Certitude Disclaimers

Transparency matters. Review the test disclaimers, intended use, and performance notes that guide how Certitude should be used in clinical settings.

Last Updated: August 2026

1. SCOPE AND APPLICABILITY

This Website Privacy Notice (this "Privacy Notice") explains what information Astrin Biosciences ("Company," "we," "our," or "us") collects about you when you visit our website certitudetest.com and related online services (the "Website"), how we use this information, with whom we share it, how long we retain it, and the privacy rights and choices available to you.

For purposes of this Privacy Notice, "personal information" (also referred to as "personal data" in some laws) means information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable individual, as further described in Section 2 below.

This Privacy Notice applies to our Website and does not cover:

Personal health information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA), which is subject to a separate Notice of Privacy Practices if applicable;
De-identified or aggregated data from clinical studies, registries, or research activities;
Information collected through separate healthcare provider portals or clinical data management systems;
Employee, contractor, or workforce data, governed by separate privacy notices;
Business-to-business vendor and partner data, subject to separate data processing agreements and privacy terms.

If you have questions about data handling under any of these separate regimes, please contact us at the information provided in the CONTACT US section below.

2. INFORMATION WE COLLECT

We collect personal information directly from you and automatically through your use of the Website. Below is a summary of the categories and sources of information we gather.

2.1 Information You Provide Directly

You may choose to share personal information with us when you contact us, submit a form, or send us feedback, questions, comments, suggestions, or ideas. When you do, we typically collect:

Identifiers: name, email address, telephone number
Professional/Employment Information: institution or company name, professional title or role, department
Message Content: the substance of your inquiry, feedback, or communication

How We Use Your Provided Information:

Respond to your inquiries or requests
Provide information about Company products or services
Send you marketing information or educational content you request
Maintain records of our communications with you

2.2 Information Collected Automatically

Our Website automatically collects certain information about your device and interaction with the Website through cookies, pixels, and similar tracking technologies. This information includes:

Categories of Collected Data

Internet Activity: browsing history and pages visited on our Website, frequency and duration of visits, time of day you access the Website, links clicked, search queries entered, referring website details
Geolocation: your approximate geographic location inferred from your Internet Protocol (IP) address; we do not collect precise geolocation on the Website
Device Information: hardware model, operating system, browser type and version, browser language preferences, device identifiers
Cookies and Tracking Technologies: analytical cookies, session identifiers, and any non-essential cookies for which you have provided consent

Some or all of the above information may be classified as "personal data" or "personal information" under the privacy laws of your state of residence, including Minnesota and other U.S. states. For more detail on how these laws apply and your rights, see State-Specific Privacy Rights and Notices below.

Types of Cookies

We use the following categories of cookies and similar technologies on our Website:

Strictly Necessary Cookies: Required for core Website functions (authentication, security, form submission). These cookies are always active and do not require your consent.
Analytical Cookies: Allow us to count visitors, understand how users interact with the Website, identify popular pages, and diagnose technical issues. These help us improve the Website experience.
Marketing and Advertising Cookies: If used, these track your activity across multiple websites to enable targeted advertising. We will only deploy such cookies with your prior consent.
Third-Party Cookies: Placed by social media platforms, analytics providers, or advertising networks when you interact with embedded content or functionality.

Analytics Tools

Our Website uses Ours Privacy to understand user behavior and improve site performance. Ours Privacy collects analytics on our behalf as our service provider, and it is the only analytics provider we use. We do not use Google Analytics. Analytics collection does not begin until you accept analytical cookies, and advertising conversions are shared with advertising partners only after you separately accept marketing and advertising cookies.

The cookies this involves are:

Cookie	Purpose	Retention
`ctd_consent_v1`	Records the privacy choices you made, so we can honor them on later visits and prove which choices were in effect. Strictly necessary.	180 days
`ctd_pending_attr`	Temporarily records allowlisted campaign and referring-link details while your privacy choice is pending. It does not start analytics or send these details to Ours Privacy or advertising platforms.	30 minutes
`ctd_attr`	Records which campaign or referring link first brought you to the Website, so we can measure which campaigns work. Set only after you accept analytical or marketing cookies.	90 days
`ours_device_id`	An anonymous identifier Ours Privacy uses to recognize your browser across pages of the Website. Set only after you accept analytical or marketing cookies.	Set and retained by Ours Privacy

