parts of the Website and/or Digital Properties may become inaccessible or not function properly.

Deactivation.

You can deactivate your User Account at any time by contacting us at [email protected]. However, you will not be able to access any part of the Services that are for registered users only once your User Account is deactivated. Please note that even if you request deactivation of your User Account, it may take some time to fulfill this request.

Access, Amendment, and Deletion.

Under applicable privacy laws, you may have the right to request to review, make amendments, have deleted, or otherwise exercise your rights over your Personal Information that we hold, subject to certain legal limitations and requirements. If you are subject to such a privacy law, you may submit a request to us related to your Personal Information by submitting an email request to us at [email protected]

We will process any request in accordance with – and where required by – applicable law with respect to your Personal Information. We will take steps to verify your identity before implementing your request. We do not charge a fee to process or respond to your verified consumer request unless it is excessive, repetitive, manifestly unfounded, otherwise creates a burden or workload in excess of standard requests, or is prohibited by law. If we determine that the request warrants a fee, we will inform you of our decision and provide both a written justification for the fee, as well as a cost estimate, before proceeding with your request.

Time for Changes to Take Effect.

We aim to complete requests as soon as reasonably practicable, consistent with applicable laws. Requests made on behalf of another, which require confirmation of the agent’s authority and the authenticity of the requester, will likely take more time to complete.

We may need to retain certain information for recordkeeping purposes and to complete transactions you started before requesting a change or deletion. Some residual information may also remain in our databases and records and will not be removed. We may not always be able to fully comply with your request, especially if doing so would compromise our duty of confidentiality or if we are legally allowed to handle the request differently.

For jurisdiction-specific data privacy policies, please consult Section 11 of this notice for additional information.

6. CHANGES TO THIS PRIVACY NOTICE.

We may periodically update this Privacy Notice. Please reference the “LAST UPDATED” legend at the top of this page to see when this Privacy Notice was last revised. Any changes to this Privacy Notice will take effect upon the posting of the revised Privacy Notice on the Website.

If any changes to this Privacy Notice could potentially require you to provide renewed or additional consent for the use of your Personal Information, notice of the requirement, as well as information we are required to disclose related to your renewed or additional consent, will be prominently displayed, and will be sent to you directly via email and/or any other acceptable means of contact under applicable law. Your continued use of the Website will, along with express consent where required, constitute your consent to any additional processing of your Personal Information described therein.

7. AGE RESTRICTIONS.
BioStem does not knowingly collect any Personal Information from children under 13 or the age of majority. We encourage parents and legal guardians to monitor their children’s Internet activity and to help enforce this Privacy Notice by instructing their children never to provide Personal Information on this (or any) Website without parental permission. If a parent or guardian believes that BioStem has Personal Information about a child under 13 or the age of majority in its database, please contact [email protected] immediately. We will make every effort to promptly remove such information and unsubscribe them from any marketing lists.

8. THIRD PARTY PRIVACY PRACTICES.
Our Website and/or Digital Properties may contain links to third-party websites or apps. If you click on one of these links, be aware that each one will have its own Privacy Notice. We do not control these websites/apps and are not responsible for their policies. When you leave the Website, we encourage you to read the Privacy Notice of every website you visit.

We are not responsible for the privacy and data security practices of other organizations, such as Facebook, Instagram, Apple, Google, Microsoft, X, or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer. Please read their privacy policies and consider customizing your browser or device settings to limit the disclosure of certain information, such as location data.

Any Personal Information that you provide through these third-party websites, mobile applications, or social platforms will be subject to the Privacy Notice of its operator, and not this Privacy Notice.

9. DO NOT TRACK, GPC, OPT-OUT SIGNALS.
Do Not Track.

We do not monitor or follow “Do Not Track” (DNT) signals because there is no standard interpretation or practice for DNT signals. Therefore, we handle all user information consistent with this Privacy Notice.

Global Privacy Control and Opt-Out Preference Signals.

In addition to traditional Do Not Track signals, BioStem recognizes and responds to the Global Privacy Control ("GPC") opt-out preference signal, which is a browser-based signal that communicates your preference to opt out of the “sale” and/or “sharing” of your Personal Information, as those terms are defined under applicable laws. If our Website and/or Digital Properties detect that your browser or device is transmitting a GPC signal, we will process that signal as an opt-out request for that browser or device in accordance with applicable law.

