Effective Date: November 2, 2026

Privacy Policy – How Perceptive Protects Your Data

This Privacy Policy (the “Policy”) explains how Perceptive Informatics LLC, its subsidiaries and affiliated companies within the Perceptive group (“Perceptive”, “us,” “our,” or “we”) collect, use, disclose and otherwise process personal information when you interact with us in the circumstances described below.

This Policy applies to personal information we process about you when you:

Visit perceptive.com or another Perceptive website or online service that links to this Policy (collectively, the “Websites”)
Use a web-based Perceptive software application as an authorized user of one of our business customers (“the Applications”), to the extent Perceptive determines the purposes and means of processing your personal information.
Contact us by telephone or through our service desk functions.
Apply for employment with Perceptive.

This Policy does not apply to personal information that we process solely on behalf of, and under the instructions of, our business customers. For example, our Applications may process information relating to participants in clinical research studies conducted by or on behalf of our business customers. Where we process that information solely on behalf of a business customer, the business customer determines how the information is used and is responsible for providing applicable privacy information to the individuals concerned.

If you have questions about the handling of personal information that our business customers process using our Applications, please contact the relevant business customer directly. Where Perceptive has separately provided privacy information, has agreed to assist the business customer, or processes information for its own purposes as a controller, you may also contact us using the details in the “Contacting Us” section below.

Depending on the context, Perceptive may process personal information as a controller, where we determine the purposes and means of processing, or as a processor or service provider on behalf of our business customers. This Policy primarily describes the processing for which Perceptive determines the purposes and means.

Where we act as a processor or service provider, we process personal information only in accordance with our agreements with our business customers and their documented instructions, or as otherwise required by applicable law. Where we separately determine the purposes and means of particular processing, we act as a controller for that processing.

Who is Responsible for Your Personal Information

Perceptive operates globally through a number of legal entities. The Perceptive entity responsible for your personal information depends on how you interact with us.

When you use our Websites, the Perceptive entity that operates the relevant Website or is responsible for the relevant business activity is the controller of your personal information.

When you use a Perceptive Application on behalf of one of our business customers, the relevant Perceptive entity may act as controller for personal information relating to your account, authentication, security, support and use of the Application where Perceptive determines the purposes and means of that processing. Where Perceptive processes personal information solely on behalf of its business customers, we act as a processor or service provider, and the business customer determines how that personal information is used.

When you apply for employment with Perceptive, the Perceptive entity to which you are applying, and where applicable another Perceptive entity responsible for administering the recruitment process, is responsible for the personal information used for recruitment.

When you contact our service desk, the Perceptive entity providing the relevant service is responsible for personal information it processes for its own purposes. Where information is processed solely in providing services on behalf of a business customer, it is processed on behalf of that business customer.

Perceptive has appointed a Data Protection Officer (DPO) who oversees data protection matters across the Perceptive group. If you would like us to identify the Perceptive entity responsible for your personal information, you can contact our DPO using the details in the “Contacting Us” section below.

Which Parts of this Policy Apply to You?

The Policy covers different ways in which you may interact with Perceptive. Not every activity described in this Policy will apply to you.

Website visitors: the provisions concerning Websites, cookies, analytics, and marketing apply to you when you visit or interact with our Websites.
Application users: the provisions concerning Application User Information apply when you use a Perceptive Application as an authorized user of one of our business customers.
Job applicants: the recruitment provisions apply when you apply for employment with Perceptive.
Service desk and telephone contacts: the service desk and call recording provisions apply when you contact us by telephone or use our service desk functions.

The provisions concerning disclosure, retention, security, international transfers, your rights and how to contact us may apply in each of these circumstances.

Information We Collect About You

Website Visitors

When you use our Websites or communicate with us through them, we may collect:

Your name, email address, telephone number, and other contact details.
Your job title, employer or organization and other business information.
Information you provide when completing forms, requesting information or demonstrations, or using available communication functions.
Your marketing and communication preferences.
Device, browser, usage, and analytics information as described below.