If you wish to prevent your data from being used for analytics, you can:

Choose "Reject optional" in our cookie banner, or change your choices at any time through the "Privacy Choices" link in the Website footer
Enable Global Privacy Control in a browser or extension that supports it, which we honor automatically as an opt-out of both analytics and advertising
Adjust your browser settings to refuse all cookies or alert you when cookies are being set
Use your device's built-in privacy settings or privacy-focused browsing modes

Note: If you disable analytics cookies, some Website features may not function optimally, and we may be unable to monitor and improve the Website experience. We may use additional or different analytics and tracking tools in the future. If so, we will update this Privacy Notice accordingly. Our use of cookies, pixels, and technologies may constitute "targeted advertising," "profiling," or "processing" of personal data under state privacy laws, including Minnesota law. Where required, we accept browser-based opt-out mechanisms (such as Global Privacy Control) or other methods to help you exercise these choices as described in Section 6 below.

2.3 Sensitive Personal Information

Our Website does not intentionally collect sensitive personal information such as:

Precise geolocation
Social security numbers or government identifiers
Biometric data
Health or medical information (except general professional background)
Financial account numbers
Racial, ethnic, religious, or political affiliations
Sexual orientation or gender identity

If sensitive information is accidentally disclosed in a message or form submission, we will handle it consistent with the requirements of applicable state privacy laws and will contact you to discuss appropriate safeguards.

To the extent any state law, including Minnesota law, defines "sensitive" personal information or "sensitive data," we do not knowingly collect or use such categories of information through this Website, and we do not process Website data for automated profiling that produces legal or similarly significant effects.

3. HOW WE USE YOUR INFORMATION

We use the personal information we collect about you for the following purposes:

Respond to your inquiries, requests, or feedback
Provide information about Company's products, services, or offerings
Send you marketing communications, newsletters, or educational content (with appropriate consent or opt-out rights)
Conduct data analytics and research to improve our Website and services
Communicate with you about changes to our Website or this Privacy Notice
Maintain and improve the functionality, security, and performance of our Website
Diagnose Website problems, monitor user experience, and prevent fraud or misuse
Defend our legal rights and comply with legal obligations
Efficiently maintain our business operations
Comply with applicable law, including requirements in healthcare and medical devices
Where permitted by law and consistent with your choices, use limited Website usage information for targeted or interest-based advertising and to measure the effectiveness of our marketing campaigns

Legal Basis for Processing: Where required by law we rely on:

Your consent (when you provide information or opt into communications)
Legitimate business interests (improving our Website, marketing, analytics, fraud prevention)
Contract performance (delivering requested information or services)
Legal obligation (compliance with law, healthcare regulation, or enforcement requests)

4. HOW WE SHARE YOUR INFORMATION

We share your personal information only for the purposes disclosed in this Privacy Notice and only with the categories of recipients described below.

4.1 Service Providers and Vendors

We may share personal information with service providers and vendors who assist us in operating the Website, marketing our services, or managing our business. These include:

Web hosting and infrastructure providers
Analytics and customer data platforms (Ours Privacy)
Email marketing and customer relationship management (CRM) platforms
IT support and security providers

All service providers are contractually obligated to:

Use your information only for the purposes we specify
Implement adequate security measures
Not disclose your information to others without our permission
Return or delete your information upon request

We do not authorize our service providers to use your personal information for their own independent purposes, other than as necessary to provide services to us or comply with their own legal obligations.

4.2 Legal Obligations and Protection

We may share personal information if we believe, in good faith, that:

It is necessary to comply with applicable law, court orders, or legal process (including subpoenas, search warrants, or regulatory requests)
It is required for law enforcement, national security, or government agency purposes
It is necessary to detect, investigate, prevent, or take action against illegal activities, fraud, breach of contract, or violation of terms of service
It is necessary to protect the rights, property, safety, or security of Company, you, other users, or the public
It is required to enforce this Privacy Notice, our terms of service, or other contracts

When we receive a law enforcement or government request, we will:

Verify the legitimacy and proper authorization of the request
Disclose only the minimum information necessary
Notify you of the request where legally permitted to do so

4.4 With Your Consent

We may share your personal information for purposes other than those listed above if we first request your permission. We will clearly inform you of the proposed use, recipient, and manner of sharing before doing so. You will have the opportunity to decline.

