Our Privacy Notices

Caidya (“Caidya”, “we”, us” or “our”) is committed to protecting the privacy and security of your personal information. This Caidya Privacy Policy (“Privacy Policy”) describes the types of personal information and other information we collect from and about you when you interact with us or use our websites, web portals, mobile applications, or other services (collectively, the “Services”) and how we use and share your information.

This Privacy Policy is directed to:

• Visitors and users of Caidya’s Services (excluding participants in a clinical trial or other research);
• Individuals who are our clients, consultants, contractors, service providers and vendors; and
• Any other persons who communicate with us, who provide us with personal information, and/or whose personal information we receive.

As you read this Privacy Policy, please consider the following important information:

1. This Privacy Policy may contain information not applicable to you because of where you are located or the type(s) of personal information we collect about you.
2. Certain types of information we collect may be covered under another Caidya privacy policy, such as our privacy policy for Caidya employees, or our privacy policy for healthcare providers who participate in our clinical trials. If your information falls under one of these other privacy policies, then the terms of the other privacy policies will apply.
3. Our Services may contain links to third party websites (see below). Once you leave our Services, we are no longer responsible for the protection and privacy of any information you provide.

The types of information that we may collect and receive from you while you use the Services are described in this section and include both information that you provide to us, information that we collect automatically when you use the Services, and information that we collect from third party sources.

Personal Information: Personal information is information from which an individual may be identified directly or indirectly. Personal information may include information such as your name, postal address, telephone number, email address, date of birth, device and browsing information, such as your IP address, and health, financial and professional information.

We may collect personal information that you provide to us through our Services. For example, you may provide your personal information to us: through your completing forms or setting up accounts on one of our websites or web portals; through an enrollment form to register for one of our programs or services; through your requests to receive marketing materials and information about our products or services; by contacting a Caidya customer service department; or by responding to Caidya questionnaires or surveys.

Cookies and other similar technologies: When you use our Services, we may also collect information relating to your usage or visits to our websites and your devices. This information is generally collected using server log files, cookies, “pixel tags,” and tools, such as, Google Analytics.

Server Log Files: Your Internet Protocol (IP) address is an identifying number that is automatically assigned to your computer by your Internet Service Provider (ISP). This number is identified and logged automatically in our server log files whenever you visit our websites, along with the time(s) of your visit(s) and the page(s) that you visited. We use the IP addresses of all visitors to our websites to calculate our websites’ usage levels, to help diagnose problems with website servers, and to administer the websites. We may also use IP addresses to communicate with or block access by visitors who fail to comply with our terms and conditions for use of our Services. Collecting IP addresses is standard practice on the Internet and is carried out automatically by many websites. However, Caidya does not combine traffic data with user accounts.

Cookies: Cookies are data that a web server transfers to an individual’s computer for record-keeping purposes. Cookies are an industry standard used by most websites and help facilitate users’ ongoing access to and use of a particular website. Cookies do not cause damage to your computer systems or files, and only the website that transferred a particular cookie to you can read, modify, or delete such cookie. If you do not want information collected using cookies, there are simple procedures in most browsers that allow you to delete existing cookies, to automatically decline cookies, or to be given the choice of declining or accepting the transfer of cookies to your computer. You can set your browser to refuse cookies, but some portions of our websites may not work properly if you refuse cookies. A session cookie is one that exists for the time-period that your browser is open. A persistent cookie is one that is saved on your device/computer even after the browser is closed. Like many websites, we may use both session cookies and persistent cookies. To find out how to see what cookies have been set and how to reject and delete cookies, please visit //www.aboutcookies.org.

Pixel Tags: Our websites may use so-called “pixel tags”, “web beacons”, “clear GIFs” or similar means (collectively, “pixel tags”) to compile aggregate statistics about website usage and response rates. Pixel tags allow us to count users who have visited certain pages on our websites, to deliver branded services, and to help determine the effectiveness of promotional or advertising campaigns. When used in HTML-formatted email messages, Pixel Tags can tell the sender whether and when the email has been opened.

Google Analytics: We may use Google Analytics, a web analysis service provided by Google, to better understand website usage. Google Analytics collects information such as how often users visit websites, what pages they visit and what other websites they used prior to visiting. Google uses the data collected to track and examine the use of the websites, to share such data with other Google services, or to personalize the ads of its own advertising network. Google’s ability to use and share information collected by Google Analytics is restricted by the Google Analytics Terms of Service and the Google Privacy Policy. To opt-out of analysis by Google Analytics on our websites, please visit //tools.google.com/dlpage/gaoptout.

The personal information that is collected in connection with our Services may be used in any of the following ways:

• To respond to your requests for information about our products or services;
• To provide you with marketing communications whether about a particular Caidya product or service, or concerning general information about our products and services;
• To determine if you are eligible for certain products, services, or programs;
• To manage or develop our business relationship with you (e.g., to respond to questions, invite you to events, comply with regulatory obligations, or determine eligibility for Caidya programs);
• To recruit and/or consider you for employment;
• For our research, development, and collaboration efforts;
• For regulatory reporting; and
• For other everyday business purposes, such as payment processing and financial account management, product development, contract management, Site administration, fulfillment, analytics, fraud prevention, corporate governance, reporting, and legal compliance.

The information that we collect from your devices is used to better design our websites. We analyze the information we collect to enhance our websites’ security and to track the popularity of certain pages on the websites, the success of our email notifications, traffic levels on the websites, and other usage data, all of which helps us to provide content tailored to your interests and improve our websites and related Services.

We do not make any decisions about you based solely on automated processing of your information, including profiling, unless we inform you, as required by applicable laws.

We may share your personal information with third parties with whom we have contracted, as well as affiliates and business partners. We will require these recipients to use your personal information only for appropriate purposes and take appropriate measures to protect your personal information.

In the event that we sell or transfer all or a portion of our business or assets to a third party, such as in the event of a corporate sale, merger, reorganization, dissolution or similar event, we may transfer information that we have collected to such third party. We will require such a third party to continue to comply with this Privacy Policy.

We may disclose information if we believe it is necessary: (a) to comply with any law applicable to us, a request from law enforcement, a regulatory agency, or other legal process; (ii) to protect the legitimate rights, privacy, property, interests, or safety of Caidya, our patients, business partners, personnel, or the general public; (iii) to pursue available remedies or limit damages; (iv) to enforce our terms and conditions on our products or services; or (v) to respond to an emergency. We reserve the right to disclose personal information when we believe in good faith that such action is necessary to comply with a legal obligation.

In addition to the disclosures described in this Privacy Policy, we may share information about you with third parties when you consent to or request such sharing.

Caidya has relationships with third party advertising companies to place advertisements on this website and other websites, and to perform tracking and reporting functions for this website and other websites. These third party advertising companies may place cookies on your computer when you visit our websites or other websites so that they can display targeted advertisements to you. These third party advertising companies do not collect Personal Data in this process, and we do not give any Personal Data to them as part of this process. However, this Privacy Policy does not cover the collection methods or use of the data collected by these vendors. For more information about third party advertising, please visit the Network Advertising Initiative (NAI) at www.networkadvertising.org.

