EpiSAP Platform — Privacy Policy
Version 1.3

How to read this document

This document has the same structure as the Terms of Use:

1. The Body (clauses 1–19) sets out global privacy provisions that apply to every user of the Platform.
2. The Schedules (A–D) at the end contain region-specific provisions that modify the Body for users in those regions. Each Schedule states clearly when it applies. Order of precedence is in clause 2.

• If you are in Australia, read the Body and Schedule A.
• If you are in India, read the Body and Schedule B.
• If you are in the United States, read the Body and Schedule C.
• If you are anywhere else (including EU, UK, Canada, Brazil, South Africa, Switzerland), read the Body and Schedule D.

For shared concepts (User Content, Feedback, Platform IP, Episapient, Acceptance, Beta Tester, Material breach), the Terms definitions apply unless this Policy specifically defines a privacy-specific term.

BODY — Global Privacy Provisions

1. Definitions

Capitalised terms not defined in this Policy have the meanings given in the Terms of Use. Privacy-specific terms used in this Policy are:

"Controller" or "Data Fiduciary" or "Business" — the natural or legal person that, alone or jointly with others, determines the purposes and means of the Processing of Personal Information. For Personal Information processed in connection with the Platform, the Controller is Episapient (subject to clause 8 in respect of Personal Information embedded in User Content, where you may be the Controller and we may act as your Processor).

"Cross-border Transfer" — the transfer of Personal Information from a country in which a data subject is located to another country, including transfers within Episapient and to sub-processors.

"Data Subject", "Data Principal", or "Consumer" — the identified or identifiable natural person to whom Personal Information relates.

"DPDPA" — the Digital Personal Data Protection Act 2023 (India).

"GDPR" — Regulation (EU) 2016/679 (the EU General Data Protection Regulation), and where the context requires, the UK GDPR as adopted by the Data Protection Act 2018 (UK).

"Personal Information" or "Personal Data" — any information relating to an identified or identifiable natural person, as that term is defined under the Privacy Act 1988 (Cth) (Australia), the GDPR, the UK GDPR, the DPDPA, the CCPA/CPRA (California), and equivalent laws of any other jurisdiction in which a user is located. The term has its broadest reasonable meaning across these laws.

"Privacy Officer" — the individual at Episapient with day-to-day responsibility for privacy compliance and complaints handling, contactable at privacy@episapvault.com. The Privacy Officer is not a designated Data Protection Officer for the purposes of GDPR Art 37 or DPDPA s 10 unless that designation is separately stated in this Policy.

"Processing" — any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

"Processor" or "Data Processor" — a natural or legal person that Processes Personal Information on behalf of a Controller.

"Sensitive Personal Information" or "Special Category Data" — Personal Information that, under the law of the relevant jurisdiction, is treated as sensitive and subject to additional safeguards. Examples include: information about racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; genetic data; biometric data processed for identification; health data; data about sex life or sexual orientation (GDPR Art 9); precise geolocation, government identifiers, financial-account information, contents of communications, and account credentials (CCPA/CPRA § 1798.140(ae)); and the categories listed in DPDPA where applicable.

"Vault Content" or "User Content" — has the meaning given in the Terms (clause 1 of the Terms): the data, documents, files, images, models, code, or other material you upload to the Platform other than Feedback. Vault Content may itself contain Personal Information about you or about third parties; clause 8 addresses how that Personal Information is treated.

2. Scope; Relationship to the Terms

2.1 This Privacy Policy applies to Personal Information that Episapient collects, uses, discloses, stores, transfers, or otherwise Processes in connection with your access to or use of the Platform (including the EpiSAP Quantum Vault, CollabHub, and any other services or features under the EpiSAP brand).

2.2 This Policy is incorporated into the Terms by reference (see Terms clause 9). On matters concerning Personal Information, this Policy prevails over the Body of the Terms in the event of conflict (Terms clause 23.2(d)). Non-derogable local law and the applicable regional Schedule prevail over both, in the order set out in Terms clause 23.2.