4.5 Aggregated and De-Identified Information

We may share aggregated, de-identified, or anonymized information that does not identify you personally with third parties for analytics, or other business purposes without restriction.

5. DATA RETENTION

We retain your personal information for as long as necessary to accomplish the purposes for which it was collected, unless a longer retention period is required by law or we are subject to a legal hold.

Typical Retention Practices:

Contact Information and Inquiry Records: Retained for at least 3-5 years to respond to follow-up requests and maintain business records, unless longer retention is legally required
Marketing List Information: Retained as long as you remain an active subscriber; deleted upon unsubscribe request within 30 days
Website Analytics and Log Data: Automatically aggregated and typically retained for 12-24 months before de-identification or deletion
Communications and Support Records: Retained consistent with our document retention policies, typically 3-6 years

These retention periods are designed to be no longer than reasonably necessary for the purposes described in this Privacy Notice or as required by applicable law, including Minnesota law. If you request deletion of your personal information, we will do so within applicable timeframes (see YOUR PRIVACY RIGHTS section below), subject to exceptions for legal holds, litigation, regulatory requirements, or ongoing business purposes.

6. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you live, you may have certain rights regarding your personal information. We are committed to honoring these rights to the extent required by applicable law.

6.1 General Privacy Rights

Under applicable state and international privacy laws, you may have the right to:

Access: Request what personal information we hold about you
Correction/Rectification: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal information (subject to exceptions)
Data Portability: Receive a copy of your information in a structured, portable format
Opt-Out of Targeted Advertising: Request that we not use your information for targeted or cross-context behavioral advertising
Opt-Out of Sale or Sharing: Request that we not sell or share your personal information (if such activity exists)
Limit Use of Sensitive Information: Request that we limit our use of sensitive personal information to necessary business purposes

6.2 How to Submit a Privacy Request

To exercise any of these rights, please submit a written request to:

Email: inquiries@astrinbio.com

Mail: Astrin Biosciences, Privacy Team, 1000 Westgate Drive, Suite 1009, St. Paul, MN 55114

In Your Request, Please Provide:

Your full name and email address
A clear description of the information you seek (e.g., "access to all personal information you hold," "delete my contact information," "opt out of marketing emails")
Any additional details that help us locate your records
A statement that you understand the request is made under applicable privacy law

We will:

Acknowledge receipt of your request within 10 business days
Make reasonable efforts to respond within 45 days of receipt (or within timeframes specified by applicable state law)
Provide responses in the format you requested, where feasible
Extend the deadline by up to 45 additional days if your request is complex, with notice of the extension
Not charge a fee unless the request is manifestly unfounded, repetitive, or excessive

We may decline or limit your request if:

We cannot verify your identity with reasonable certainty
The request is frivolous, repetitive, or overly burdensome
Fulfillment would violate another person's privacy rights
Disclosure is prohibited by law or we have a legal obligation to retain the information
The information is not personal information or falls outside our control

6.3 Verification of Identity

To protect your privacy, we will verify your identity before responding to access, deletion, or other sensitive requests. Verification may include:

Confirming the email address or phone number on file
Requesting a signed affidavit under penalty of perjury (for sensitive requests)
Using third-party identity verification services if appropriate

Authorized representatives (such as a parent or legal guardian) may submit requests on your behalf and will be asked to provide evidence of authorization.

6.4 Appeal Process

If we deny your privacy request, we will:

Provide you with a clear reason for the denial
Explain any exceptions under law that apply
Inform you of your right to appeal within 45 days of receiving the denial
Provide instructions on how to submit an appeal

To Appeal:

Send an appeal letter to inquiries@astrinbio.com with:

Your original request and our denial letter
A clear explanation of why you believe the denial was incorrect
Any additional information supporting your position

We will review your appeal and respond within 45 days. If the appeal is denied, you may also file a complaint with your state attorney general or relevant privacy regulator.

6.5 Marketing Communications

Email Marketing:

You may opt out of promotional emails, newsletters, or marketing communications by:

Clicking the "Unsubscribe" link at the bottom of any marketing email
Replying to a marketing email with "UNSUBSCRIBE"
Contacting us at inquiries@astrinbio.com and requesting removal from marketing lists

We will process opt-out requests within 30 days. Please note that we will continue to send you:

Administrative notices (changes to this Privacy Notice, Website changes)
Legally required communications

Do Not Track Signals:

Some browsers include a "Do Not Track" (DNT) feature. We do not currently respond to DNT browser signals. However, you can control cookies and tracking through your browser settings as described in Section 6.6 below.