Our websites may contain links to third party websites, which are not operated or controlled by Caidya and for which Caidya is not responsible. The links from the websites do not imply that Caidya endorses or has reviewed the third party websites. Once you leave one of our websites, we are not responsible for the protection and privacy of any information you provide. We suggest contacting those third parties directly for information regarding their privacy practices.

Caidya operates in many countries around the world and your personal information may be accessible to or shared with any of our locations, our affiliates, consultants, contractors, service providers, suppliers and vendors in various countries for the purposes specified in this Privacy Policy.

The laws in certain countries may not provide the same level of protection as the laws in your country or region. When that is the case, and as required by applicable laws, we take steps to protect your information, such as by entering into contracts with recipients of your information or by implementing additional data protection safeguards.

By using our websites or Services or you are otherwise providing information to us, you hereby expressly consent to the transfer of your personal information outside your country or region.

Protecting the privacy of children is especially important to us. We take seriously our obligations under applicable laws concerning the collection of personal information from children. Our Services are not directed to children and we do not knowingly allow children to communicate with us or use any of our websites or Services. We request that children do not provide any personal information through our websites or in connection with the Services. If you are a parent and become aware that your child has provided us with personal information, please contact us at [email protected].

Caidya participates in the EU-US Data Privacy Framework, UK Extension to the EU-US Data Privacy Framework, and Swiss- U.S. Data Privacy Framework. Click here to learn more.

If you would like your personal information removed from our systems, changed or updated, or if you would like to opt out of your personal information being disclosed to third parties or from being used for a purpose that is materially different from the purpose for which it was originally collected or subsequently authorized, you can click here and submit the form to [email protected]. Also, if requested, we will promptly verify and delete your account and you will no longer receive emails or other communications from Caidya. Your removal from the mailing list or our systems will not remove records of past transactions or delete information stored in our data backups and archives where we are required to keep your data for legitimate business or legal requirements. Data on past transactions and data stored in backups and archives will be deleted in the normal course of our business.

Under certain laws, such as the European Union’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act of 2018 (CCPA), the California Privacy Rights Act of 2020 (CPRA) or China’s Personal Information Protection Law and Cybersecurity Law (including their implementing regulations and national standards), you may have the following rights with respect to your personal information:

• Your right of access. You may have the right to ask us to provide clear, transparent and understandable information on how we process your personal information, as well as for copies of your personal information. There are some exemptions, which means you may not always receive all the information we process.
• Your right to rectification. You may have the right to ask us to rectify information you think is obsolete or inaccurate and the right to ask us to complete information you think is incomplete.
• Your right to deletion of your personal information. You may have the right to ask us to delete your personal information in certain circumstances.
• Your right to restriction of processing. You may have the right to ask us to restrict the processing of your personal information, during a limited period of time, in certain circumstances.
• Your right to object to processing. You may have the right to object to processing, in which case, Caidya will no longer process your personal information unless Caidya demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as compliance with a legal obligation or for the establishment, exercise or defense of legal claims.
• Your right to data portability. You may have the right to ask that we transfer the information you gave us from one organization to another or give it to you.
• Your right to withdraw your consent. If we process your personal information based on your consent, you have the right to withdraw your consent, without this withdrawal affecting the lawfulness of the processing operations previously carried out.
• Your right to close your account. If you receive our services through online accounts, you have the right to close your accounts. We will then delete or anonymize your personal information associated with your accounts, unless otherwise permitted under applicable laws.Depending on your country of residence and the country where the Caidya entity processing your personal information is established, you may have additional local rights with respect to our processing of your personal information. Please note that some of the personal information that we collect, use and disclose may be exempt from the rights outlined above.

We will respond to your requests within the time period prescribed by applicable laws. Under certain circumstances, Caidya may ask you for specific information to confirm your identity and ensure the exercise of your rights. This is a security measure to safeguard personal information. We will notify you when your request is completed, if we deny your request to exercise your rights (because, for example, an exception applies), or if there is a fee associated with processing your request.

You may designate an authorized agent to exercise your rights on your behalf. In such case, we will also need to verify your agent’s identity and obtain proof of your authorization. We may need to deny a request from an agent whose identity or authorization we cannot verify.

If you believe that Caidya has processed information in a manner that is unlawful or breaches your rights, or has infringed applicable laws, you may have the right to complain directly to your local data protection authority. Without limiting any rights to complain directly to an authority, we are committed to protecting personal information, and complaints may be made directly to us.

We will not discriminate against you for exercising any data subject right you have under applicable law.

Caidya stores personal information and other data using reasonable physical, technical and administrative safeguards to secure information and data against foreseeable risks, such as unauthorized use, access, disclosure, destruction or modification. Please note, however, that while Caidya has endeavored to create secure and reliable websites for our users, the confidentiality of any communication or material transmitted to or from one of our websites or via e-mail cannot be guaranteed. You should take special care in deciding what information you transmit, upload, send, or otherwise submit to Caidya.

In case of a personal information security incident, as required by applicable laws, we will inform you in a timely manner and report the incident to the relevant regulatory authorities.

We retain your information for as long as it is necessary for the purposes set out in this Privacy Policy, unless required by law to retain it for a longer period of time. To determine the appropriate retention period for information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, whether we can achieve those purposes through other means, and all applicable global legal, regulatory, and compliance requirements.

We may update this Privacy Policy from time to time. At a minimum, we will post an updated version on our websites. Caidya encourages you to review this Privacy Policy regularly for any changes. Any changes will be effective immediately upon posting of the revised Privacy Policy, and your continued use of our websites or our Services will be subject to the then-current Privacy Policy.

If you have any questions about this Privacy Policy or about our handling of your personal information, please contact us at: [email protected].

We endeavor to respond to your request as soon as reasonably possible in compliance with all applicable laws.

We are required to comply with the European Union’s and the United Kingdom’s General Data Protection Regulations (“GDPR”/”UKGDPR”), Switzerland’s Federal Act on Data Protection (FADP) and similar applicable local laws with regards to certain personal information we collect. The data controllers of your personal information are the Caidya entities referenced when we collect your personal information. Please contact us if you have any questions about the controller or controllers of your personal information.

Sensitive Personal Data. We may process special categories of information (e.g., sensitive personal data that reveals racial or ethnic origin or genetic, biometric and health information, etc.) only where you give us your explicit consent, or when our processing is for scientific research purposes, necessary to meet a legal or regulatory obligation, in connection with the establishment, exercise or defense of legal claims, or is otherwise expressly permitted by law. If we need to collect your personal information by law or under the terms of a contract we have with you and you do not provide the requested information, we may not be able to perform the contract we have, or are trying to enter into, with you.

The servers where your personal data are stored may be located in the United States and other countries that have not been deemed by the European Commission to provide an adequate level of protection for personal data. In addition, we may share personal data with our affiliates and external service providers and third parties located outside of the EEA. When we transfer personal data out of the EEA to other countries that have not been deemed adequate, we will implement one or more of the safeguards deemed to provide appropriate safeguards by the European Commission, which may include EU Standard Contractual Clauses, transfers to organizations that protect personal data under binding corporate rules, or transfers to organizations that operate under an approved code of conduct or certification mechanism.