2.3 This Policy does not cover:

1. third-party websites, services, or applications that you may access through links from the Platform (those are governed by the third party's own privacy notice);
2. your collection and processing of Personal Information embedded in your Vault Content for your own purposes (you act as the Controller for that processing — see clause 8); or
3. information that has been irreversibly anonymised so that no individual is reasonably identifiable.

3. Personal Information We Collect

We collect the following categories of Personal Information.

3.1 Sensitive Personal Information. The Platform does not require you to provide Sensitive Personal Information. We will not knowingly collect Sensitive Personal Information unless (a) you choose to include it in Vault Content (in which case we Process it only as necessary to host and secure the vault — we do not look at the substantive content of your vault); (b) you provide it as part of identity verification (where this is required to comply with law and is processed under additional safeguards); or (c) you choose to include it in Feedback or support communications (in which case we ask you not to do so).

3.2 Children. The Platform is not directed at children under 18. See clause 14 and (for users in the United States) Schedule C.5 in respect of children under 13 (COPPA).

4. How We Collect Personal Information

We collect Personal Information in three ways:

1. Directly from you — when you register an account, log in, configure preferences, upload Vault Content, give Feedback, contact support, complete identity verification, or pay for a paid tier.
2. Automatically — through cookies, software development kits (SDKs), server logs, audit logs, and analytics tools when you access the Platform. See Annex 2 for cookies and similar technologies.
3. From third parties — including (where you choose to use them) authentication providers (single sign-on / OAuth), identity-verification providers, payment processors, fraud and abuse prevention services, and publicly available sources where we need to verify identity or comply with sanctions / anti-money-laundering law (Terms clause 2.1(c)). The current list of sub-processors is at https://vault.episapvault.com/legal/sub-processors (see Annex 1).

5. Why We Use Personal Information (Purposes)

We Process Personal Information for the following purposes. Where the law applicable to you requires us to identify a lawful basis (clause 6), we map each purpose to that basis below.

6. Lawful Bases (Where Required by Law)

For users in jurisdictions whose privacy law requires a lawful basis for Processing (including the EU, UK, and analogous regimes), we rely on one or more of the following bases:

1. Consent (GDPR Art 6(1)(a); UK GDPR; DPDPA s 6 for India; analogous bases under other laws) — where you have given freely-given, specific, informed, unambiguous, and (for special-category data) explicit consent. Consent can be withdrawn at any time without affecting the lawfulness of Processing already carried out.
2. Contract performance (GDPR Art 6(1)(b)) — where Processing is necessary to perform our contract with you (the Terms) or to take pre-contractual steps at your request.
3. Legal obligation (GDPR Art 6(1)(c)) — where Processing is necessary to comply with a legal obligation to which Episapient is subject.
4. Vital interests (GDPR Art 6(1)(d)) — where Processing is necessary to protect your or another natural person's vital interests (rare for the Platform; relevant only in narrow security or emergency scenarios).
5. Public interest task (GDPR Art 6(1)(e)) — we do not generally rely on this basis.
6. Legitimate interests (GDPR Art 6(1)(f)) — where Processing is necessary for our legitimate interests or those of a third party, except where overridden by your interests or fundamental rights. We carry out a legitimate-interests assessment before relying on this basis. You may object to Processing on this basis (clause 13).

Under the CCPA/CPRA and other US state privacy laws (Schedule C), the framework is different: we provide notice at collection and respect opt-out rights for sale, sharing, and use of Sensitive Personal Information. Under the DPDPA (Schedule B), Processing is permitted on the basis of consent or for certain "legitimate uses" listed in the Act.

7. AI Training Carve-Out

This clause cross-references and reinforces Terms clause 5.5.

7.1 We will not use your User Content (Vault Content) to train any artificial-intelligence model that is publicly distributed or made available to other users.

