QCDx, Inc.

Privacy Policy

Effective Date: March 16, 2026

Last Updated: March 16, 2026

1. Introduction

QCDx, Inc. ("QCDx," "we," "us," or "our") is committed to protecting the privacy and security of personal information we collect through our website at www.qcd-x.com (the "Site"). QCDx is a cancer diagnostics company specializing in circulating tumor cell (CTC) detection and liquid biopsy technology, incorporated in Delaware and headquartered in Connecticut. Our Site serves pharmaceutical and biotechnology partners, healthcare providers, investors, and patients seeking information about our technology and services.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our Site or interact with us through our online services. Please read this policy carefully. By using our Site, you agree to the practices described herein.

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily submit to us, including when you:

• Complete a contact, inquiry, or partnership request form

• Subscribe to our newsletter or email communications

• Request information about our CTC analysis services or technology

• Apply for a position with QCDx

• Correspond with us by email or other means

 

The types of personal information collected through these channels may include:

• Name and professional title

• Company or institution name

• Business and/or personal email address

• Phone number

• Mailing or business address

• Areas of professional interest or inquiry

• Any other information you choose to include in your message or submission

 

2.2 Information Collected Automatically

When you visit our Site, we and our third-party service providers may automatically collect certain technical and usage data, including:

• IP address and general geographic location (country/region)

• Browser type, version, and language settings

• Device type and operating system

• Pages viewed, time spent on pages, and navigation paths

• Referring URLs and exit pages

• Date and time of your visit

 

This information is collected through cookies, web beacons, pixels, and similar tracking technologies, as described further in Section 6 of this Policy.

2.3 Information We Do Not Collect

QCDx does not collect or store protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA) through our public website. Our Site is not a platform for the submission of patient data, clinical samples, or medical records. If you are a clinical or pharmaceutical partner engaged in a service relationship with QCDx that involves patient-level data, such data is governed by a separate Business Associate Agreement or Data Processing Agreement, not this Policy.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

 

• Responding to inquiries and communications. To respond to questions, requests, and messages you submit through our contact forms or email.

• Business development and partnership communications. To facilitate discussions with pharmaceutical, biotechnology, and clinical partners regarding QCDx services and collaborations.

• Newsletter and marketing communications. To send you company updates, scientific publications, industry news, and information about our services, where you have opted in to receive such communications.

• Site analytics and improvement. To understand how visitors use our Site, identify technical issues, and continuously improve our online presence and content.

• Legal compliance and security. To comply with applicable legal obligations, protect against fraudulent or unauthorized activity, and enforce our terms and policies.

• Recruitment. To evaluate applications for employment and communicate with candidates.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, our processing of your personal data is based on the following legal grounds under the General Data Protection Regulation (GDPR) and applicable national laws:

 

• Legitimate interests (Article 6(1)(f)). Processing is necessary for our legitimate business interests, including responding to professional inquiries, conducting business development activities, analyzing Site performance, and maintaining security, except where such interests are overridden by your rights.

• Consent (Article 6(1)(a)). Where you have provided explicit consent, such as subscribing to our newsletter or accepting non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

• Performance of a contract (Article 6(1)(b)). Where processing is necessary to take steps at your request prior to or in connection with a contractual relationship with QCDx.

• Compliance with a legal obligation (Article 6(1)(c)). Where processing is required to comply with applicable law or regulation.

5. Disclosure of Your Information

5.1 We Do Not Sell Your Personal Information

QCDx does not sell, rent, or trade personal information to third parties for their own marketing purposes.

5.2 Service Providers

We may share personal information with trusted third-party service providers who assist us in operating our Site and conducting our business, including:

• Website hosting and infrastructure providers

• Email delivery and communication platforms

• Analytics providers (e.g., website traffic analysis tools)

• Customer relationship management (CRM) systems

• Recruitment and applicant tracking platforms

 

These service providers are contractually required to use your information only as directed by QCDx and in accordance with this Privacy Policy, and may not use it for their own independent purposes.

 

5.3 Legal Requirements

We may disclose personal information if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law, regulation, subpoena, court order, or legal process; (b) protect the rights, property, or safety of QCDx, our partners, or the public; or (c) detect, prevent, or address fraud or security issues.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, dissolution, or sale of all or substantially all of our assets, your personal information may be transferred as part of such transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

6. Cookies and Tracking Technologies

6.1 Types of Cookies We Use

Strictly necessary cookies. These are essential to enable core Site functionality and cannot be disabled. They do not require consent.

Analytics and performance cookies. These help us understand how visitors interact with our Site by collecting aggregated data (e.g., page views, session duration, traffic sources). We currently use Google Analytics for this purpose. We may in the future also deploy analytics or tracking tools provided by HubSpot and/or LinkedIn, and this Policy will be updated accordingly when those tools are activated.

