Privacy Policy

Effective Date: [Effective Date]
Last Updated: [Last Updated Date]
Version: [Version Number] · [Link to prior versions]

Draft notice. This document is provided for informational purposes and as a high-quality starting draft. It does not constitute legal advice. Axiogen's actual policies and agreements must be reviewed, customized, and approved by qualified legal counsel licensed in the relevant jurisdictions before publication or use.

1. Who we are and what this Policy covers

Axiogen AI Inc. ("Axiogen AI," "Axiogen," "we," "us," or "our"), operates the website at axiogen.ai (the "Site") and the Axiogen platform — an AI-powered intelligence and commercial operating platform for pharmaceutical and medical-device companies in medical aesthetics, including the web application, the Axiogen API, and related services (together, the "Platform," and with the Site, the "Services").

This Privacy Policy explains how we collect, use, share, and protect personal information, and the choices and rights available to you. It applies to the following groups of people:

What this Policy does not cover. When a Customer uploads its own data into the Platform (for example, its CRM records, sales data, or field notes — "Customer Content"), Axiogen processes that data as a processor (or service provider) on the Customer's instructions. The Customer's own privacy notice governs that data, and our obligations are set out in our Data Processing Addendum and, where applicable, a Business Associate Agreement. If you have questions about Customer Content, please contact the Customer directly; we will help route your request where we can.

This Policy should be read together with our Terms of Service, Data Processing Addendum, HIPAA & Business Associate Information, Security & Trust Overview, and Contact pages.

2. The short version

• We are a business-to-business company. Our customers are pharmaceutical and medical-device manufacturers and their commercial, medical-affairs, insights, and legal teams. We do not market to consumers or patients.
• The core Axiogen dataset is professional information about aesthetics practices and practitioners, assembled from public sources, commercially licensed sources, and our own analysis. It is not a patient record system and is not designed to hold Protected Health Information.
• We track where every data point came from. Provenance is recorded for the information in the Platform so that we — and our Customers — can answer the question "where did this come from?"
• We do not sell or share the personal information of Site Visitors or Customer Users, and we do not use personal information for cross-context behavioral advertising.
• Professionals have choices. If you are a healthcare professional whose information appears in the Platform, you can ask us what we hold, correct it, or ask us to suppress it. See Section 8.4.
• We never train models on one Customer's data for another Customer's benefit. See Section 5 and our Security & Trust Overview.

3. Information we collect

3.1 Site Visitors

3.2 Customer Users

Audit data is retained in an immutable audit log so that Customers can meet their own compliance obligations, including medical-legal-regulatory (MLR) review of promotional activity.

3.3 Professionals — professional and practice information

This is the information at the heart of the Platform. It concerns people in their professional capacity — as licensed clinicians, aesthetic injectors, practice owners, practice managers, and staff of medical-aesthetics practices — and the businesses they work in.

Categories of Professional Data we collect

Where Professional Data comes from

• Public professional registries and government sources — the NPI Registry, state licensing boards, U.S. federal transparency datasets (such as CMS Open Payments), the U.S. Food and Drug Administration, the U.S. Patent and Trademark Office, and comparable public records.
• Publicly available online sources — practice websites, business directories and listings, public social-media profiles and posts, and public review platforms.
• Commercially licensed data providers — third-party data vendors from whom we license professional, business, and firmographic data under contracts that require lawful collection. [Link to current list of data-source categories, if published.]
• Our own analysis — derived attributes created by Axiogen's models and analysts from the sources above.
• Customers, where their contract permits — [CONFIRM WITH PRODUCT: whether any Customer-contributed corrections or confirmations (e.g., a verified address) are incorporated into the shared Axiogen dataset, and under what contractual terms. If not, delete this bullet.]

Every record carries provenance metadata identifying its source and the date it was collected or last refreshed.

What we do not intentionally collect about Professionals

• Patient information or Protected Health Information (PHI) of any patient.
• Health information about the Professional (for example, their own medical conditions), or other special categories of personal data such as racial or ethnic origin, religious beliefs, sexual orientation, or political opinions.
• Government-issued identification numbers other than professional license and provider identifiers.
• Personal financial account information, or precise, real-time geolocation of an individual (practice addresses are business addresses).

Where publicly available content incidentally contains such information (for example, a public post that mentions a patient), we do not extract, index, or profile it. [CONFIRM WITH ENGINEERING: describe the specific minimization controls applied to social and review ingestion, or keep this sentence at the current level of generality.]