7.2 The only exceptions are:

1. You have given express, separate, opt-in consent to use specified User Content for a specified training purpose.
2. The User Content has been irreversibly anonymised within the meaning of Article 4(1) and Recital 26 of the GDPR (and not merely pseudonymised or aggregated) such that you cannot reasonably be re-identified by any means likely to be used by us or by any other person, and the resulting model and outputs do not allow re-identification.
3. Use is required for security, abuse-prevention, or compliance purposes (for example, training a malware-detection classifier on hashes or signatures, or anti-fraud signal detection on aggregated metadata).

7.3 Internal operational metrics about the Platform (latency, error rates, feature adoption, infrastructure load) are not subject to this restriction. Aggregate analytics that do not identify you are not subject to this restriction.

7.4 Feedback (Terms clause 7.1) is treated separately and is governed by Terms clause 7. We may use Feedback to improve the Platform — including by training internal models — subject to Terms clause 7.13 (good-faith use; not sold or licensed as a product on its own; treated under this Privacy Policy where it contains personal data). Where Feedback contains personal data and we propose to use it for training internal AI models, we will conduct and publish a DPIA in accordance with Terms clause 7.13(e) and clause 7.5 of this Policy.

7.5 DPIA summaries. Where we conduct an AI-training campaign in reliance on clause 7.2(a) (express opt-in consent) or where Feedback containing personal data is to be used for AI-model training in reliance on Terms clause 7.13(e), we will publish a Data Protection Impact Assessment summary in this Policy (or at a URL referenced from this Policy) before the campaign begins, identifying: (a) the purpose of the training; (b) the categories of Personal Information processed; (c) the lawful basis (in addition to consent where applicable) and the legitimate-interests assessment where relevant; (d) the technical and organisational measures applied (including any anonymisation, pseudonymisation, or differential-privacy techniques); (e) the retention period for training data; (f) data-subject rights and how to withdraw consent; and (g) the residual risk assessment and mitigations. Current DPIA summaries are listed at https://vault.episapvault.com/legal/dpia (the page returns "no active DPIAs" until the first AI-training campaign is announced). This clause implements Terms clause 5.5(a) and Terms clause 7.13(e).

8. Sharing and Disclosure

We disclose Personal Information only in the limited circumstances described below.

8.1 Service providers / sub-processors. We use sub-processors to deliver the Platform (cloud hosting, email delivery, identity verification, payment processing when launched, analytics, security monitoring, customer support tooling, and similar). Sub-processors act on our documented instructions, are bound by written contracts that meet the standards required by the applicable privacy law (including GDPR Art 28 standard contractual clauses where relevant), and are listed at https://vault.episapvault.com/legal/sub-processors (Annex 1). We give reasonable advance notice of changes to the sub-processor list before adding a new sub-processor that materially affects Personal Information.

8.2 Successors and corporate transactions. If Episapient is involved in a merger, acquisition, financing, restructure, insolvency, or sale of substantially all our assets (Terms clause 25.1), Personal Information may be disclosed to the prospective or actual counterparty under appropriate confidentiality and use restrictions. Per Terms clause 25.1, we will use reasonable endeavours to ensure the assignee is bound by terms substantially equivalent to these in respect of your User Content, Feedback, and Personal Information, and we will give you written notice.

8.3 Legal-process disclosures. We may disclose Personal Information if we reasonably believe in good faith that disclosure is required by law, court order, subpoena, search warrant, or other lawful process; necessary to comply with sanctions, export-control, or anti-money-laundering law; or necessary to protect Episapient's rights or the rights, safety, or property of any user or the public. Where lawfully permitted, we will give you advance notice of compelled disclosure so you can seek a protective order.

8.4 Research collaborators (CollabHub). If you use CollabHub, you may share Personal Information and Vault-related metadata with other CollabHub users you choose to collaborate with. We are not responsible for what those collaborators do with information you share with them through that feature; you act as the Controller for that sharing.