Please note:

  • The GPC signal applies only to the specific browser and/or device from which it is transmitted. If you access our Website and/or Digital Properties from a different browser or device, you will need to enable the GPC signal separately for each.
  • If you clear your cookies, change your browser settings, or uninstall and reinstall your browser, your opt-out preference may need to be re-established.
  • The GPC signal is offered by third parties that we do not control. For more information about how GPC works, please visit https://globalprivacycontrol.org/.

10. MISCELLANEOUS TERMS AND CONDITIONS.
Other Terms and Policies.

This Privacy Notice is to be read in conjunction with this Website’s Terms of Use, and Cookie Policy. Your access to and use of the Website may also be subject to any separate agreements or terms and conditions you have signed or agreed to with BioStem. Please refer to those agreements as needed.

Reservation of Rights.

Regardless of any other part of this Privacy Notice, we reserve the right to disclose any personally identifiable or non-personally identifiable information about you to: (a) fulfill a government request; (b) conform with the requirements of the law or legal process; (c) protect or defend our legal rights or property, our Website, or other users; or (d) in emergencies, to protect the health and safety of our customers or the general public. This includes exchanging information with third parties and organizations to reduce credit risk and protect against fraud.

Security of Personal Information.

We use standard physical, technical and administrative measures designed to reduce the risk of loss, misuse, unauthorized access, disclosure, or modification of your Personal Information. Unfortunately, no system or network can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you suspect that the security of any Personal Information you provided to us has been compromised), please notify us immediately at [email protected].

Data Breach Notification.

In the event of a security incident involving unauthorized access to, disclosure of, or loss of Personal Information that is likely to result in harm or injury and/or increased risk of identity theft, we will notify affected individuals and relevant supervisory authorities in accordance with applicable law. Where required, we will provide notification without undue delay, and in any event within the timeframes mandated by applicable data protection laws. Notifications will include, where required, a description of the nature of the breach, the likely consequences of the breach, the measures we have already taken or propose to take in order to address the breach, and contact information for obtaining further information. For jurisdiction-specific breach notification requirements, please consult the applicable addendum in Section 11 of this Privacy Notice.

Retention of Personal Information.

We retain each category of Personal Information for only as long as necessary to fulfill the purposes described in this Privacy Notice. We consider the amount, nature, and sensitivity of the Personal Information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process it and whether those purposes can be achieved through other means; and any relevant legal, regulatory, tax, accounting, or reporting requirements.

11. ADDITIONAL INFORMATION FOR CERTAIN JURISDICTIONS.
Residents of certain countries or U.S. states have additional rights under applicable privacy laws, as described in this section. The term “Personal Information” encompasses “Personal Information” as defined by Canadian, Australian, and New Zealand law, as well as “Personal Data” as defined by the EU, the UK, Swiss, and Singaporean law. See the list below for which section applies to you.

  • If you are a California resident, please review Section 11.1.
  • If you are a resident of another U.S. state, please review Section 11.2.

11.1 Residents of the State of California.

CCPA Personal Information Use Disclosure.

The California Consumer Privacy Act of 2019 (“CCPA”) requires that we disclose certain categories of Personal Information that we collect, the sources of that Personal Information, the purpose of collecting such information and the categories of third parties with whom we share that information.

Categories of Personal Information that We Collect and Disclose: Our collection, use and disclosure of Personal Information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. Below we describe the categories of Personal Information we may collect about California residents (including the categories of Personal Information that we have collected about California residents in the past 12 months):

Identifiers.

Includes direct identifiers such as a real name, alias, address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

Customer Records. 

Paper and electronic customer records containing Personal Information, which you provide to us, such as name, digital signature, address, telephone number, email and other contact information, government identifiers, financial and payment information.

Characteristics of Protected Classifications. 

Such as disability and health information (e.g., which we may collect to, for example, make accommodations available to you at events we host), as well as inferences made about such characteristics based on other types of information we have collected from you or from third parties.