3.4 Business Contacts

Name, work contact details, employer, role, and the content of our correspondence, collected from you directly, from your employer, from publicly available professional sources (such as LinkedIn or company websites), or from licensed B2B data providers. If you apply for a role with us, we collect the information in your application; [link to Candidate Privacy Notice, if separate].

3.5 Information collected automatically

See Section 7 (Cookies and similar technologies) for details of the technologies we use on the Site and in the Platform.

4. How we use information and our legal bases

Where the EU or UK General Data Protection Regulation ("GDPR") applies, we must have a legal basis for each purpose. The table below lists our purposes and the corresponding bases. Where the GDPR does not apply, we use information for the purposes listed.

Our legitimate interests in processing Professional Data. Axiogen and its Customers have a legitimate interest in understanding the professional landscape of medical aesthetics — who practices where, what credentials they hold, what products and procedures they offer, and how practices and practitioners relate to one another — in order to plan territories, direct scientific and commercial engagement appropriately, validate credentials, and meet transparency and compliance obligations. We have assessed this interest against Professionals' rights and interests. In our assessment, (i) the information concerns people in their public, professional role rather than their private life; (ii) it is drawn from sources the Professional has made public or that are public by law; (iii) the processing is of a kind Professionals in a regulated, manufacturer-facing specialty can reasonably expect; and (iv) we apply safeguards including provenance tracking, access controls, contractual use restrictions on Customers, and the rights described in Section 8. [Link to Legitimate Interests Assessment summary, if published.]

5. Profiling, scoring, and AI

The Platform generates derived attributes about practices and Professionals — such as segment classifications, estimated product affinity, influence tiers, and next-best-action recommendations. These outputs are decision-support tools for Customers' trained commercial and medical personnel. They do not produce legal effects concerning a Professional and are not intended to produce similarly significant effects. Specifically:

• Axiogen does not make, and the Platform is not designed to support, decisions about a Professional's eligibility for employment, credit, insurance, housing, licensure, or clinical privileges. Axiogen is not a consumer reporting agency, and our data may not be used for any purpose regulated by the U.S. Fair Credit Reporting Act. Our Terms of Service prohibit such uses.
• Customers remain responsible for how they act on Platform outputs, including compliance with laws and industry codes governing interactions with healthcare professionals.
• We do not use one Customer's Customer Content to train or fine-tune models that serve any other Customer. Models that power shared features are developed using Axiogen's own dataset, public data, licensed data, and synthetic or aggregated data. [CONFIRM WITH ENGINEERING and align with /security.]
• Where we use third-party AI model providers, they are engaged as sub-processors under terms that prohibit them from using our inputs or outputs to train their models. [Link to current Sub-processor List.]

If you believe a derived attribute about you is inaccurate, you can ask us to review and correct it (Section 8.4).

6. How we share information

We do not sell or share the personal information of Site Visitors, Customer Users, or Business Contacts, and we do not disclose any personal information for cross-context behavioral advertising. We share information only as described below.

6.1 With our Customers (Professional Data)

The purpose of the Platform is to make Professional Data and related analytics available to Customers. Customers access Professional Data under license and are independent controllers of their own use of it. Our Terms of Service require every Customer to use Professional Data lawfully, only for its own internal business purposes, in compliance with applicable laws and industry codes governing promotion and interactions with healthcare professionals, and never to resell it, use it to build a competing dataset, or use it for any eligibility determination.

[COUNSEL DECISION — select one before publication.]

Option A (if counsel concludes that licensing Professional Data is a "sale" under the California Consumer Privacy Act or similar laws): "Because we make Professional Data available to Customers for a fee, this may be considered a 'sale' of personal information under the California Consumer Privacy Act and certain other U.S. state privacy laws, even though the information concerns individuals in their professional capacity and is largely drawn from publicly available sources. Professionals may opt out of this disclosure at any time using the process in Section 8.4 or the 'Do Not Sell or Share My Personal Information' link on our Site. [If applicable: Axiogen is registered as a data broker with [the California Privacy Protection Agency / other states] — registration number [●].]"

Option B (if counsel concludes that the publicly-available-information exclusion and/or the nature of the data mean no "sale" occurs): "We do not sell personal information. Professional Data made available to Customers consists of information concerning individuals in their professional capacity that is publicly available or commercially licensed; derived attributes are treated as personal information and are subject to the rights in Section 8."