8.5 Vault Content embedding third-party Personal Information. If your Vault Content contains Personal Information about other people, you are responsible (as Controller / Data Fiduciary / Business) for having a lawful basis to upload that information and for honouring any rights those people may exercise against you. We act as your Processor / Data Processor for that information and process it only to host, secure, and provide the Platform to you.

8.6 No sale or rent. We do not, and will not, sell or rent your Personal Information for monetary consideration. Schedule C describes the position under the broader CCPA/CPRA definition of "sale" and "sharing" (which can include certain cross-context behavioural advertising); we currently do not engage in any sale or sharing as defined by CCPA/CPRA, and if that ever changes we will provide a "Do Not Sell or Share My Personal Information" mechanism (Schedule C.4).

9. Cross-Border Transfers

9.1 Where data is hosted. Personal Information and Vault Content are primarily stored and processed in AWS region ap-southeast-2 (Sydney, Australia), including AWS RDS PostgreSQL (primary database), AWS ECS Fargate (application runtime), AWS Secrets Manager, AWS CloudWatch Logs, and AWS ECR. Edge / DNS / TLS termination is performed by Cloudflare on its global Anycast edge network. Other sub-processor locations are listed at https://vault.episapvault.com/legal/sub-processors (Annex 1). Episapient is established in Queensland, Australia, and our staff and contractors who access Personal Information do so primarily from Australia, with the possibility of access from other locations where they are travelling or otherwise lawfully permitted to process Personal Information consistent with this Policy.

9.2 Transfer mechanisms. Where we transfer Personal Information from a jurisdiction whose law restricts cross-border transfer (including the EU/EEA, the UK, India, and others), we rely on one or more of the following mechanisms (depending on the jurisdiction):

1. an adequacy decision (or equivalent recognition) by the originating jurisdiction's data-protection authority;
2. Standard Contractual Clauses approved by the European Commission (or the UK International Data Transfer Agreement / Addendum), supplemented where necessary by additional technical and organisational measures consistent with the Schrems II jurisprudence;
3. Binding Corporate Rules (where adopted in future);
4. your explicit consent to the transfer, given after being informed of the possible risks (Art 49(1)(a) GDPR);
5. necessity for the performance of a contract between you and us (Art 49(1)(b) GDPR);
6. a derogation that is established for the establishment, exercise, or defence of legal claims (Art 49(1)(e) GDPR); or
7. the equivalent mechanism available under the originating jurisdiction's law.

9.3 India. Cross-border transfers from India are governed by section 16 of the DPDPA and any restriction the Central Government notifies. Schedule B.4 elaborates.

9.4 China. The Platform is not currently offered in mainland China. Before any China launch, a separate schedule will be drafted to address the Personal Information Protection Law 2021 (PIPL) and related data-localisation and outbound-transfer requirements (see Terms Schedule D.5).

10. Retention

10.1 General principle. We retain Personal Information for as long as necessary to fulfil the purposes set out in clause 5, comply with our legal obligations, resolve disputes, and enforce our agreements.

10.2 Account data. We retain account data for the duration of your account and for at least 30 days after termination (consistent with the export window in Terms clause 17.4), and up to a maximum of 7 years after termination unless a longer period is required by law.

10.3 Vault Content. Vault Content is retained for the duration of your account, plus the 30-day export window in Terms clause 17.4, after which we may delete it in accordance with Terms clause 17.4 and clause 10.5 of this Policy.

10.4 Evidentiary / blockchain anchoring records. Hashes, anchoring transaction references, and agreement-gate evidence are retained for not less than 10 years from the date of anchoring (Terms clause 11.2) and may persist on public blockchains for the chain's lifetime, outside our control.

10.5 Category-specific retention table. The following retention periods apply by default. Where a longer or shorter period is required by law, the legal period overrides.