本隐私声明适用于出于以下目的向 dMedClinical Company Limited 及其关联方和子公司（下 称“康缔亚（Caidya）” 、“ 我们” 、 “我们的”）提供个人信息的个人（下称“您” 、“ 您的” 、 “求 职者” 、 “承包商” 、 “员工”）：(1) 向康缔亚申请并寻找就业机会； (2) 就您在康缔亚的就业 状况作出决定； (3) 成为康缔亚的员工（包括全职、兼职、外包、派遣或实习生）；或 (4) 与 康缔亚签订工作合同。

康缔亚是您作为求职者、承包商或员工的个人信息的数据控制者（即决定为何收集您的个人 信息以及如何使用您的个人信息的实体）。因此，康缔亚特向您提供本隐私声明，其中描述 了康缔亚将如何使用我们所收集的关于您的个人信息以及您如何就康缔亚对您的个人信息 的使用情况行使您的权利。

在阅读本隐私声明时，务必牢记下文中关于本隐私声明将以何种方式适用于您的重要信息：

1. 本隐私声明包含的特定章节可能适用也可能不适用于您，具体取决于您所在的位置或我 们收集和维护的关于您的个人信息的类型。
2. 其他隐私政策或信息声明可能会补充或取代本隐私声明，这些政策或信息声明将会向您 告知在其他特定情况下将如何使用和披露您的个人信息。如果提供、张贴和/或引用了这 些政策或通知，则这些隐私政策或通知（而非本隐私政策或通知）将适用于您的个人信 息的处理。
3. 我们的官网、门户网站、移动应用程序或其他数字服务（统称为我们的“网站”）可能含 有跳转至我们不运营、不控制或不认可的第三方网站的链接。一旦您离开我们的网站， 我们将不再对您提供的任何信息的保护和隐私负责。我们建议您阅读这些第三方网站的 隐私政策，如有必要，请直接联系第三方，以便获取关于其隐私惯例的信息。

康缔亚可能会收集和处理关于您的个人信息的任何下列类别和示例。请注意，下表列出了康 缔亚收集的关于您的个人信息的最常见类别和示例，但并未包含所有个人信息类别或示例：

敏感个人信息。根据适用法律，康缔亚收集的关于您的某些个人信息可能被视为敏感个人信 息。为了保护这些敏感个人信息，我们将：

• 采取适当的安全和技术措施来保护和处理您的敏感个人信息； 和
• 根据适用法律的要求，就您的敏感个人信息的处理向您发出通知和/或获得您的 明确同意书。

网站信息。我们的网站通过 Cookie 和其他数据收集技术自动收集以下信息：

• IP 地址
• 设备类型
• 浏览器类型
• 语言
• 浏览历史记录，以及
• 关于您与我们的网站及其服务互动的信息

这些信息对于我们的网站及其服务的正常运行以及我们的内部业务分析目的（例如受众测 量）而言必不可少。

如需了解更多关于我们的 Cookie 和其他数据收集技术的信息，请阅读您正在访问的网站所 适用的 《Cookie 政策》或《隐私政策》。

必填信息。出于特定目的，为方便我们处理您的个人信息，我们可能要求必须提供特定类型 的个人信息，这可能是因为适用的法律要求您在职位申请表、承包商工作或雇员工作中提供 某些特定信息，或为您提供与您在康缔亚履行工作职责相关的服务。

在收集您的个人信息时，必填信息将被标记为“必填项”，以便您意识到其是必填信息。如果 您决定不提供必填信息，康缔亚可能无法处理您的个人信息。

在大多数情况下，我们直接从您那里收集您的个人信息，例如当您通过电话、电子邮件、邮 件或亲自联系我们时，在我们的网站上向我们提交信息时，向我们发送您的简历或求职信时， 填写在线申请表、表格或民意调查表时，在我们的网站上注册账户或您请求接收我们的材料 和信息时。

如果您是雇员或承包商，我们可能会在您与康缔亚合作期间收集关于您的信息，包括个人业 务联系信息和位置信息、银行、福利、医疗保健、工资和库存信息，或康缔亚收集的任何其 他个人信息（作为您在公司工作所需），例如绩效评估、调查信息等。

有时，我们可能会从您指示或授权与我们共享您的个人信息的授权第三方来源获取您的个人 信息，例如您当前的雇主、作为您的推荐人的个人或其他授权代表或附属组织（例如招聘人 员）。

此外，如果您使用我们的网站，我们可能会通过使用 Cookie 和其他数据收集技术从您的计 算机或其他设备收集信息。如需了解更多关于 Cookie 和其他数据收集技术的信息，请阅读 您正在使用的网站所适用的 《Cookie 政策》或《隐私政策》。

我们处理您的个人信息的方式有许多种，而具体的处理方式取决于我们收集信息的原因。根 据您与康缔亚之间的关系和/或互动以及适用的法律和我们自身的程序和要求，康缔亚可能 出于以下原因和法律依据处理您的个人信息：

除非我们根据适用法律的要求通知您，否则我们不会仅根据对您的个人信息的自动处理（包 括分析）便作出决定。

我们可能会在康缔亚内部与位于不同国家或地区的康缔亚子公司、与我们签约的所有授权第 三方、司法、行政或监管机构或适用法律允许的其他机构共享您的个人信息。我们共享的个人信息的类型以及我们共享信息的目的取决于接收者的角色，但我们不会出售我们所收集的 关于您的个人信息。就美国加利福尼亚州的居民而言，我们不会出于互联网广告或定向营销 目的而共享您的个人信息（请参阅下文中适用于加利福尼亚州居民的章节）。

下表举例说明了我们与谁共享您的个人信息以及共享信息的目的：

除我们的法律义务要求保留更长的时间外，若为实现本隐私声明中所列目的有需要保留，我 们就会一直保留您的个人信息。为了确定信息的适当保留期限，我们会考虑信息的数量、性 质和敏感性、未经授权使用或披露信息造成损害的潜在风险、我们处理信息的目的以及我们 是否能够通过其他方式实现这些目的以及所有适用的全球法律、监管和合规要求。

例如，通过我们的职位申请流程所收集的个人信息将保留在我们的求职者数据库中，以供将 来职位搜索和申请以及未来您获得工作机会时使用。如果您希望删除您的信息，请联系 康 缔亚的隐私团队：[email protected]。

我们将保留您的取消请求记录（如有），保留时间为满足该请求所需的时间。如果适用法律 要求和为了捍卫或执行我们的合法权利需要，我们也可能保留特定职位申请信息。

此外，康缔亚还将按照以下期限保留您的个人信息：

• 适用的法定时效（出于证据目的需要）；
• 适用的法定保留期，特别是关于商业、合规和监管事务的法律保留期或任何其他 强制性保留期（例如诉讼保全或调查要求的保留期）。

康缔亚在许多国家/地区开展业务，出于本隐私声明所提及的目的，我们在各国的子公司、 获授权服务提供商、司法、行政和监管方以及代理人、顾问、咨询师和代表可能会访问或共 享您的个人信息。