Marketing and advertising cookies. In the future, we may use marketing platforms such as HubSpot and LinkedIn Insight Tag to measure the effectiveness of our content and communications with professional audiences. These tools may set cookies or pixels that track visits to our Site and link activity to profiles on those platforms. We will provide appropriate notice and obtain consent before deploying such tools.

Functional cookies. These remember your preferences and settings to improve your experience on return visits.

6.2 Third-Party Analytics and Tracking Tools

The following third-party tools are currently in use or anticipated on our Site:

 

• Google Analytics (active). Provided by Google LLC. Collects anonymized browsing and usage data. Google may process data in the United States. For more information, see Google's Privacy Policy at policies.google.com/privacy. To opt out, install the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.

• HubSpot (anticipated). A CRM and marketing automation platform that may be used to track form submissions and visitor behavior in connection with partnership and business development activities. HubSpot's privacy policy is available at legal.hubspot.com/privacy-policy.

• LinkedIn Insight Tag (anticipated). A JavaScript tag provided by LinkedIn that may be used to enable campaign reporting and audience analytics for professional audiences visiting our Site. LinkedIn's privacy policy is available at linkedin.com/legal/privacy-policy. LinkedIn members can opt out of the Insight Tag at linkedin.com/settings/guest-controls.

6.3 Your Cookie Choices

When you first visit our Site, you will be presented with a cookie consent banner (where required by applicable law, including GDPR) allowing you to accept or decline non-essential cookies by category. You may change your preferences at any time through our cookie settings tool or by adjusting your browser settings to block or delete cookies. Note that disabling certain cookies may affect the functionality of our Site. By accepting analytics, marketing, or advertising cookies through our consent banner, you consent to the collection and processing of your browsing data by the applicable third-party providers as described in this Policy. If you do not consent, only strictly necessary cookies will be deployed. You may withdraw your consent at any time by accessing our cookie settings tool or by clearing your browser cookies and declining consent upon your next visit.

6.4 Tracking Pixels and Similar Technologies

In addition to cookies, we and certain third-party partners may use tracking pixels (also known as web beacons, pixel tags, or clear GIFs) on our Site. A tracking pixel is a small piece of code embedded in a webpage that collects information about your browsing behavior, such as pages visited, time spent on the Site, and actions taken. Some tracking pixels may be provided by third-party platforms (such as analytics or advertising services) and may transmit information directly to those third parties. We will not deploy third-party tracking pixels that share your personal information with social media platforms or advertising networks without providing appropriate notice and, where required by applicable law, obtaining your prior consent. If you wish to limit tracking by third-party pixels, you may adjust your cookie preferences through our cookie settings tool, use browser-based opt-out mechanisms, or install privacy-focused browser extensions.

6.5 Do Not Track Signals

Some web browsers may transmit "Do Not Track" (DNT) signals to websites. Because there is no uniform standard for how DNT signals should be interpreted or honored, our Site does not currently respond to DNT signals. However, you may manage your cookie and tracking preferences through our cookie settings tool or by adjusting your browser settings.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including:

• Contact form submissions and correspondence: up to 3 years from the date of last interaction, unless an ongoing business relationship is established

• Newsletter subscriber data: until you unsubscribe or request deletion

• Analytics data: in accordance with our analytics provider's data retention settings (typically 26 months for Google Analytics)

• Recruitment data: up to 12 months from the conclusion of a recruitment process, unless required to be retained longer by law

 

After the applicable retention period, we will securely delete or anonymize your personal information in accordance with our data disposal procedures.

8. Your Rights and Choices

8.1 Rights Under GDPR (EEA, UK, and Switzerland Residents)

If you are located in the EEA, United Kingdom, or Switzerland, you have the following rights with respect to your personal data:

 

• Right of access. Request a copy of the personal data we hold about you.

• Right to rectification. Request correction of inaccurate or incomplete personal data.

• Right to erasure. Request deletion of your personal data, subject to certain legal exceptions.

• Right to restriction of processing. Request that we limit the ways in which we use your data.

• Right to data portability. Receive your personal data in a structured, commonly used, machine-readable format.

• Right to object. Object to processing based on legitimate interests or for direct marketing purposes.

• Right to withdraw consent. Where processing is based on consent, withdraw it at any time without affecting prior processing.

• Right to lodge a complaint. File a complaint with your local data protection authority. In the EU, supervisory authority contact information is available at edpb.europa.eu.

8.2 Rights for United States Residents

If you are located in the United States, based on your state of residence, you may have the following rights with respect to your personal data:

 

• Right of access. Request a copy of the personal data we hold about you.

• Right to rectification. Request correction of inaccurate or incomplete personal data.

• Right to erasure. Request deletion of your personal data, subject to certain legal exceptions.

• Right to restriction/opt-out of processing. Request to restrict/opt-out of the processing of your personal data, including for the purpose(s) of: (a) targeted advertising; (b) sale or sharing of personal data; or (c) profiling to make decisions that have legal or other significant effects on you.

