Company Privacy Notice

Effective date: July 26, 2026

This Notice explains how ClinX Academy LLC ("ClinX," "we," "us," or "our") handles personal information about representatives of companies, MSOs, and other organizations that use Connect and related ClinX services (the "Service"). It also explains your choices and privacy rights.

This Notice is for United States users who are at least 18 years old. The Service is not intended for patients, minors, or people outside the United States.

1. Information we collect

Depending on how you use Connect, we collect the following categories.

Account and contact information: name, business email, phone number, title, employer or organization, login identifiers, account role, communication preferences, and authentication records.

Company and opportunity information: company name, legal name, website, domains and aliases, address, business and care-delivery model, services, insurance-billing information, operating details, contacts, opportunity descriptions, role requirements, target states, compensation information Company chooses to provide, candidate requests, messages, deal stages, status notes, and contract-finalization facts.

Candidate interaction information: clinicians viewed or recommended, invitations, interests, interview and contracting stages, communications, and decisions recorded in Connect. Company does not receive clinician-private compliance logs, billing information, or unrelated relationship records.

Device, use, and security information: IP address, browser and device information, timestamps, pages or features used, authentication events, application logs, security events, and records showing which legal version Company agreed to or acknowledged.

Support and communications: messages to ClinX, responses to surveys, privacy requests, and other communications.

Inferences and recommendations: organizational or matching suggestions based on Company criteria and clinician professional information. These are aids, not final decisions.

We do not need patient records, PHI, Social Security numbers, government identification, biometric templates, precise geolocation, or consumer health data from Company users to provide the current Service. Do not submit them.

2. Where information comes from

We collect information:

• directly from Company users and their authorized representatives;
• from clinicians when they communicate or update a shared deal;
• from ClinX administrators who create, review, edit, or support company profiles and opportunities;
• from service providers that support authentication, communications, hosting, and security; and
• from public business sources when reasonably needed to verify or complete Company information.

3. Why we use information

We use personal information to:

• create, authenticate, secure, and support accounts;
• build Company profiles and process opportunities;
• recommend clinicians and support invitations, messaging, and deal-status tracking;
• keep independent status histories for each clinician-deal;
• operate role-based privacy controls and prevent one company or candidate from seeing another's private information;
• send transactional communications;
• prevent fraud, misuse, security incidents, and unlawful activity;
• debug, measure, maintain, and improve the Service;
• comply with law, enforce agreements, and establish or defend legal claims; and
• create deidentified or aggregate analytics that are not reasonably linkable to a person or Company.

We do not use identifiable Company content or communications to train general-purpose AI models. Our vendors may process information only to provide contracted services to us, subject to their service terms and our instructions.

4. Matching and automated tools

Connect may organize opportunity criteria and suggest potentially relevant clinicians. Automated results can be incomplete, biased, or wrong. ClinX does not use AI as the final decision-maker for employment, contracting, professional eligibility, licensure, tier, or fees.

Company must have a qualified person review information and make final decisions. Company should not infer protected traits or use a recommendation as the sole basis for a legally significant decision.

5. How we disclose information

Clinicians: A clinician may see Company profile and opportunity information needed to evaluate a role, messages directed to that clinician, and the status history of that clinician's deal. A clinician does not see other candidates' private activity.

Service providers: We use providers for cloud hosting and database services, authentication, payment infrastructure used for clinician billing, email delivery and ingestion, sensitive-data scanning, AI-assisted processing, SMS delivery, security, and technical support. Current core providers include Supabase, Vercel, Stripe, Google Workspace and Google Cloud, OpenAI, Resend, and Twilio. They process information for us under contracts or service terms and may not use it for their own behavioral advertising.

Professional advisers and authorities: We may disclose information to lawyers, accountants, insurers, auditors, regulators, law enforcement, courts, or other authorities when reasonably necessary and lawful.

Business transfers: We may disclose information in a financing, merger, acquisition, reorganization, bankruptcy, or sale, subject to appropriate confidentiality and notice where required.

With Company's direction: We disclose information when an authorized user asks us to or intentionally uses a feature that sends it to another person.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use third-party advertising trackers in Connect.

6. What Company users cannot see

Company users cannot see a clinician's Connect subscription, coupon, ClinX fee quote, ClinX invoice, payment status, private compliance logs, pre-existing relationship records, or unrelated opportunities. Company users also cannot see other companies' information or private activity involving other candidates.

ClinX applies role-based controls designed to maintain these boundaries. Contact info@clinxacademy.com immediately if you believe you received information you should not have.