请记住，某些国家/地区的数据隐私和数据保护法律或法规可能无法提供与您所在国家或地 区相同级别的保护。在此情况下，根据适用法律的要求，在将您的个人信息传输至另一个国 家或地区时，我们会依法采取必要的措施来保护您的个人信息，例如与您的信息接收者签订 合同和/或实施更多的保护措施来保护您的个人信息等。

虽然我们已制定了合理的物理、管理和技术措施来保护您的个人信息免遭未经授权的访问或 披露，但我们不能保证信息的绝对安全。因此在决定向我们传输、上传、发送或以其他方式 提交哪些信息时，请您务必小心谨慎，除非是康缔亚要求根据您的合同工作或雇佣所需提供 的信息。

根据特定法律，例如欧盟《通用数据保护条例》(GDPR)、《瑞士数据保护法》、《英国数据保 护法》(UK-GDPR)、《加利福尼亚州消费者隐私法》(CCPA)、《加利福尼亚州隐私权法》(CPRA) 或《中华人民共和国网络安全法》和《中华人民共和国个人信息保护法》(PIPL)，包括其实施 条例和国家标准，您对您的个人信息可能享有以下权利：

• 访问权。您可能有权要求我们就我们如何处理您的个人信息事宜提供清晰、透明和易于 理解的信息，也有权要求我们提供您的个人信息的副本。但也有一些豁免情况，这表明 您可能无法始终访问我们拥有和处理的有关您的所有个人信息。
• 纠正个人信息的权利。您可能有权要求我们改正或纠正您认为过时或不准确的信息，并 有权要求我们补充您认为不完整的信息。
• 删除个人信息的权利。在某些情况下，您有权要求我们删除您的个人信息。
• 限制处理的权利。在某些情况下，您有权要求我们在有限的时间内限制对您的个人信息 的处理。
• 反对处理的权利。您可能有权对某些处理活动提出反对。在此情况下，除非康缔亚有令 人信服的合法理由证明必须进行处理，而且该理由凌驾于您的利益、权利和自由之上 （例如您作为公司员工履行职责的能力、遵守法律义务或提出、行使或辩护法律索赔 等），否则康缔亚将不再处理您的个人信息。
• 数据迁移权利。您可能有权要求我们将您向我们提供的信息从一个组织机构转移至另 一组织机构，或者将其交给您，以便转移至另一组织机构。
• 撤回同意书的权利。如果我们基于您的同意书而处理了您的个人信息，您有权撤回该同意书，但该撤回不影响先前进行的处理操作的合法性。但如果您撤回同意书，我们可能 无法再向您提供某些服务，或者您可能无法再履行您的雇佣职责。
• 关闭账户的权利。如果您通过在线账户接收我们的服务，您有权关闭您的账户。随后， 除非适用法律另行允许我们保留您的个人信息，否则我们将删除或匿名化与您的账户 相关的个人信息。

根据您居住的国家/地区以及处理您的个人信息的康缔亚实体所在的国家/地区，您在当地可 能拥有与我们处理您的个人信息相关的其他权利。例如，您可能还有权直接向当地数据保护 机构提出问题或疑虑。

请注意，我们对您的一些个人信息的收集和处理可能不受上述权利的约束。

如您有任何请求，通过向我们的电子邮箱 [email protected] 发送电子邮件，您的请求将直 接提交给康缔亚。

我们将在适用法律规定的期限内回复您的请求。在某些情况下，为了确认您的身份并确保您 适当行使权利，康缔亚可能会要求您提供特定信息。这是保护个人信息的安全措施。在您提 出请求后，如果我们拒绝您行使权利的请求（例如，因为适用例外情况），或者处理您的请 求需要支付费用，我们将向您发出通知。

您可以指定一名授权代理人代表您行使权利。在此情况下，我们还需要验证您的代理人的身 份并获得您的授权证明。如果我们无法验证其身份或授权，我们可能会拒绝代理人的请求。

如果您认为康缔亚以非法方式处理信息或侵犯了您的权利，或违反了适用法律，您可能还有 权直接向当地数据保护机构进行投诉。我们始终致力于保护您的个人信息，您也可以直接发 送电子邮件至 [email protected] 或 [email protected] 进行投诉，同时您直接向有关当局进 行投诉的权利不受影响。

我们不会因您行使适用的数据隐私和数据保护法所赋予的任何权利而歧视您。

如果您是加利福尼亚州居民，同时也是康缔亚的求职者，则我们收集的关于您的个人信息不 受本隐私声明中“您的选择和权利”章节所述权利的约束。

如果您成为了康缔亚的潜在员工，我们可能会收集、使用和共享您的以下个人信息：

我们出于多种目的收集和共享这些个人信息，其中包括：管理您的职位申请、开展雇前筛选 和背景调查、履行我们的法律义务、改进我们的招聘流程和网站以及用于我们的日常业务目 的，例如处理工资单、保护康缔亚财产并防止滥用或欺诈等。在出售或交易康缔亚或康缔亚 子公司（包括康缔亚的部分或全部资产）时，我们也可能会使用您的个人信息。

我们不会出售加利福尼亚州求职者的个人数据，也不会出于互联网广告或定向营销目的而 共享加利福尼亚州求职者的个人数据。

如果您对本隐私声明存有疑问，可通过以下方式联系我们：[email protected]。

数据传输。我们可能会在中国境外与其他康缔亚实体共同处理您的个人信息，或者与我们的 第三方服务提供商共享您的个人信息，而这些第三方服务提供商将使用您的个人信息向康缔 亚或向您提供本隐私声明所述的服务。根据《中华人民共和国个人信息保护法》，我们可能 需要获得您的同意书才能将您的个人信息传输至中国境外。在向康缔亚申请工作、新员工入 职培训期间或在康缔亚有必要获得其员工之同意书的情况下，您可能需要签署数据传输同意 书。如果您不提供该同意书，或者今后撤回该同意书，我们可能无法再向您提供本隐私声明 中所述的某些服务，或者您可能无法再充分履行您的雇佣职责。

如果您对从中国境内传输您的个人信息存有任何疑问，请通过以下方式联系我们：[email protected]。

就我们收集的特定个人信息而言，我们必须遵守欧盟和英国的《通用数据保护条例》 （“GDPR”）、瑞士的《联邦数据保护法》（FADP）以及当地适用的类似法律。您的个人信息的 数据控制者是本隐私声明文首所述的康缔亚实体。 如果您对您的个人信息的控制者存有任何 疑问，请联系我们：[email protected]。

敏感个人信息。只有在您向我们给予明确同意书时，或者当我们的处理是出于科学研究目的 或履行与建立、行使或辩护法律主张相关的法律或监管义务所必需的情况下，或者适用法律 明确允许的情况下，我们才会处理特殊类别的个人信息（例如，揭示种族、性别或民族血统 的敏感个人信息、遗传、生物特征和健康信息、政治和工会关系等）。