6.6 Cookie and Tracking Technology Preferences

Manage Cookies:

Session Cookies: These automatically expire when you close your browser and do not require action to remove them.
Persistent Cookies: You can remove persistent cookies by following your browser's instructions:

Global Opt-Out Tools:

Use the "Privacy Choices" link in the Website footer to withdraw analytics or advertising consent at any time
Use the Digital Advertising Alliance (DAA) Opt-Out Tool or Your Ad Choices to opt out of advertising from members
Enable privacy browsing modes offered by your browser

Global Privacy Control:

Where required by applicable law, we recognize the Global Privacy Control (GPC) as a browser or device-level signal indicating your preference to opt out of certain types of tracking or targeted advertising. If you enable GPC, your preferences will apply only to the browser or device you are using to interact with our Website and not to other devices or browsers. If you use another browser or device, you may need to enable GPC to have your preferences recognized in connection with that browser or device.

Impact of Opting Out:

If you reject all cookies or opt out of analytics:

The Website will continue to function for basic purposes
Some interactive features may not work optimally
We will not be able to monitor Website performance or recognize you on return visits
If you clear cookies, you will need to re-customize your preferences

7. STATE-SPECIFIC PRIVACY RIGHTS AND NOTICES

Residents of certain U.S. states have additional privacy rights under state law. Below are state-specific disclosures and instructions.

7.1 California Residents (CCPA / CPRA)

Applicability: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply if you are a California resident.

Your Rights Under CCPA/CPRA:

Right to Know: You have the right to request what categories and specific pieces of personal information we collect, the sources, our business purposes, and to whom we disclose it.
Right to Delete: You have the right to request deletion of personal information we collect, subject to exceptions (e.g., information needed to complete transactions or comply with legal obligations).
Right to Correct: You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: You have the right to direct us not to sell or share your personal information for cross-context behavioral advertising. Company currently does not sell or share personal information for these purposes; however, you may submit an opt-out request to preserve this right.
Right to Opt-Out of Targeted Advertising: You have the right to opt out of our use of your information for targeted or interest-based advertising.
Right to Limit Use of Sensitive Personal Information: You have the right to request that we limit our use of sensitive personal information to necessary business purposes.
Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA right.

7.2 Minnesota Residents (Minnesota Consumer Data Privacy Act)

Applicability: The Minnesota Consumer Data Privacy Act (MCDPA), effective July 31, 2025, applies if you are a Minnesota resident.

Your Rights Under MCDPA:

Right to Access: You have the right to request confirmation of whether we process your personal information and, if so, request access to a copy of your personal information.
Right to Deletion: You have the right to request deletion of your personal information, subject to exceptions for information needed to complete transactions, comply with legal obligations, or maintain reasonable security.
Right to Correction: You have the right to request that we correct inaccurate personal information.
Right to Data Portability: You have the right to request your personal information in a structured, machine-readable format and to have it transmitted to another controller where feasible.
Right to Opt-Out of Targeted Advertising: You have the right to opt out of our use of your personal information for targeted advertising.
Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising purposes.
Right to Opt-Out of Profiling: You have the right to opt out of our use of your personal information for profiling activities that produce legal or similarly significant effects.
Right to Non-Discrimination: We will not discriminate against you for exercising any MCDPA right, including by denying goods or services, providing different prices or service levels, or imposing penalties.

How to Submit Requests:

Minnesota residents may submit privacy requests by:

Email: inquiries@astrinbio.com
Mail: Astrin Biosciences, Privacy Team, 1000 Westgate Drive, Suite 1009, St. Paul, MN 55114

In your request, please provide:

Your full name and email address
A clear description of your request
Any additional information that helps us locate your records

We will acknowledge receipt of your request within 10 business days and respond within 45 days (or up to 90 days if the request is complex).

Appeal Process:

If we deny your request, we will provide a written explanation of the denial, including the specific reasons and applicable legal exceptions. You may appeal our denial within 45 days by submitting a appeal to inquiries@astrinbio.com with the subject "APPEAL - Privacy Request Denial." We will review your appeal and respond within 30 days. If you remain dissatisfied after our review, you may file a complaint with the Minnesota Attorney General's Consumer Protection Division.