Counsel should also assess registration obligations under the California Delete Act (including processing of deletion requests through the CPPA's Delete Request and Opt-out Platform, which data brokers are required to begin honoring from August 2026), and the data-broker registration laws of Vermont, Oregon, and Texas.

6.2 With service providers and sub-processors

We use third parties to host infrastructure, store and process data, provide AI model services, send email, provide analytics, support customers, and run our business. They may access personal information only to perform services for us and are bound by contracts that restrict their use of it. Our current sub-processors for Customer Content are listed at [Link to current Sub-processor List].

6.3 With our affiliates

With entities under common control with Axiogen AI Inc., for the purposes described in this Policy. [Delete if none.]

6.4 For legal, safety, and compliance reasons

Where we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request; to enforce our agreements; to protect the rights, property, or safety of Axiogen, our Customers, Professionals, or the public; or to investigate fraud or security issues. Where permitted, we will notify the affected Customer of a request for Customer Content before disclosing it.

6.5 In a business transaction

If Axiogen is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy and to notice where required by law.

6.6 With your direction or consent

For example, when you ask us to share a case study naming you, or to integrate with a third-party tool you have chosen.

6.7 Aggregated and de-identified information

We may create and share aggregated or de-identified information (for example, market-level statistics) that cannot reasonably be used to identify an individual. We maintain and use de-identified data only in de-identified form and contractually prohibit recipients from attempting re-identification.

7. Cookies and similar technologies

We use cookies, pixels, local storage, and similar technologies on the Site and in the Platform for the following purposes:

We honor Global Privacy Control (GPC) signals as a valid opt-out of sale/sharing where required by law. We do not currently respond to browser "Do Not Track" signals because no common standard has been adopted. For the full list of cookies and their lifetimes, see our [Cookie Notice] [CREATE OR DELETE LINK].

8. Your privacy rights

8.1 Rights overview

Depending on where you live, you may have some or all of the following rights. We extend the rights to know/access, correct, delete, and opt out of marketing to everyone regardless of location, and the remaining rights as required by applicable law.

* Including, as of the Last Updated date, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. [Counsel to confirm list and effective dates.] Some of these laws exempt data processed in a business-to-business or employment context, or publicly available information; we will tell you if an exemption applies to your request.

8.2 How to exercise your rights

• Email: [Data Protection Officer / Privacy Contact Email] (e.g., privacy@axiogen.ai)
• Web form: [Link to privacy request form]
• Toll-free (California): [Toll-free number, if required based on Axiogen's operations]
• Mail: Axiogen AI Inc., Attn: Privacy, [Registered Address]

We will acknowledge your request promptly and respond within the time required by applicable law (generally within 30 days under the GDPR and 45 days under U.S. state laws, extendable once where permitted, in which case we will tell you why).

Verification. To protect your information, we need to verify that you are the person the request concerns (or that person's authorized agent). For Customer Users, we may verify through the Customer. For Professionals, we may ask you to confirm control of a professional email address, phone number, or social-media account associated with your record, or to provide a copy of a professional license with non-essential information redacted. We will use verification information only for that purpose.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We will ask for proof of the agent's authority (such as a signed permission or power of attorney) and may still verify your identity directly.

Appeals. If we decline all or part of a request, we will tell you why and how to appeal (where a right of appeal applies). Appeals may be sent to [Data Protection Officer / Privacy Contact Email] with the subject line "Privacy appeal." If your appeal is denied, you may contact your state Attorney General or, in the EU/UK, your supervisory authority.

8.3 Requests relating to Customer Content

If your request concerns information a Customer uploaded to the Platform, we will refer the request to that Customer and assist it in responding, as required by our Data Processing Addendum.

8.4 Professional Data choices

If you are a healthcare professional, injector, or practice representative whose professional information appears in the Platform, you can — regardless of where you live:

1. See your record. Request a copy of the professional information we hold about you and its sources.
2. Correct it. Tell us about inaccurate or outdated information — including derived attributes — and we will review and update it. Because Professional Data is continuously refreshed from public and licensed sources, corrections are recorded as authoritative overrides so that a later refresh does not reintroduce the error. [CONFIRM WITH ENGINEERING that an override/suppression mechanism exists; if not, build before publication.]
3. Opt out / suppress. Ask us to stop making your professional information available to Customers. We will remove your record from Customer-facing views and add your identifiers to a suppression list so that the record is not recreated from a later ingestion. We may retain the minimum information necessary to honor the suppression (for example, your name and NPI) and information we are required by law to keep.
4. Object to profiling. Object to the generation of derived attributes about you.