如果我们根据法律或我们与您签订的合同条款的需要收集您的敏感个人信息，而您没有提供 所要求的信息，我们可能无法处理您的职位申请或相关请求。

数据传输。康缔亚是一家跨国公司，在中国、美国和欧洲经济区均设有办事处。因此，康缔 亚可能会将您的个人信息传输至或提供给其子公司和关联方、获授权服务提供商或合作者或 这些国家/地区的其他第三方以及可能无法为您的个人信息提供与您所居住国家/地区的个 人信息相同级别之保护的其他方。在此种情况下，如果缺乏关于接收国的适当性决定，我们 将对您的个人信息接收者所在的第三国对您的权利的保护程度进行评估，随后将依靠已批准 的示范合同（例如欧盟的标准合同条款或英国的国际数据传输协议）等保障措施来保护您的 个人信息。

您作为数据主体的权利。本隐私声明中的“您的选择和权利”章节介绍了根据《通用数据保护 条例》和相关法规，您对我们收集和维护的您的个人信息可能拥有的各项权利。根据《通用 数据保护条例》，这些权利的行使可能会受到限制或延迟，具体取决于处理您的个人信息的 法律依据，例如：

Cookie、像素标签和其他跟踪器（下称“Cookie”）是方便您在访问我们的网站时在浏览器或 设备（计算机、平板电脑、手机等）上存储或检索信息的小文件。Cookie 广泛用于网站、移 动应用程序、软件或电子邮件。在第一次访问我们的网站后，如果您删除了 Cookie 或 Cookie 已经过期或更改，再次访问时系统会询问您同意哪些 Cookie。

Cookie 无法识别您个人，而是识别您所使用的设备，并且只提供与您的浏览活动相关的信 息，方便日后识别设备，从而改善浏览体验、保存您的偏好，甚至调整网站上为您提供的服 务。如需了解更多关于 Cookie 的信息，包括如何查看已设置的 Cookie ，请访问 www.aboutcookies.org 或 www.allaboutcookies.org。

我们的网站可能会使用以下类型的 Cookie：

• 必要 Cookie——使网站能够正常运行（安全、方便浏览、网页显示）。如下文所述，您 可以通过更改浏览器设置来禁用必要 Cookie。如果禁用必要 Cookie，您仍然可以浏览 网站，但网站的某些功能可能会受到影响；
• 分析型 Cookie——用于收集与访问者如何使用我们网站相关的信息，并通过收集关于 您如何与网站互动的信息来改进网站；
  • Cookie 收集信息的方式不会直接识别任何人，而是以汇总或概括的统计形式收 集信息，包括网站访问者数量、访问者从何处访问网站以及访问的页面。
  • 我们使用的一种分析型 Cookie 是 Google Analytics。如需了解关于谷歌隐私管理和数据保护措施的概述，请访问：https://support.google.com/analytics/answer/6004245。如果选择不让 Google Analytics 在所有网站上进行跟踪，请访问 http://tools.google.com/dlpage/gaoptout。
• 社交媒体 Cookie——方便您与网站上的社交插件互动并在社交网络上分享内容； 和
• 广告 Cookie——允许投放广告，衡量广告有效性并根据您的浏览和个人资料调整广告 内容。

大多数网络浏览器允许通过浏览器设置对大多数 Cookie 进行一定程度的控制。例如，大多 数浏览器中都有简单的程序允许您删除现有的 Cookie。如果您希望将计算机或移动网络浏 览器设置为默认拒绝所有 Cookie，请访问您的浏览器主页，以获取相关说明。如果您拒绝所 有 Cookie，您仍可以使用我们的网站； 但我们网站某些区域的功能可能会受到影响。

此外，每当您访问我们的网站时，您的互联网协议 (IP) 地址（您的互联网服务提供商自动 分配给您的计算机的识别号）、您访问的次数以及您访问的页面都会被识别并自动记录在我 们的服务器日志文件中。我们使用网站所有访问者的 IP 地址来计算网站使用级别、帮助诊 断网站服务器问题和管理网站。此外，我们还可能使用 IP 地址与不遵守我们的使用条款的 访问者进行通信或阻止其访问我们的网站（视情况而定）。

我们不会为了提供有针对性的广告而长时间或跨第三方网站跟踪我们的网站用户。目前，由 于缺乏既定的行业标准，我们不会响应您的网络浏览器所发出的“请勿跟踪”信号。如需了解 更多关于“请勿跟踪”信号的信息，请访问 https://allaboutdnt.com/。

如果您对本隐私声明或我们的相关措施存有疑问或疑虑，欢迎随时与我们联系。请发送电子 邮件至：[email protected]。

我们将按照适用法律的规定在合理可行的时间内尽快地回复您的请求。

为了保护您的隐私和安全，在授予您的个人信息的访问权限或更正您的个人信息之前，我们 会采取合理的措施来验证您的身份。请注意，尽管收到了删除或更改您的个人信息的请求， 但我们的数据库和其他记录中可能仍会保留残留信息。

我们努力为所有人提供便利，无论其是否残疾。如果您需要以其他格式接收本文件中所包含 的信息，请通过以下方式联系我们：[email protected]。

我们计划定期更新本隐私声明以准确反映我们的相关措施。因此，我们建议您定期查看本隐 私声明。如果本隐私声明发生重大变更，我们可能会在该变更生效之前通知您。

Caidya (“Caidya”, “we”, “us” or “our”) is committed to protecting the privacy and security of your “Consumer Health Data” (defined below). This Consumer Health Data Privacy Notice supplements all other Caidya Privacy Notices with respect to your Consumer Health Data and applies to our collection of Consumer Health Data subject to the Washington State My Health My Data Act (the “MHMDA”) as well as other similar state consumer health data laws.

This Consumer Health Data Privacy Notice describes the health data that we may collect about you; how we may use that information; and the choices you may make with respect to it.

In this Consumer Health Data Privacy Notice, we use the term “Consumer” to mean: (1) residents of Washington State, and (2) other individuals whose Consumer Health Data we collect in Washington State, consistent with the definition of “Consumer” in the MHMDA. Also consistent with the MHMDA, we use the term “Consumer Health Data” in this Consumer Health Data Privacy Notice to mean personal information that is linked to, or reasonably linkable to, a Consumer and that identifies the Consumer’s past, present, or future physical or mental health status.

This Consumer Health Data Privacy Notice does not apply to any other personal data we collect which may otherwise be covered under one of our other existing Privacy Notices which you will find here at: https://www.caidya.cn/privacy-policy/.

We, or our third-party business partners, may collect the following categories of Consumer Health Data about you:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of health information;
• Diagnoses or diagnostic testing, treatment, or medication;
• Genetic data;
• Information regarding gender affirming care or reproductive or sexual health;
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies;
• Data that could identify you as an individual seeking health care services; and
• Any inferences of the above categories of health data that we may infer or derive from any non-health information.

The types of Consumer Health Data we collect about you depends on your relationship with Caidya. Not all of the categories of Consumer Health Data may apply to you. If the nature of your relationship with Caidya changes, additional or different categories of Consumer Health Data may also apply.

If our third-party business partners collect and use your Consumer Health Data on our behalf, this Privacy Notice may not apply and you should consult our third party business partners’ Privacy Notices for more information regarding their privacy practices. (see WHO WE MAY SHARE CONSUMER HEALTH DATA WITH below for more information).