7. Cookies, browser signals, and Global Privacy Control

Connect uses only cookies and similar storage reasonably needed for authentication, security, session continuity, and core preferences. We do not use them for cross-site behavioral advertising.

Because we do not track users across unrelated services for advertising, browser Do Not Track signals do not change how Connect operates. We honor Global Privacy Control where it applies. Under our current practices, a GPC signal does not trigger an additional opt-out because we do not sell or share personal information for behavioral advertising.

8. Retention

We keep information only as long as reasonably needed for the Service, security, legal obligations, disputes, and the purposes described above. Our normal schedule is:

• active account, contact, company-profile, and ordinary opportunity information: while the account or Company relationship is active, then normally deleted or deidentified within 90 days after a verified deletion request or closure, unless the information remains needed for another user's active deal;
• legal acceptance, material deal, contract-finalization, and business records: generally 7 years;
• security and access logs: generally 24 months; and
• backups: up to 90 days before routine rotation.

We may keep information longer when required by law, needed to protect users, investigate abuse, preserve a legal claim, or maintain a material deal record. A documented legal hold pauses normal deletion for the covered record.

9. Security

We use administrative, technical, and physical safeguards designed for the nature of the information, including access controls, role boundaries, private storage, encrypted connections, audit records, and vendor controls. No service can guarantee perfect security. Keep login credentials secure and contact us promptly if you suspect misuse.

10. Your choices and rights

Authorized users may update many Company and opportunity fields in Connect, unsubscribe from marketing email, and ask ClinX to correct or close an account.

Depending on your state, the context in which you use Connect, and how its law applies, you may have rights to:

• confirm whether we process your personal information;
• access or obtain a portable copy;
• correct inaccurate information;
• delete information, subject to exceptions;
• opt out of a sale, targeted advertising, or certain profiling;
• limit certain uses of sensitive information;
• withdraw consent where processing depends on consent;
• appeal a denied privacy request; and
• receive equal service without unlawful discrimination for exercising a right.

To make a request or appeal, email info@clinxacademy.com. State your name, account email, state of residence, Company, the right you want to exercise, and whether the message is an appeal. We may ask for information reasonably needed to verify identity and authority.

Some state consumer privacy laws do not cover information processed solely in a business-to-business or employment context. If a particular law does not apply, we may still honor a reasonable request at our discretion. We may need to preserve legal acceptances, security records, and material deal facts.

Maryland residents acting in an individual or household context may have rights to access, correct, delete, obtain a copy, and opt out of sale, targeted advertising, or certain profiling under the Maryland Online Data Privacy Act, when it applies. They may appeal a denial by replying to our decision or emailing info@clinxacademy.com with "Privacy appeal" in the subject.

California residents may request the categories and specific pieces of personal information collected, sources, purposes, categories of recipients, correction, deletion, and portability, subject to legal exceptions. They may also opt out of sale or sharing and limit certain sensitive-information uses where applicable. ClinX does not currently sell or share personal information for cross-context behavioral advertising and does not use sensitive information to infer characteristics. We will not unlawfully discriminate for exercising a California privacy right.

For California's required look-back disclosure, the categories we may have collected are identifiers; professional or employment information; commercial and business-transaction information; internet or network activity; communications content intentionally sent to us; and inferences described above. We collect and disclose those categories for the business purposes in Sections 3 and 5. We have not sold or shared those categories for cross-context behavioral advertising.

11. Email choices

You may unsubscribe from marketing email using the link in the message or by emailing us. We may still send account, security, opportunity, deal, legal, and support messages needed to provide the Service.

12. Patient information and HIPAA

Connect is for professional business activity, not patient care. Do not submit PHI, patient communications, medical records, or clinical images. ClinX does not offer this version of Connect as a HIPAA business associate and does not enter business associate agreements for it.

If we detect information that appears to be PHI or other prohibited sensitive content, we may redact, quarantine, restrict, or delete it and may contact Company. Tell us promptly at info@clinxacademy.com if you believe prohibited information was submitted.

13. Children and users outside the United States

The Service is not for anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor provided information, contact us so we can investigate and delete it.

The Service is offered only in the United States. Do not use it from another country or submit information about people outside the United States unless ClinX has expressly approved that use in writing.

14. Changes to this Notice

We may update this Notice as the Service or law changes. We will post the new effective date and provide additional notice for material changes. If a change requires consent, we will ask for it separately. We record the version Company acknowledged.

15. Contact us

For privacy questions, requests, appeals, or complaints:

ClinX Academy LLC

10811 Barn Wood Lane

Potomac, MD 20854

info@clinxacademy.com