Please note that suppression applies to the Axiogen Platform. It does not remove information from the public sources we collected it from, and it does not affect information that a Customer independently holds.

8.5 Marketing communications

You can opt out of marketing email at any time by using the unsubscribe link in any message or by emailing [Data Protection Officer / Privacy Contact Email]. We will continue to send service and account communications that are not marketing in nature.

9. International data transfers

Axiogen is headquartered in the United States and hosts the Services primarily in the United States. If you are located outside the United States, your information will be transferred to, stored, and processed in the United States and in any other country where we or our sub-processors operate. Those countries may not provide the same level of data protection as your home country.

Where the GDPR, UK GDPR, or Swiss data protection law applies to a transfer, we rely on one or more of the following safeguards:

• the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum and Swiss amendments), supplemented where necessary by additional technical and organizational measures;
• an adequacy decision covering the recipient country;
• [If and when certified: participation in the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF — confirm certification status at [dataprivacyframework.gov] before including]; or
• another lawful transfer mechanism, or a derogation, where appropriate.

You may request a copy of the relevant safeguards by contacting [Data Protection Officer / Privacy Contact Email]. Transfers of Customer Content are governed by our Data Processing Addendum.

10. Data retention

We keep personal information for as long as needed for the purposes described in this Policy, and then delete or de-identify it, unless a longer period is required by law, contract, or legitimate business need (such as resolving disputes or enforcing agreements).

11. Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit (TLS 1.3) and at rest (AES-256), single sign-on with SAML and SCIM-based provisioning, role-based and row-level access controls, and an immutable audit log. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. For a full description of our program, see our Security & Trust Overview. To report a security concern, contact [Security Contact Email] (e.g., security@axiogen.ai).

12. Children's privacy

The Services are intended for business use by adults. We do not knowingly collect personal information from anyone under 18 (or under 16 where that is the applicable threshold). If you believe we have collected such information, please contact us and we will delete it.

13. Additional disclosures for specific jurisdictions

13.1 California

Categories of personal information. In the preceding 12 months we have collected the following categories of personal information as defined by the CCPA, from the sources and for the purposes described in Sections 3–4:

We do not use or disclose sensitive personal information for purposes other than those permitted by CCPA regulations, and we do not knowingly sell or share the personal information of consumers under 16. [If counsel selects Option A in Section 6.1:] A "Do Not Sell or Share My Personal Information" link is available in the Site footer. Shine the Light. California residents may request information about disclosures of personal information to third parties for their own direct marketing purposes; we do not make such disclosures.

13.2 European Economic Area, United Kingdom, and Switzerland

The controller of your personal information is Axiogen AI Inc., [Registered Address]. [If required: Our representative in the EU under Article 27 GDPR is [EU Representative Name and Address]. Our representative in the UK is [UK Representative Name and Address].] You can contact our Data Protection Officer / privacy lead at [Data Protection Officer / Privacy Contact Email]. You have the right to lodge a complaint with your local supervisory authority; a list of EU authorities is available at [edpb.europa.eu], and the UK authority is the Information Commissioner's Office ([ico.org.uk]). Article 14 notice: where we have obtained your personal information from sources other than you, Section 3.3 describes the categories of information and the sources, and this Policy serves as the notice required by Article 14 GDPR.

13.3 Nevada

We do not sell covered information as defined in Nevada law. [Counsel to confirm consistent with the Section 6.1 decision.]

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will change the "Last Updated" date above and, for material changes, provide more prominent notice — for example, by email to Customer Users or a notice on the Site — before the change takes effect. Prior versions are available at [Link to prior versions].

15. Contact us

More channels are listed on our Contact page.

Related documents

Terms of Service · Data Processing Addendum · HIPAA & Business Associate Information · Security & Trust Overview · Contact

Draft notice. This document is provided for informational purposes and as a high-quality starting draft. It does not constitute legal advice. Axiogen's actual policies and agreements must be reviewed, customized, and approved by qualified legal counsel licensed in the relevant jurisdictions before publication or use.