As described further in our other existing Privacy Notices, we may use your Consumer Health Data: (1) to respond to your requests for information about our products and services or to manage or develop our business relationship with you (e.g., to respond to questions, invite you to events, etc.); (2) to determine your eligibility for certain Caidya products, services, or other information; (3) to provide and improve Caidya products and services; (4) in accordance with the terms and conditions of Caidya’s programs; (5) to operate, manage, and maintain our business; (6) to respond to your inquiries and fulfill your requests; (7) to send you administrative information and marketing communications about a particular Caidya product; (8) for our research, development and collaboration efforts including our clinical studies; or (9) for regulatory reporting, such as adverse event reporting or to communicate product safety information to you or for pharmaceutical transparency reporting.

We may also use your Consumer Health Data for our own business purposes including: data analysis, internal audits, developing new products or services or improving existing products or services, identifying usage trends, determining the effectiveness of promotional campaigns, preventing fraud, and for other everyday business purposes, such as contract management, website administration, fulfillment, analytics, corporate governance, reporting and legal compliance.

Additionally, we may use your Consumer Health Data to comply with applicable law, legal processes, responding to requests from public and government authorities, and to protect our rights, operations, and enforce our terms of service.

Further, we or one of our third-party partners may de-identify or anonymize your Consumer Health Data so that it cannot reasonably be reidentified by us or by another person (“De-Identified Data”), and we may use this De-Identified Data for any reason permitted by applicable law. If we de-identify information that was originally based on your Consumer Health Data, we will maintain and use that information in de-identified form and will not attempt to re-identify the data, except as otherwise permitted under applicable law.

Please, note that Caidya does not and will not sell your Consumer Health Data to any third parties.

We, or our third-party business partners, may collect Consumer Health Data directly from you, as well as from the following sources:

• Healthcare providers (e.g., doctors and specialty pharmacies);
• Health insurance companies (e.g., health plans and other payors);
• Your authorized/legal representatives, family members, and caregivers;
• Payment processors and other financial institutions;
• Your mobile devices and computers when you are connected to our websites, platforms or applications via the internet;
• Cookies, web beacons, and similar technologies (automatically) when you visit our websites or our third party partners’ websites;
• Third Parties and Processors who help us maintain the accuracy of our data and data aggregators that help us complete and enhance our records;
• Third Parties and Processors who provide digital marketing and analytics services for us using cookies and similar technologies that contain a unique identifier, such as an advertising ID;
• Third Parties and vendors that provide access to information you make publicly available, such as social media platforms; and
• Third Parties and processors who provide us with supplemental consumer data or data analytics and market research services, such as data aggregators.

We may share your Consumer Health Data with third parties, such as:

• Healthcare providers (including doctors or specialty pharmacies);
• Health insurance companies (health plans and other payors);
• Your authorized/legal representatives, family members, and caregivers;
• Third Parties that help administer, manage, and analyze our programs and services;
• Third Parties with whom we have joint marketing or other similar arrangements;
• Payment processors, financial institutions, and others as needed to complete transactions and for authentication, security, and fraud prevention;
• Third Parties who deliver our communications, such as the postal service or other mail couriers (e.g., UPS, FedEx, DHL, etc.);
• Third Parties who provide marketing and data analytics services, such as social media platforms used to deliver our ads, website/email optimization providers, email marketing vendors, and data analytics vendors;
• Third Parties who assist with fraud prevention, detection, and mitigation;
• Third Parties as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings);
• Our lawyers, auditors, and consultants; and
• Legal and regulatory bodies and other third parties as required by law.

Subject to certain legal limitations and exceptions, you have the following rights with respect to any Consumer Health Data we may collect about you:

• The right to confirm whether we are collecting, sharing, or selling your Consumer Health Data and to access your Consumer Health Data, including a list of all third parties and affiliates with whom we have shared or sold your Consumer Health Data and an active email address or other online mechanism that you may use to contact these third parties;
• The right to withdraw consent from our collection and sharing of your Consumer Health Data; and
• The right to have your Consumer Health Data deleted.

If you would like to exercise your rights pursuant to the MHMDA or similar consumer health data laws, please submit your request to: [email protected]. We will endeavor to fulfill your request to exercise these rights, but sometimes, we may have legal grounds or obligations to reject your request.

We will respond to your requests within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. Under certain circumstances, Caidya may ask you for specific information to confirm your identity and ensure the exercise of your rights. This is a security measure to safeguard your Consumer Health Data. We will notify you when your request is completed or if we deny your request to exercise your rights (because, for example, we cannot properly verify your identity).

You may designate an authorized agent to exercise your rights on your behalf. In such case, we will also need to verify your agent’s identity and obtain proof of your authorization. We may need to deny a request from an agent whose identity or authorization we cannot verify.

If you believe that Caidya has processed your Consumer Health Data in a manner that is unlawful or breaches your rights, or has infringed applicable laws, you may have the right to complain directly with the Washington State Attorney General at: www.atg.wa.gov/file-complaint. Without limiting any rights to complain directly to your state authority, we are committed to protecting your Consumer Health Data and complaints may also be made directly to us.

We will not discriminate against you for exercising any right you have under applicable law.

We may update this Privacy Notice from time to time. At a minimum, we will post an updated version on our websites. Caidya encourages you to review this Privacy Notice regularly. Any changes will be effective immediately upon posting of the revised Privacy Notice, and your continued use of our websites or our products or services will be subject to the then-current Privacy Notice.

If you have any questions about this Privacy Notice or about our handling of your Consumer Health Data or other information we collect about you, please contact us at: [email protected].

You may also contact us by mail at the address below. If you choose to contact us by mail, please be sure to provide us with your name, address, email address, and/or phone number you would like us to respond to.

Caidya
Attn: Privacy Officer
2700 Wycliff Road
Suite 340
Raleigh, NC 27607

This Privacy Notice (“Privacy Notice”) is directed at patients (and/or their care givers, guardians, parents or representatives, collectively “patients”), health care professionals and other medical professionals such as pharmacists, statisticians, staff or other representatives of medical offices, hospitals, and academic and medical centers (“HCPs”) who provide Caidya (“Caidya”, “we”, “us”, “our”) with personal information and/or personal data (“Personal Information”) we receive for such purposes including but not limited to: (1) management and support of clinical trials including such services as clinical development, study start-up and patient recruitment services; (2) safety data reporting (e.g., pharmacovigilance services for clinical trials and post-marketing activities); (3) medical writing; (4) regulatory services; (5) clinical data management; (6) clinical analytics, biometrics and biostatistical analytics; (7) clinical technology and ecosystem services; and (8) any other related activities or services provided by Caidya.

This Privacy Notice describes how Caidya uses the Personal Information we collect about you and how to exercise your rights.

As you read this Privacy Notice, please keep in mind the following important information about how this Privacy Notice applies to you:

1. This Privacy Notice contains specific sections that may or may not be applicable to you because of where you are located or the type of Personal Information we collect and maintain about you.
2. This Privacy Notice may be complemented or supplanted by other privacy notices or policies that tell you how your Personal Information is used and disclosed in certain other contexts. To the extent that those privacy notices or policies are provided, posted and/or referenced, those different privacy notices or policies, and not this one, will apply to the processing of your Personal Information.
3. Our websites, web portals, mobile applications or other digital services (together, our “Websites”) may contain links to third-party websites that we do not operate, control or endorse. Once you leave our Websites, we are not responsible for the protection and privacy of any information you provide. We recommend that you read the privacy policies of these third-party websites, and if needed, contact the third parties directly for information about their privacy practices.