10.6 Anonymisation. We may retain irreversibly anonymised data indefinitely for analytics and Platform improvement; such data is no longer Personal Information.

11. Security

11.1 We implement reasonable technical and organisational measures intended to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are intended to comply with GDPR Art 32, the Australian Privacy Principles (APP 11), DPDPA s 8(5) (reasonable security safeguards), the security requirements of the CCPA/CPRA, and equivalent obligations under other laws.

11.2 Without limiting the generality of clause 11.1, our measures include:

1. encryption in transit (TLS) and encryption at rest. Vault Content is encrypted using one or more cryptographic primitives selected from those described in our published security documentation (which may include post-quantum primitives where so described). References here and in our marketing to "quantum", "post-quantum", or "quantum-resistant" describe design objectives and the primitives in use at the relevant time, not warranties of any particular cryptographic property (Terms clause 14.4);
2. role-based access controls and the principle of least privilege for staff and contractors;
3. multi-factor authentication for administrative access;
4. logging and monitoring of access to Personal Information;
5. secure software-development practices, including code review and vulnerability management;
6. network segmentation and intrusion detection;
7. regular backups and tested recovery procedures;
8. vendor risk assessment for sub-processors;
9. staff privacy and security training; and
10. an incident-response plan covering detection, containment, eradication, recovery, notification, and post-incident review.

11.3 No security measure is infallible. Consistent with Terms clause 14.1, we do not warrant that the Platform is free of vulnerabilities or that Personal Information will never be subject to unauthorised access. You should keep independent backups of materially important records during the beta period (Terms clause 14.2).

12. Breach Notification

12.1 Notification to you. If we become aware of an actual or reasonably-suspected unauthorised access to or disclosure of your Personal Information or Vault Content, we will notify you within 72 hours of becoming aware (Terms clause 10), except where a shorter or longer period is required by law in your jurisdiction.

12.2 Notification to regulators. Where required by law, we will notify the relevant regulator within the applicable statutory period:

1. Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme (Privacy Act 1988 (Cth) Part IIIC) — "as soon as practicable" after we are reasonably satisfied that the breach is an "eligible data breach";
2. EU/EEA supervisory authorities under GDPR Art 33 — within 72 hours of becoming aware of a personal-data breach, where feasible, except where the breach is unlikely to result in a risk to data subjects' rights and freedoms;
3. UK Information Commissioner's Office under the UK GDPR — same 72-hour standard as GDPR;
4. India CERT-In under the CERT-In Directions, 2022 — within 6 hours of becoming aware of an applicable cyber-incident (Terms Schedule B.11);
5. India Data Protection Board under the DPDPA — as required by the Act and any rules made under it;
6. California Attorney General and affected residents under Cal. Civ. Code § 1798.82 — "in the most expedient time possible and without unreasonable delay";
7. other US-state Attorneys General as required by the relevant state law (Schedule C.4(e)); and
8. any other regulator with jurisdiction.

12.3 Notification content. Notifications will include (to the extent then known) the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures we have taken or propose to take, and a contact point for further information.

13. Your Privacy Rights (Generic Statement)

Subject to the regional Schedule applicable to you, and to the conditions and exceptions provided in your local privacy law, you have the following rights in respect of Personal Information about you that we hold:

1. Right of access — to confirm whether we are processing your Personal Information and to obtain a copy.
2. Right of correction / rectification — to have inaccurate or incomplete Personal Information corrected.
3. Right of erasure / deletion ("right to be forgotten") — to have Personal Information erased in defined circumstances, subject to exceptions for legal claims, freedom of expression, and our retention obligations.
4. Right of portability — to receive Personal Information you have provided in a structured, commonly-used, machine-readable format and (where technically feasible) have it transmitted to another controller.
5. Right of objection — to object to Processing based on legitimate interests, and to object to direct marketing at any time.
6. Right of restriction — to have Processing restricted in defined circumstances (for example, while a correction request is being assessed).
7. Right not to be subject to solely automated decision-making — including profiling, that produces legal or similarly significant effects, except where permitted by law and subject to safeguards. We do not currently make solely automated decisions of that kind.
8. Right to withdraw consent — where Processing is based on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of Processing already carried out.
9. Right to lodge a complaint — with us first (clause 18) and with the relevant regulator (Schedule A–D as applicable).
10. Right of nomination — for users in India, the right under the DPDPA to nominate a person to exercise rights in the event of death or incapacity (Schedule B.7).
11. Right of grievance redressal — for users in India, the right under DPDPA s 13 to a readily-available grievance-redressal mechanism (Schedule B.8).