Application Users

When you use a Perceptive Application as an authorized user of one of our business customers, we may collect:

Your name and business contact information.
Your employer or organization.
Account and registration information, including your username and other information used to authenticate or administer your account.
Information about your device, browser, and use of the Application.
Security, diagnostic and technical information.
Information you provide when requesting support or otherwise communicating with us.

This does not include personal information that Perceptive processes solely on behalf of our business customers, as described at the beginning of this Policy.

Job Applicants

When you apply for employment with Perceptive, we may collect information including:

Your name and contact information.
Your resume or CV and cover letter.
Employment, professional and education history.
Information you provide as part of your application or during the recruitment process.
Information required to assess your eligibility for a role or to meet applicable legal requirements.
Technical and behavioral information used to protect the integrity and security of our recruitment process.

Depending on the role, recruitment process, and applicable law, we may also process information subject to additional legal protection, such as information concerning health or disability, workplace adjustments, diversity or equal opportunities, or criminal convictions. We process such information only where necessary and where an applicable legal condition permits us to do so.

To help detect fraudulent, automated, or abusive job applications, we may collect and analyze technical and behavioral signals such as IP addresses, approximate location, device and browser characteristics, network-related identifiers, application timing patterns, and application activity metrics. We may use this information to generate indicators or risk scores concerning potentially suspicious or automated activity.

We do not use such indicators or risk scores as the sole basis for recruitment decisions. Where they contribute to a fraud or automation flag, the flag is reviewed by appropriate personnel before it is used in making a recruitment decision. Where provided by applicable law, individuals may also have the right to obtain information about, seek further human review of, or challenge a decision involving automated processing.

Service Desk and Telephone Contacts

When you contact us by telephone or through our service desk functions, we may collect your name, contact details, organization, service requests, support tickets, and information you provide during the interaction. Where a call is recorded, we may also collect the call recording, transcript, notes and associated information such as date, time, duration, and outcome of the interaction.

Where calls are recorded, callers are informed that recording will take place at the beginning of the call.

Information Collected Automatically / Cookies and Analytics

When you use our Websites or Applications, we may automatically collect information about your device and your interaction with the relevant service, including IP address, operating system, browser type, device characteristics, pages, or functionality accessed, referring URLs and other technical or usage information.

Cookies and Similar Technologies

Our Websites and Applications may use cookies, pixels, web beacons, and similar technologies. These technologies may be used to enable essential functionality, maintain security, remember preferences and, where permitted, understand how our Websites and Applications are used and improve their performance and user experience.

Some technologies are strictly necessary for the relevant Website or Application to operate or provide functionality you request. Other technologies, including certain analytics and user-experience technologies, will only be used where permitted by applicable law and, where required, after you have provided consent.

We may use analytics and user-experience services including Google Analytics and Hotjar. Depending on the service, your preferences and our configuration, these technologies may collect information including IP address, device and browser characteristics, approximate location, pages visited, clicks, scrolling behavior, navigation paths, and session replay or heatmap information.

Where we use session replay, heatmapping or similar functionality, we configure these technologies to avoid capturing credentials, subject identifiers, free-text fields, and other personal information that is not necessary for the relevant purpose.

You can manage non-essential cookies and similar technology preferences through the Consent Preferences control available on the relevant Website or Application. The consent controls also provide further information about the technologies in use, their purposes and, where applicable, the third parties that provide them.

Uses and Purposes for Processing Your Information

We process personal information only where we have a lawful basis for doing so under applicable data protection law. The purposes for which we process personal information, and the legal bases we rely on where applicable, depend on how you interact with us.

Context / purpose	Legal basis where applicable
Operate, maintain, and secure Websites and Applications	Legitimate interests in providing, operating, and protecting our services; performance of a contract where applicable.

Create and administer Application user accounts	Legitimate interests in administering services provided to business customers; performance of a contract where the processing is necessary for a contract with you.

Respond to enquiries and requests	Steps taken at your request before entering into a contract, where applicable; otherwise, legitimate interests in communicating with customers, potential customers, and other contacts.