Caidya may collect and process any of the following categories and examples of Personal Information about you. Please keep in mind that this list includes the most common categories and examples of Personal Information Caidya collects about you. Please note that not every category or example of Personal Information is contained in this list:

Sensitive Personal Information. Certain Personal Information Caidya collects about you may be considered Sensitive Personal Information under applicable laws. To protect such Sensitive Personal Information, we will:

• take appropriate security and technical measures to protect and process your Sensitive Personal Information; and
• provide notices and/or obtain your explicit consent for processing your Sensitive Personal Information where required by applicable laws.

Website Information. Our Websites automatically collect the following information through cookies and other data collection technologies:

• IP address
• device type
• browser type
• language
• browsing history, and
• information about your interaction with our websites and their services

This information is necessary for the proper functioning of our Websites and their services, as well as our internal business analytics purposes, such as audience measurement.

For more information on our cookies and other data collection technologies, please read the OUR COOKIES POLICY section below, or the privacy notice applicable to the website you are accessing.

Required Information. Required information will be marked as required at the time of collection of your Personal Information so that you are aware that it is required. If you decide not to provide the required information, Caidya may not be able to process your Personal Information.

The most common way we collect your Personal Information is directly from you, such as when you contact us via phone, electronically via email or in person; when you complete a form or survey on-line or that we send to you; when you contract with us; when you provide services to us; when you register for an on-line account; or when you request to receive from us clinical, corporate, marketing, medical or investor materials.

We may also collect your Personal Information from a variety of other sources including but not limited to: our business partners, specialty pharmacies, health insurance companies, your healthcare provider, public sources (such as websites, social media and other digital platforms, publication databases, journals, societies, editorial board websites, national registries, professional directories and third-party healthcare professional databases), or from our third-party vendors and service providers.

In addition, if you use our Websites, we may collect information from your computer or other devices through our use of cookies and other data collection technologies.

The ways we process your Personal Information depend on why we collected it. Depending on your relationship and/or interactions with Caidya, as well as applicable laws and our own procedures and requirements, Caidya may process your Personal Information for the following reasons:

Our legal bases for processing your Personal Information may be: (1) in furtherance of a contract between Caidya and you; (2) Caidya’s legitimate business interests; (3) due to a legal or regulatory obligation; or (4) your consent.

We do not undertake any decisions based solely on automated processing of your information, including profiling, unless we inform you as required by applicable laws.

We may share your Personal Information within Caidya, business partners, with all authorized third parties with whom we have contracted, judicial, administrative, or regulatory authorities, or as otherwise permitted by applicable laws. The type(s) of Personal Information we share and our purposes for sharing it depends on the role of the recipient. We do not, however, sell your Personal Information that we collect about you. For residences of the State of California, U.S.A., we do not share your Personal Information for internet-based advertising or targeted marketing (see below section for California Residents).

Here are examples of who we share your Personal Information with and the purposes for sharing it.

We retain your Personal Information for as long as it is necessary for us to carry out the purposes for which we collected it as set out in this Privacy Notice unless we are required by law to retain it for a longer period of time. When we determine the appropriate retention period for your Personal Information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, whether we can achieve those purposes through other means, and all applicable legal, regulatory, and compliance requirements.

When we communicate with you via email, send newsletters, or respond to your requests to receive information from us, your information may be kept until you decide to unsubscribe and the information you provide via your requests will be kept at least until their complete processing. We will keep a record of your unsubscribe request for as long as is necessary to comply with that request.

In addition, Caidya will keep your Personal Information:

• In compliance with Caidya’s records retention policy.
• For the statute of limitation, if needed for evidentiary purposes.
• For the applicable legal retention periods, in particular regarding commercial, compliance and regulatory matters, or any other mandatory retention period (such as a legal hold or investigation).

Caidya operates in many countries around the world and your Personal Information may be accessible to or be shared with our subsidiary companies, authorized service providers, Judicial, administrative, and regulatory parties and agents, advisors, consultants, and representatives in various countries for the purposes specified in this Privacy Notice.

Keep in mind that the data privacy and data protection laws or regulations in certain countries may not provide the same level of protection as those in your country or region. When that is the case, and as required by applicable laws, we take legally required steps to protect your Personal Information when transferred to another country or region, such as entering into contracts with recipients of your information and implementing additional safeguards.

While we have established reasonable physical, administrative, and technical measures to protect your Personal Information from unauthorized access or disclosure, we cannot guarantee its absolute security. You should take special care in deciding what information you transmit, upload, send or otherwise submit to us.

You may choose not to provide your Personal Information to us; however, in doing so, you may not be able to continue your relationship or interactions with us or use certain services.

At any time, you can choose to opt out from our marketing communications by using the unsubscribe feature in any marketing email you have received. If you unsubscribe from marketing, we may still send you email communications that are relationship or transactional in nature.

Under certain laws, such as the European Union’s General Data Protection Regulation (GDPR), The Swiss Federal Act on Data Protection (FADP), The UK Data Protection Act (UK-GDPR), the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA) or China’s Cybersecurity Law and Personal Information Protection Law (PIPL), including their implementing regulations and national standards, you may have the following rights with respect to your Personal Information:

• Your right of access. You may have the right to ask us to provide clear, transparent, and understandable information on how we process your Personal Information, as well as for copies of your Personal Information. There are some exemptions, which means you may not always receive access to all the Personal Information we have and process about you.
• Your right to rectification. You may have the right to ask us to correct or rectify information you think is obsolete or inaccurate and the right to ask us to complete information you think is incomplete.
• Your right to deletion of your personal information. You may have the right to ask us to delete your Personal Information in certain circumstances.
• Your right to restriction of processing. You may have the right to ask us to restrict the processing of your Personal Information, during a limited period of time, in certain circumstances.
• Your right to object to processing. You may have the right to object to certain processing activities, in which case, Caidya will no longer process your Personal Information unless Caidya demonstrates compelling legitimate grounds for the processing which overrides your interests, rights and freedoms, such as compliance with a legal obligation or for the establishment, exercise or defense of legal claims.
• Your right to data portability. You may have the right to ask that we transfer the information you gave us from one organization to another or give it to you to transfer to another organization.
• Right to withdraw your consent. If we process your Personal Information based on your consent, you have the right to withdraw your consent, without this withdrawal affecting the lawfulness of the processing operations previously conducted.
• Right to close your account. If you receive our services through on-line accounts, you have the right to close your accounts. We will then delete or anonymize your Personal Information associated with your accounts unless we are otherwise permitted to retain your Personal Information under applicable laws.

Depending on your country of residence and the country where the Caidya entity processing your Personal Information is established, you may have additional local rights with respect to our processing of your Personal Information. For example, you may also have the right to raise questions or concerns directly with your local data protection authority. Please note that some of the Personal Information that we collect and process may be exempt from the rights outlined above.

You can submit your request directly to Caidya by sending us an email at: [email protected].