Commercial Information. 

Including records of real property, products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.

Usage Data.

Internet or other electronic network activity information including without limitation browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement.

Location Data. 

Location information about a particular individual or device.

Employment History. 

Professional or employment-related information, including inferences about such information based on other types of information we have collected from you or from third parties.

Education Information.

Education history and background, including inferences about such information based on other types of information we have collected from you or from third parties.

Profiles and Inferences. 

Inferences drawn from any of the information identified above to create a profile reflecting a resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

Sensitive Personal Information.

In limited circumstances, we may collect certain information considered to be sensitive Personal Information under the CCPA, including Social Security number and tax ID; driver’s license, state identification card, passport number, or other government identifier; financial account number and payment card data; health and medical data; citizenship or immigration status; and geolocation data; gender or gender identity/expression. If we process Sensitive Personal Information, California residents may also exercise the ‘Limit the Use and Disclosure of My Sensitive Personal Information’ option by contacting us as described above.

Per Category Disclosures: We do not ‘sell’ Sensitive Personal Information.

In addition, we may disclose any of the categories of Personal Information we collect about you to other third parties as directed by or consented to by you, or where necessary to fulfill your specific requests.

Sales and Sharing: The CCPA defines a “sale” as disclosing or making available Personal Information to a third party in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available Personal Information to a third party for cross-context behavioral advertising. While we do not disclose Personal Information to third parties in exchange for monetary compensation, we may “sell” or “share” (as defined by the CCPA): (i) identifiers, usage data, customer records, commercial information, and profiles with our affiliates and subsidiary companies (e.g., so they can improve or enhance their own records and for other purposes); (ii) identifiers, customer records, and commercial information related to transactions with partners and third-party businesses, who may use or process the information for their own commercial purposes; and (iii) identifiers, usage data, and commercial information to ad networks, social media platforms, and data analytics providers (e.g., to improve and measure our ad and marketing campaigns). Some third-party cookies and similar technologies on our Website may constitute a ‘sale’ or ‘sharing’ of Personal Information under California law. You can manage these by using the ‘Cookie Preferences’ or by enabling GPC in your browser.

Sources of Personal Information: We may collect Personal Information from the following sources:

  • Directly from the individual;
  • Donation and charitable giving records;
  • Real estate professionals, including brokers and independent agents;
  • Library account and borrowing history records
  • Property records, public records, and other publicly available sources;
  • Advertising networks;
  • Data analytics providers;
  • Social networks;
  • Government entities;
  • Data brokers;
  • Affiliate and subsidiary companies; and
  • Service providers.

Purposes of Collection, Use, and Disclosure: As described in more detail in Section 3, we collect, use, disclose, and otherwise process Personal Information (including sensitive Personal Information) for the following business or commercial purposes or as otherwise directed or consented to by you:

  • Providing support and related services;
  • Analyzing and improving our business;
  • Personalizing content and experiences;
  • Advertising, marketing, and promotional purposes;
  • Securing and protecting our business;
  • Defending our legal rights;
  • Planning and facilitating business transactions;
  • Auditing, reporting, corporate governance, and internal operations; and
  • Complying with any legal obligations.

Retention: We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice or otherwise disclosed to you at the time of collection unless an extended retention period is required or permitted by law. We may retain Personal Information for longer where required by our legal and regulatory obligations, professional indemnity obligations, or where we believe it is necessary to establish, defend, or protect our legal rights.

California law may permit you to request that we:

  • Provide you with a list of the categories of Personal Information we have collected or disclosed about you in the last twelve (12) months; the source category of such information; the business or commercial purpose for collecting or selling the information; and the categories of third parties to whom we disclosed the information;
  • Provide access to and/or a copy of the Personal Information we have collected about you.
  • Delete certain Personal Information we have collected about you.
  • Do not sell your Personal Information to any third parties.

Certain information is exempt from such requests under applicable law. You may also have the right to receive information about the financial incentives we offer you (if any). You also have certain rights under the CCPA not to be subject to certain negative consequences for exercising your CCPA rights.

Minors: We do not knowingly sell or share Personal Information of consumers under the age of majority.