Provide service desk support	Legitimate interests in providing and administering customer support; performance of a contract where the processing is necessary for a contract with you.

Record and review service desk calls	Legitimate interests in quality assurance, training, service improvement, security, complaint investigations, and verification of instructions, subject to applicable law.

Website / Application analytics and user-experience improvement	Consent where required; otherwise, legitimate interests where permitted by applicable law.

Marketing of our products and services	Consent where required; otherwise, legitimate interests where permitted by applicable law.

Recruitment and assessment of job applications	Taking steps before entering an employment contract; legitimate interests in recruitment and workforce management; compliance with legal obligations where applicable.

Recruitment fraud prevention	Legitimate interests in detecting fraud, protecting recruitment systems, and maintaining the integrity of recruitment activities.

Information and system security	Legitimate interests in protecting Perceptive, its customers, users, systems, and information; compliance with legal obligations where applicable.

Establishing, exercising, and defending legal rights	Legitimate interests in protecting our legal rights; compliance with legal obligations where applicable.

Complying with law and regulatory requirements	Compliance with applicable legal obligations.

Corporate transactions	Legitimate interests in managing and undertaking legitimate corporate transactions.

Where we rely on legitimate interests, we consider whether the processing is necessary for our legitimate interests and balance those against the interests, rights, and freedoms of affected individuals. Where processing requires consent, you may withdraw that consent as described in the “Your Rights and Choices” section below.

Disclosure of Your Information

We may disclose personal information, where necessary for the purposes described in this Policy too:

Perceptive group companies, where they support or are involved in the relevant processing activity.
Our business customers, where information concerns an authorized Application user or where the customer is responsible for responding to a request concerning personal information it controls.
Service providers, including providers of hosting, analytics, recruitment technology, security and fraud prevention, customer support, service desk, telephony, and call recording services.
Professional advisers, including legal, audit and other professional advisers, as necessary.
Public authorities, regulators, courts, and law enforcement, where disclosure is required or permitted by applicable law or necessary to protect legal rights.
Parties to a corporate transaction, including an actual or prospective buyer, seller, investor, successor, or adviser involved in a merger, acquisition, restructuring, financing or sale of a business or assets.
Other recipients where you have requested or authorized disclosure.

Where a recipient processes personal information on our behalf, we require appropriate contractual, confidentiality and data protection protections. Some recipients may process personal information as independent controllers where they determine their own purposes and means of processing.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or subsequently lawfully processed. The retention period will depend on the nature of the information and processing and may take account of:

The duration of our relationship or interaction with you or the relevant business customer.
How long an account, Application or service remains active.
Applicable legal, regulatory, and contractual requirements.
Applicable limitation periods and the need to establish, exercise or defend legal claims.
Security, fraud prevention, and audit requirements.
Our approved records retention requirements.

Different retention periods therefore apply to different categories of information, including Website enquiries, Application user records, recruitment information, security logs, service desk tickets, and call recordings.

Personal information may also remain in secure backup, archive, disaster recovery, business continuity, or system restoration environments for a limited period after it has been deleted from active systems. We maintain appropriate controls to protect information held in such environments and will delete or overwrite it in accordance with our applicable retention and backup practices.

Data Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration.

Access to personal information is restricted according to business needs and subject to appropriate confidentiality and security requirements.

We maintain procedures to detect, investigate, and respond to security incidents involving personal information and will provide notifications where required by applicable law.

Your Rights and Choices

Depending on where you are located and the laws that apply to the processing of your personal information, you may have rights to:

Access personal information we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of your personal information.
Restrict or object to particular processing.
Receive or request transfer of certain personal information.
Withdraw consent where processing is based on consent.
Object to direct marketing.
Seek human intervention or challenge certain decisions involving automated processing, where applicable.

These rights may be subject to conditions or exceptions under applicable law.

You can exercise applicable rights by contacting us using the details in the “Contacting Us” section. We may need to verify your identity before fulfilling a request and may request additional information where reasonably necessary to do so.