We will respond to your requests within the time period prescribed by applicable laws. Under certain circumstances, Caidya may ask you for specific information to confirm your identity and ensure the appropriate exercise of your rights. This is a security measure to safeguard Personal Information. We will notify you when your request is completed, if we deny your request to exercise your rights (because, for example, an exception applies), or if there is a fee associated with processing your request.

You may designate an authorized agent to exercise your rights on your behalf. In such case, we will also need to verify your agent’s identity and obtain proof of your authorization. We may need to deny a request from an agent whose identity or authorization we cannot verify.

If you believe that Caidya has processed information in a manner that is unlawful or breaches your rights, or has infringed applicable laws, you may have the right to complain directly to your local data protection authority. Without limiting any rights to complain directly to an authority, we are committed to protecting your personal information, and you may also lodge your complaint(s) directly with us.

We will not discriminate against you for exercising any of your rights that you have under applicable data privacy and data protection laws.

If you are a California Consumer, in the past twelve (12) months, we may have collected the categories of personal information about you described in the CATEGORIES OF PERSONAL INFORMATION WE COLLECT AND PROCESS ABOUT YOU section of this Policy. That information was collected for the purposes described in the WHY WE PROCESS YOUR PERSONAL INFORMATION section of this Policy and may have been shared with the third parties identified in the WHO WE SHARE YOUR PERSONAL INFORMATION WITH section of this Policy.

You can exercise your data subject access rights as described in the YOUR CHOICES AND RIGHTS section of this Policy by sending us an email at [email protected] or you may write to us at:

Caidya Inc.
Attn: Privacy Officer
2700 Wycliff Road
Suite 340
Raleigh, NC 27607

Some of the Personal Information that we collect, share or use may be exempt from California state law because it is regulated by other federal or state laws that apply to us.

We do not sell your Personal Information, and we do not share your Personal Information for internet-based advertising or targeted marketing.

We are required to comply with the European Union’s and the United Kingdom’s General Data Protection Regulations (“GDPR”), Switzerland’s Federal Act on Data Protection (FADP) and similar applicable local laws with regards to certain Personal Information we collect. The data controllers of your Personal Information are Caidya and/or Caidya’s business partners or clients. Please contact us if you have any questions about the controller or controllers of your Personal Information at: [email protected].

Sensitive Personal Information. We process special categories of Personal Information (e.g., Sensitive Personal Information that reveals racial, sex or ethnic origin, genetic, biometric and health information, political and trade union affiliations, etc.) only where you give us your explicit consent, or when our processing is for scientific research purposes, necessary to meet a legal or regulatory obligation, in connection with the establishment, exercise or defense of legal claims, or is otherwise expressly permitted by applicable laws.

If we need to collect your Personal Information by law or under the terms of a contract we have with you and you do not provide the requested information, we may not be able to perform the contract we have or are trying to enter into with you.

Data transfers. Caidya is a global company with offices in the United States, the European Economic Area, China, India, South America, among other locations. As such, Caidya may transfer or provide access to your Personal Information to its subsidiary companies and affiliates, authorized service providers or collaborators or other third parties in these countries and others that may not provide the same level of protection to your Personal Information as in your country of residence. When we do so, in the absence of an adequacy decision concerning the recipient country, we rely on safeguards such as approved model contracts (for example the EU’s standard contractual clauses or the UK’s international data transfer agreement), after having carried out an assessment of the level of protection of your rights on the territory of the third country where the recipient of your Personal Information is established. For more information about Caidya’s use of the model contracts, please contact us at: [email protected].

Your Data Subject Rights. Rights you may have under the GDPR and related regulations with regards to the personal information we collect and maintain about you are described in the section YOUR CHOICES AND RIGHTS. Under the GDPR, the exercise of these rights may be limited or delayed dependent upon the legal basis for processing your Personal Information, for example:

Cookies, pixel tags, and other trackers (hereinafter “Cookies”) are small files that allow for storing or retrieving information on your browser or your device (computer, tablet, mobile, etc.) when visiting our websites. Cookies are widely used on websites, mobile applications, software, or emails. When you first visit our websites and again if you delete the Cookies or the Cookies expire or change, you will be asked which Cookies you consent to. In addition to the information below, you may read more about our Cookie Policy on our websites and in our websites’ on-line Privacy Notices.

Cookies do not recognize you personally, but rather the device you use. Cookies simply give information about your browsing activities in order to recognize the device later on in order to improve the browsing experience, save your preferences or even adapt the services offered to you on the websites. To find out more about cookies, including how to see what cookies have been set, visit www.allaboutcookies.org.

We may use the following types of cookies on our websites:

• Necessary Cookies – enable the proper functioning of the websites (security, facilitate browsing, display of the webpage). You may disable Necessary Cookies by changing your browser settings as described below. If you do so, you will still be able to navigate the websites, but some of the websites’ functions may be affected;
• Analytics Cookies – are used to collect information about how visitors use our websites and to improve the websites by collecting information on how you interact with the websites;
  • The cookies collect information in a way that does not directly identify anyone, rather they collect information in an aggregated or generalized statistical form, including the number of visitors to the website and where visitors have come to the website from and the pages they visited.
  • One of the analytic cookies we use is Google Analytics. Google’s overview of privacy practices and data safeguards is available at: https://support.google.com/analytics/answer/6004245. To opt out of being tracked by Google Analytics across all websites, visit https://tools.google.com/dlpage/gaoptout.
• Social Media Cookies – enable you to interact with social plugins on the websites and share content on social networks; and
• Advertising Cookies – enable the placement of advertisements, to measure their effectiveness and to adapt their content to your browsing and your profile.

Most web browsers allow some control of most cookies through the browser settings. For example, there are simple procedures in most browsers that allow you to delete existing cookies. If you want to set your computer or mobile web browser to reject all cookies by default, please visit the home page for your browser for instructions. If you reject all cookies, you may still use our websites; however, this may affect the functionality of some areas of our websites.

In addition, your Internet Protocol (IP) address (an identifying number that is automatically assigned to your computer by your Internet Service Provider) is identified and logged automatically in our server log files whenever you visit our websites, along with the time(s) of your visit(s) and the page(s) that you visited. We use the IP addresses of all visitors to our websites to calculate website usage levels, to help diagnose problems with the website servers, and to administer the websites.

We do not track our website users over time or across third-party websites to provide targeted advertising. At this time, we do not respond to “Do Not Track” signals from your web browser due to the lack of an established industry standard. For more information about “Do Not Track” signals, please visit https://allaboutdnt.com/.

You may contact us at any time if you have questions or concerns about this Privacy Notice or our practices. Please send an email to: [email protected].

We will endeavor to respond to your request as soon as reasonably possible in compliance with applicable laws.

To protect your privacy and security, we take reasonable steps to verify your identity before granting access to or making corrections with your Personal Information. Note that despite any requested removal of or change to your Personal Information there may be residual information that will remain within our databases and other records.

We strive to accommodate all individuals regardless of disabilities. If you need to receive the information contained in this document in a different format, please contact us at: [email protected].

We aim to regularly update this Privacy Notice to reflect our practices. Therefore, we recommend that you periodically review this Privacy Notice. In case of material changes, we may take steps to notify you before they become effective.