• Right to data portability. Receive your personal data in a structured, commonly used, machine-readable format.

• Right to withdraw consent. Where processing is based on consent, withdraw it at any time without affecting prior processing.

• Right to non-discrimination. Residents have the right not to receive discriminatory treatment by covered businesses for the exercise of their rights conferred by the applicable privacy law.

8.3 Other Rights for California Residents

California residents have the right to request and obtain from QCDx once a year, free of charge, a list of the third parties we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties. As noted above, QCDx does not “sell” or “share” personal information (as those terms are defined under the California Consumer Privacy Act of 2018 (CCPA), and California Privacy Rights Act of 2020 (CPRA) (together, the “CCPA”) with third parties. To submit a CCPA request, contact us at info@qcd-x.com.

8.4 Other State Specific Rights

• No “Selling” or Processing for Targeted Advertising. As noted above, QCDx does not “sell” or “share” or process for targeted advertising (as those terms are defined under applicable privacy law) personal data.

• Connecticut Right to Appeal a Denied Appeal. If you are a resident of the State of Connecticut and your request for reconsideration of QCDx’s refusal to take action in accordance with the exercise of your rights in the “Rights for United States Residents” section is denied, you have the right to file a complaint with the Connecticut Office of the Attorney General by visiting the “File a Compliant” page here or contacting the Consumer Assistance Unit at 860-808-5420.

• Additional Delaware, Maryland and Oregon Rights. If you are a resident of the State of Delaware, Maryland or Oregon, you have the right to request a list of the specific third parties to which QCDx has disclosed your personal data.

• Additional Minnesota Rights. If you are a resident of the State of Minnesota, you have the right to: (a) request the specific third parties to whom QCDx has disclosed personal data; and/or (b) question the results of QCDx’s profiling to the extent it produced legal effects.

• Nevada Rights. If you are a resident of Nevada, you have the right to opt-out of the sale of certain personal data to third parties who intend to sell or license that personal data, even if your personal data is not currently being sold.

If you would like to exercise any of these rights, please contact at info@qcd-x.com.

8.5 Email Opt-Out

You may unsubscribe from our newsletter and marketing emails at any time by clicking the "unsubscribe" link in any such email or by contacting us at info@qcd-x.com. Note that even if you opt out of marketing communications, we may still send you transactional or administrative emails where permitted by law.

8.5 Automated Decision-Making

QCDx does not currently use automated decision-making or profiling that produces legal or similarly significant effects on visitors to our Site. If we implement such technologies in the future, we will update this Policy and provide appropriate notice and safeguards.

8.6 Verification of Requests

When you submit a request to exercise your privacy rights, we may ask you to provide information to verify your identity before we can respond. This helps us ensure that personal information is not disclosed to unauthorized parties. We will only use information provided for verification purposes to verify your identity or authority to make the request.

9. International Data Transfers

QCDx is headquartered in the United States. If you access our Site from outside the United States, your personal information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

For transfers of personal data from the EEA, UK, or Switzerland to the United States or other third countries, QCDx relies on appropriate transfer mechanisms as required by applicable law, including Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent instruments recognized under UK GDPR. If you would like more information about the safeguards we use, please contact us at info@qcd-x.com.

10. Security

We implement reasonable and appropriate technical, organizational, and administrative measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit (SSL/TLS), access controls, and vendor security assessments.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you believe your information has been compromised, please contact us promptly at info@qcd-x.com. In the event of a data breach affecting your personal information, QCDx will notify affected individuals and applicable regulatory authorities as required by applicable law and other applicable requirements.

 

11. Third-Party Links

Our Site may contain links to third-party websites, including those of scientific publishers, regulatory agencies, industry organizations, and partner companies. This Privacy Policy does not apply to those external sites. We encourage you to review the privacy policies of any third-party sites you visit, as we have no control over their practices.

12. Children's Privacy

Our Site is not directed to children under the age of 16 (or 13 in jurisdictions where COPPA applies). We do not knowingly collect personal information from individuals under 16 (or 13 in COPPA jurisdictions). If we become aware that we have inadvertently collected personal information from a child under the applicable age threshold, we will promptly delete it. If you believe we have collected such information, please contact us at info@qcd-x.com.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where appropriate, provide additional notice (such as a banner on our Site or an email notification to subscribers).

Your continued use of our Site following any update constitutes your acceptance of the revised Policy. We encourage you to review this Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or to exercise any of your rights described herein, please contact us:

 

QCDx, Inc.

Incorporated in: Delaware

Headquarters: Connecticut, United States

Email: info@qcd-x.com

Website: www.qcd-x.com

 

We will endeavor to respond to all legitimate requests within 30 days. Occasionally, it may take longer if your request is complex or if you have made multiple requests. In such cases, we will notify you and keep you updated on the status of your request.

 

If you are located in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EEA data protection authorities is available at: edpb.europa.eu/about-edpb/about-edpb/members_en.