13.1 How to exercise. Send a request to privacy@episapvault.com identifying the right you wish to exercise and providing enough information for us to verify your identity and the relevant Personal Information. We respond within statutory time limits and at no charge for reasonable requests; abusive, manifestly unfounded, or excessive requests may attract a fee or be refused, with reasons.

13.2 Authorised agent. Where the law allows, you may use an authorised agent (such as the agent mechanism under CCPA § 1798.135) to exercise rights on your behalf. We may verify the agent's authorisation.

13.3 Vault Content holding third-party data. Where Personal Information is embedded in Vault Content you have uploaded and the request is from a third party (clause 8.5), we will refer the request to you, the Controller, and assist you to respond as your Processor.

14. Children

14.1 The Platform is not directed to or designed for use by individuals under 18, and we do not knowingly collect Personal Information from individuals under 18 in connection with their direct use of the Platform. By accepting the Terms, you confirm that you are at least 18 (Terms clause 2.1(a)).

14.2 For users in the United States, we do not knowingly collect Personal Information from children under 13 in violation of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506). If we learn that we have collected such Personal Information, we will delete it promptly. See Schedule C.5.

14.3 If you become aware that a child has provided Personal Information to us, contact privacy@episapvault.com and we will take reasonable steps to investigate and delete that information.

15. Cookies and Similar Tracking Technologies

15.1 We use cookies, local storage, session storage, and similar technologies (collectively, "cookies") for the categories below. The full list is in Annex 2.

1. Strictly necessary cookies — required to provide the Platform (authentication, session management, security). These cannot be turned off without disabling the Platform.
2. Functional cookies — remember your preferences (language, theme, view settings).
3. Analytics cookies — help us understand how the Platform is used and improve it. Set with your consent in jurisdictions where consent is required.
4. Advertising cookies — we do not currently set advertising cookies. If that ever changes, we will update this Policy and seek consent where required.

15.2 EU/UK consent banner. For users in the EU/EEA and UK, we present a consent banner consistent with the ePrivacy Directive (Directive 2002/58/EC) and the relevant implementing law. The banner displays the categories of cookies we use, identifies which categories require your consent, and allows you to make a choice before any non-essential cookie is set. The Platform sets only essential, security, and consent-recording cookies by default; non-essential cookies (analytics, preferences) are not set unless and until you opt in. You can withdraw consent at any time via the cookie-preferences link in the footer, and we treat withdrawal as having the same effect as initial refusal. (Pilot phase note: where granular per-category UI is not yet available, we present consent on an essential-only basis — that is, we collect no consent for non-essential cookies because we do not set any — rather than ship a non-functional ‘Reject all’ button.)

15.3 Do Not Track / Global Privacy Control. We honour the Global Privacy Control (GPC) browser signal as an opt-out of "sale" or "sharing" for Users to whom the CCPA/CPRA applies (Schedule C.4(b)). We treat a valid GPC signal as a deemed opt-out without requiring further action by the User.

16. Marketing Communications

16.1 Service messages (account, security, billing, material changes to the Terms or Policy) are sent on the basis of contract performance and legal obligation; you cannot opt out of these while you maintain an active account.