Submitting CCPA Requests: California residents may exercise their CCPA privacy rights to know/access, delete, correct, and limit use/disclosure of sensitive Personal Information by submitting a verifiable request to us via:

We will respond to verified requests received from California residents as required by law. When you submit a request to know or delete, we will take steps to verify your identity by matching the information you provide with the information we have on file. You must provide all requested information so that we can process and verify your request. In some cases, we may ask for additional information to verify your request or, if necessary, to process it. If we are unable to verify a request, we will notify the requester. Authorized agents can submit a request on behalf of another individual by contacting us by mail. To do so, they will need to provide proof of their authorization. Additionally, we may also require the relevant consumer to directly verify their identity and the authority of the authorized agent.

Requests to Opt Out: Our Website and/or Digital Properties responds to global privacy control—or “GPC”—signals, which means that if we detect that your browser is communicating a GPC signal, we will treat that as a request to opt out of sales and sharing (such as through cookies and tracking tools) on the Website and/or Digital Properties. Note that if you come back to our Website from a different device or use a different browser on the same device, you will need to opt out or set GPC for that device and browser as well. You can also manage your preferences for targeting and other cookies on our Website through the “Cookie Settings” link in the footer of each Website.

For more information about GPC, please visit: www.globalprivacycontrol.org/. You may also submit a request to opt out of other sharing and sales by submitting a request via:

Rights Under California Shine the Light Law.

California residents may request from businesses with whom they have an established business relationship: (1) a list of categories of Personal Information, such as name, address, email address, and the type of services provided to the customer, that a business has disclosed to third parties during the immediately preceding calendar year for the third parties’ direct marketing purposes and (2) the names and addresses of all such third parties. To request the above information please contact us at [email protected]. We will respond to such requests within 30 days of receipt.

For more information about our privacy practices, contact us as set forth above.

11.2. Residents of Other U.S. States.

Certain U.S. states provide their state residents with rights to:

  • Confirm whether we process their Personal Information, and if so, provide limited information about the nature of the Personal Information collected, processed, and disclosed, the business or commercial purpose, and information concerning third parties to whom the Personal Information was disclosed.
  • Access and delete certain Personal Information.
  • Correct inaccuracies in their Personal Information, considering the Personal Information’s nature and processing purpose (excluding Iowa and Utah).
  • Data portability.
  • Opt-out of Personal Information processing for:
    • targeted advertising (excluding Iowa);
    • sales; or
    • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
  • Either limit (opt-out of) or require consent to process sensitive Personal Information.

The exact scope of these rights may vary by state. To exercise or appeal a decision regarding a consumer rights request, please contact us at [email protected]

If we deny your request, you may appeal our decision by emailing us and including ‘Appeal’ in the subject line and a brief explanation. We will inform you in writing of any action taken or not taken in response to the appeal within 45 days, including a written explanation of the reasons.

Nevada provides its residents with a limited right to opt out of the sale of Personal Information. However, please note that we do not currently sell data that triggers the statute's opt-out requirements.

12. SECTOR-SPECIFIC PRIVACY REQUIREMENTS.
12.1 Fair Credit Reporting Act (FCRA) Notice.

BioStem uses consumer reports subject to the Fair Credit Reporting Act ("FCRA") (15 U.S.C. § 1681 et seq.).

  • The right to obtain a free copy of your consumer report under certain circumstances;
  • The right to ask for your credit score;
  • The right to dispute incomplete or inaccurate information;
  • The right to have inaccurate information corrected or deleted;
  • The right to have outdated negative information not reported;
  • The right to limit access to your file;
  • The right to seek damages from violators; and

Permissible Purpose.

BioStem obtains consumer reports only for permissible purposes as defined by FCRA, which may include employment purposes (with proper disclosure and authorization).

12.2 Other Sector-Specific Requirements.

BioStem may be subject to additional sector-specific privacy requirements not described above. If you have questions about whether additional privacy requirements apply to our handling of your Personal Information, please contact us at [email protected].

FTC Act Compliance.

BioStem is committed to complying with Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive acts or practices in or affecting commerce. We strive to ensure that our privacy practices are consistent with the statements made in this Privacy Notice and any other representations we make about our data practices.