More Information:

For additional information about Minnesota's consumer privacy law, visit the Minnesota Attorney General's Website.

7.6 Other U.S. State Residents

The privacy laws of other U.S. states may also provide residents with rights to:

Confirm whether we process your personal information
Access, correct, and delete your personal information
Receive your personal information in a portable format
Opt out of the sale, sharing, or targeted use of personal information
Opt out of automated decision-making or profiling that produces legal or similarly significant effects

To exercise any of these rights, please contact us at inquiries@astrinbio.com. We will respond to your request in accordance with applicable state law. If your request is denied, you may appeal as described in Section 6.4 above, or file a complaint with your state's attorney general or privacy regulator.

8. DATA SECURITY

8.1 Security Measures

We implement and maintain industry-standard, commercially reasonable administrative, technical, and physical security measures to protect your personal information against unauthorized access, disclosure, alteration, destruction, and other security risks. These measures include:

Access Controls: Limiting access to personal information to authorized personnel and contractors with a legitimate business need.
Encryption: Using encryption protocols (e.g., TLS/SSL) to protect data in transit between your device and our Website.
Authentication: Using passwords, multi-factor authentication, and session management to control access to accounts and systems.
Vendor Management: Requiring service providers to implement appropriate security measures and maintain compliance with data protection obligations.
Security Monitoring: Monitoring for unauthorized access and conducting regular security assessments and penetration testing.
Incident Response: Maintaining incident response procedures to detect, investigate, and remediate security breaches or unauthorized access.

8.2 Limitations and No Absolute Security Guarantee

No security measure is 100% secure. While we strive to protect your information, we cannot and do not guarantee absolute security. Unauthorized individuals may still gain access through hacking, social engineering, or other means beyond our control. By using the Website, you acknowledge this risk and agree that we are not responsible for unauthorized access or misuse of information resulting from factors outside our reasonable control.

8.3 Breach Notification

If a security breach compromises your personal information, we will notify affected individuals:

Without unreasonable delay
By email or other appropriate means
To the extent required by applicable law, including Minnesota breach notification laws
With information about the nature of the breach, steps being taken, and measures you can take to protect yourself

9. AGE RESTRICTIONS AND CHILDREN

The Website and services offered thereon are intended for professional healthcare providers, medical professionals, patients and other business and clinical audiences. The Website is not intended for, and we do not knowingly collect personal information from, individuals under the age of 18 years.

10. THIRD-PARTY LINKS AND WEBSITES

Our Website may contain links to third-party websites, applications, services, and resources that are not operated by Company. This Privacy Notice applies only to Company's Website and not to any linked third-party sites or services.

We are not responsible for:

The privacy practices of third-party websites or services
The content, accuracy, or security of third-party websites
Any losses or damages resulting from your use of third-party links or services

Before using a third-party website or service, review its privacy notice and terms of use. We recommend that you carefully review the privacy policies of any third-party sites you visit.

11. CHANGES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Changes We May Make:

Updates to data categories or retention periods as business practices evolve
Clarifications to our use of analytics tools or third-party services
Expansion to cover new state privacy laws or regulations
Adjustments to user rights or choices in response to legal changes

How We Notify You:

We will post the updated Privacy Notice on our Website and update the "Last Updated" date at the top of this document.
For material changes that meaningfully affect your privacy rights or our practices (e.g., new uses of data, new categories of recipients, material reductions in privacy protections), we will provide prominent notice on the Website or send you an email notification.
Your continued use of the Website following notice of changes constitutes your acceptance of the updated Privacy Notice. If you do not agree with the changes, you may discontinue using the Website.

We encourage you to review this Privacy Notice periodically to stay informed of how we are protecting your information.

12. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Notice or our privacy practices, please contact us:

General Inquiries:

Email: inquiries@astrinbio.com
Mail: Astrin Biosciences, Attention: 1000 Westgate Drive, Suite 1009, St. Paul, MN 55114

Privacy Rights Requests (CCPA/CPRA):

Email: inquiries@astrinbio.com

13. DISPUTE RESOLUTION AND GOVERNING LAW

This Privacy Notice is governed by the laws of the State of Minnesota, without regard to conflicts of law principles. Any disputes arising from this Privacy Notice shall be resolved in accordance with the terms of service for the Website (if applicable) or, if no alternative dispute resolution mechanism applies, in the courts located in the State of Minnesota.