16.2 Marketing messages are sent only on an opt-in basis. Each marketing email contains a one-click unsubscribe mechanism. Compliance specifics:

1. Australia — Spam Act 2003 (Cth): consent (express or inferred), accurate sender information, functional unsubscribe (Schedule A.5).
2. United States — CAN-SPAM Act (15 U.S.C. §§ 7701–7713): accurate header information, clear identification as advertising where applicable, valid postal address, opt-out honoured within 10 business days.
3. Canada — CASL (Canada's Anti-Spam Legislation, S.C. 2010, c. 23): express or implied consent, sender identification, unsubscribe.
4. EU/EEA — ePrivacy Directive and national implementations: prior consent (with limited soft-opt-in for similar products to existing customers).
5. India — Telecom Commercial Communications Customer Preference Regulations and DPDPA consent rules (Schedule B).

17. Changes to this Policy

17.1 We may amend this Policy from time to time. For material changes that adversely affect your rights or that change the categories of Personal Information collected, the purposes of Processing, the categories of recipients, or the retention periods, we will give you not less than 30 days' written notice (consistent with Terms clause 18 and clause 21).

17.2 Notice will be by email to your account address and by an in-Platform notification (Terms clause 21.2). The current version, effective date, and version history are recorded in Annex 3.

17.3 Continued use of the Platform after the change takes effect constitutes acceptance of the amended Policy. If you do not accept a material amendment, you may terminate your account before the amendment takes effect (Terms clause 18) and exercise your data-export and deletion rights (Terms clause 17.4 and clause 13 of this Policy).

18. Contact and Complaints

18.1 Privacy Officer. Privacy questions, rights requests, and complaints should be sent to:

EPISAPIENT PTY LTD — Privacy Officer
Email: privacy@episapvault.com
Postal: 48 Castle Hill Drive, Murrumba Downs QLD 4503, Australia

18.2 How we handle complaints. We will acknowledge your complaint within 7 business days, investigate it, and respond substantively within 30 days (or such shorter period as required by law in your jurisdiction). If we cannot respond within 30 days, we will tell you why and give an expected response date.

18.3 Regulators. If you are not satisfied with our response, you may complain to the regulator in your jurisdiction. The relevant Schedule lists the contact points:

• Australia — Office of the Australian Information Commissioner (OAIC) (Schedule A);
• India — Data Protection Board of India (Schedule B);
• United States — California Privacy Protection Agency (CPPA), the California Attorney General, and the State Attorney General of your home state (Schedule C);
• EU/EEA — the lead supervisory authority or your local data-protection authority;
• UK — Information Commissioner's Office (ICO);
• Canada — Office of the Privacy Commissioner of Canada (federal) and the relevant provincial commissioner;
• elsewhere — the data-protection authority for your country (Schedule D).

18.4 EU/UK Article 27 representative. As of the date at the head of this Policy, EpiSAP is in private beta and does not actively market to or accept users from the EEA or the UK. Where and from the date we designate territories within the EEA or the UK as supported, we will designate (a) an EU representative under GDPR Art 27 and (b) a UK representative under UK GDPR Art 27, and publish their contact details in Schedule D and at https://vault.episapvault.com/legal/eu-rep and /legal/uk-rep respectively, before the first User from that territory is on-boarded.

19. Governing Law

19.1 Default. Subject to non-derogable local privacy law and to the applicable Schedule, this Policy is governed by the laws of Queensland, Australia (consistent with Terms clause 19).

19.2 Non-derogable local privacy law prevails. Nothing in this clause limits the application of any non-derogable local privacy law to your Personal Information, and the order of precedence in Terms clause 23.2 applies.

SCHEDULES — Region-Specific Privacy Provisions

ANNEXES

Annex 1 — Sub-Processors

The list below identifies the sub-processors that Process Personal Information on our behalf as of the date at the head of this Policy. The list is updated at https://vault.episapvault.com/legal/sub-processors when sub-processors are added or removed. We will provide reasonable advance notice (no less than 30 days where practicable) of changes that materially affect Personal Information.

