CDMOHUB Privacy Notice

1. Identity of the Data Controller / Business

CDMOHUB Inc., registered in the State of Delaware, United States.

• Registered Address: 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808
• Company Registration Number: SR-797482
• Email: privacy@cdmohub.ai

Under GDPR, CDMOHUB acts as the Data Controller. Under CCPA/CPRA, CDMOHUB acts as a Business.

2. Categories of Personal Information Collected

We collect the following categories of personal information:

• Identifiers: name, business email address, phone number
• Professional information: company name, job title, seniority level
• Account credentials
• Communications and correspondence
• Technical usage data: IP address, browser type, device identifiers, pages visited, timestamps

3. Purposes of Processing

We process personal information for the following purposes:

• To provide and maintain the Services
• To enable professional networking and matchmaking functionality
• To provide customer support
• To improve performance and user experience
• To ensure security and prevent fraud
• To comply with legal obligations

We do not sell personal information.

4. Legal Basis for Processing (GDPR/UK GDPR)

Processing is based on:

• Contractual necessity — to perform our obligations under our terms of service
• Legitimate interests — to improve our Services and ensure security
• Consent — where required by applicable law
• Compliance with legal obligations

5. Data Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Notice or as required by law. Inactive accounts may be deleted after a defined retention period.

6. Disclosure of Personal Information

We may disclose personal information to service providers under contractual safeguards, including:

• Cloud hosting and IT infrastructure providers
• Analytics providers
• Email platforms
• Payment processors
• AI/ML processing services — used to extract professional details from uploaded LinkedIn profiles (see Section 9)
• Authentication and identity providers
• File storage and content delivery networks

A current list of our data subprocessors is available upon request by contacting privacy@cdmohub.ai.

7. International Data Transfers

When transferring personal data outside the EEA or UK, we implement appropriate safeguards such as Standard Contractual Clauses or UK International Data Transfer Agreements.

8. Data Security

We implement administrative, technical, and physical safeguards including:

• Encryption in transit (TLS/SSL)
• Access controls
• Secure hosting environments
• Monitoring mechanisms
• Periodic security reviews

9. Automated Decision-Making and AI Processing

We may use automated systems to enhance matchmaking and improve user experience; such processing does not produce legal or similarly significant effects without human oversight.

LinkedIn Profile Processing: When you upload a LinkedIn PDF during onboarding, the extracted text (including your name, job history, and professional credentials) is sent to an AI service (OpenAI) for automated extraction of structured profile data. This data is processed in the United States. The AI service does not retain your data for model training. You provide consent for this processing at the time of upload.

Matchmaking: Our AI-powered matchmaking system uses the professional data you provide to suggest relevant connections between pharmaceutical buyers and CDMOs. All matchmaking results are presented as suggestions and do not produce binding decisions.

10. Data Subject Rights (EEA/UK)

You have the right to:

• Access your personal data
• Rectify inaccurate personal data
• Request erasure of your personal data
• Restrict processing of your personal data
• Object to processing of your personal data
• Request portability of your personal data

11. U.S. State Privacy Rights (Including California)

California residents may request:

• Access to their personal information
• Deletion of their personal information
• Correction of inaccurate personal information
• Opt-out of sale or sharing of personal information

CDMOHUB does not sell personal information.

12. Data Breach Notification

In the event of a personal data breach, we will notify affected individuals and authorities as required by applicable law.

13. Children's Data

The Services are intended for professionals aged 18 or older. We do not knowingly collect data from minors.

14. Changes to This Privacy Notice

We may update this Notice periodically. Material changes will be communicated appropriately.

15. Contact Information

For privacy-related inquiries:

• Email: privacy@cdmohub.ai