Excluded categories. The Platform does not currently use third-party analytics, third-party identity-verification (KYC), payment processing, third-party customer-support tooling, or third-party advertising / behavioural-tracking sub-processors. If any of those is introduced, this Annex will be updated and Users notified per the change-notification mechanism above.

Annex 1.A — Episapient personnel with production access (added v1.3)

For transparency, the natural persons who hold administrative or infrastructure-level access to the production environment (AWS account 925091290713, ap-southeast-2; the production database; deploy tooling; and incident-response credentials) as of the date at the head of this Policy are:

Both individuals are bound by the confidentiality obligations in the EpiSAP Platform Terms of Use and the agreements between them and Episapient. Access is logged at the AWS CloudTrail level and at the application audit-log level. Where technically feasible, role-based access controls and least-privilege scoping are applied; full administrative access is reserved for the named individuals above and is not granted to any other person without an updated disclosure in this Annex.

The list above is updated when the personnel set changes. Users may request the current list at any time via the Privacy contact in section 2.

Annex 2 — Cookies and Similar Technologies

The Platform uses the minimum-necessary set of cookies and browser-side storage. We do not use third-party advertising, analytics, or behavioural-tracking cookies as of the date at the head of this Policy.

Not in use. The Platform does not currently set Flask-Login remember_me cookies, third-party analytics cookies (e.g. Google Analytics), advertising-network cookies, or social-network embed cookies. The CSRF token is held inside the session cookie rather than a separate cookie. Strictly-necessary cookies are exempt from prior consent under GDPR Recital 32 / ePrivacy Directive Art 5(3) and the equivalent rule under DPDPA / IT Act 2000 / Privacy Act 1988 (Cth). Consent is recorded for the episap_cookie_consent banner action only.

Annex 3 — Version History

The current version of this Policy is recorded at the head of this document. Prior versions are retained by Episapient and made available on request. The hash of the version of the Policy accepted by each User is recorded in that User's UserConsent record at the time of Acceptance.

v1.2 changes (April 2026 — institution pilot): added two new categories to the table at section 3 (Regulatory attestations covering the Indian Patents Act s 39 soft-gate and the ICMR / health-data soft-gate; and Publication-overlap scan inputs and outputs covering the Publication Watch / Pub-Alerts feature). Added four new sub-processor entries to Annex 1 (Crossref, NCBI E-utilities, OpenAlex, and arXiv) covering the public-record APIs queried by Pub-Alerts. The full attribution and licensing basis for each of those sources is set out in the published Data Sources & Attribution Policy v1.0. No deletion or weakening of prior commitments; v1.2 is purely additive disclosure.

v1.3 changes (April 2026 — personnel access transparency): added Annex 1.A disclosing the named natural persons at Episapient who hold administrative or infrastructure-level access to the production environment. This is in response to procurement-counsel requests typical for institutional pilots and to align with DPDPA s 5 / s 6 transparency expectations. Also added a security-fix bundle (v19_57.3 deploy) that closed five data-egress paths surfaced in our internal audit. v1.3 is purely additive disclosure; no deletion or weakening of prior commitments.

Annex 4 — Hash Registry

Auto-populated by the agreement gate at deployment. The rendered HTML of this Policy is hashed (SHA-256) and recorded in each UserConsent row at the time of Acceptance, intended to support evidentiary use under section 65B of the Bharatiya Sakshya Adhiniyam 2023, section 10A of the Information Technology Act 2000, the Electronic Transactions Act 1999 (Cth), the Electronic Signatures in Global and National Commerce Act (15 U.S.C. §§ 7001 et seq.), the Uniform Electronic Transactions Act (US state-by-state), and equivalent electronic-records evidence regimes in other jurisdictions. Specific evidentiary use depends on the certificate provided by us at the time of any proceeding, which we will produce on reasonable request (Terms Annex 3).

— End of Privacy Policy v1.3 —