You may manage your preferences for non-essential cookies and similar technologies through the Consent Preferences control available on the relevant Website or Application. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Third-party Links

Our Websites and Applications may contain links to websites, applications or services operated by third parties. Their processing of personal information is governed by their own privacy practices and not this Policy. We encourage you to review their privacy information before providing personal information to them.

International Transfers

Perceptive operates internationally. As a result, your personal information may be transferred to, accessed from, or processed in countries other than the country in which it was collected. Data protection laws may differ between countries.

Where applicable law restricts international transfers of personal information, we use an appropriate transfer mechanism or other safeguard required or recognized by that law.

For personal information protected by EEA, UK, or Swiss data protection law, this may include an adequacy decision, the European Commission’s Standard Contractual Clauses, an applicable UK international data transfer mechanism, or other legally recognized safeguards. Where required, we undertake relevant transfer assessments and implement supplementary measures.

You may contact our DPO for further information about safeguards applicable to an international transfer of your personal information, including how to obtain information about those safeguards where this is available under applicable law.

Additional requirements relating to transfers from particular jurisdictions are described below.

Additional Information for Individuals Located in the EEA, UK, and Switzerland

Where EEA, UK or Swiss data protection law applies to the processing of your personal information, the rights described in the “Your Rights and Choices” section apply subject to the conditions and exceptions provided by applicable law.

You may also have the right to lodge a complaint with the data protection supervisory authority responsible for your location or the relevant processing. You may contact us or our DPO before making a complaint if you would like us to investigate your concern, but this does not affect your right to contact a supervisory authority.

Additional Information for Individuals Located in the People’s Republic of China

This section applies only to individuals located in the PRC and provides additional information with respect to how we process personal information collected from such individuals (“PRC Personal Information”) in line with the privacy and cybersecurity laws, regulations and measures of the PRC, as amended, replaced or superseded from time to time, including the Personal Information Protection Law (“PIPL”).

PRC Personal Information We Collect

The types of Personal Information we collect from individuals located in the PRC are described in the “Information We Collect About You” section above.

Purposes for Which We Use PRC Personal Information

We process PRC Personal Information for the purposes described in the “Uses and Purposes of Processing Your Information” section above and in accordance with a lawful basis available under applicable PRC law.

Disclosures of PRC Personal Information

We may disclose PRC Personal Information to the parties listed in the “Disclosure of Your Information” section above. Where required by applicable PRC law, before providing PRC Personal Information to another personal information processor, we will provide the information required by applicable law and obtain separate consent where required.

Transfers of PRC Personal Information

We may transfer PRC Personal Information to recipients outside the PRC where permitted by applicable law. Where required, we will provide additional information before the transfer takes place, including information concerning the overseas recipient, the personal information transferred, the purposes and methods of processing and how you may exercise applicable rights in relation to the overseas recipient. Where separate consent to an international transfer is required by applicable law, we will request that consent separately.

PRC Personal Information Rights and Choices

If you are located in the PRC, you may have rights in relation to your personal information under applicable PRC law, including rights to know about, decide on, restrict or refuse certain processing; access or obtain a copy of personal information; correct or supplement inaccurate or incomplete information; and request deletion in circumstances provided by applicable law. Other rights may apply in accordance with applicable law.

Where you have consented to the processing of your personal information, you have the right to withdraw your prior consent at any time. Subject to applicable law, you also have the right to request that your personal information be transmitted to another company where it is technically feasible. You may exercise these rights, if applicable, or contact our Data Protection Officer, by contacting us as described in the “Contacting Us” section of this Policy. You may lodge a complaint with the relevant supervisory authorities if you are not satisfied with our response to your request.

Where we process sensitive personal information relating to individuals located in the PRC, we will do so only for a specific purpose, where there is sufficient necessity, and subject to the additional safeguards required by applicable law. Where required, we will provide additional information about the necessity of the processing and its impact on your rights and interests and obtain separate consent.

Additional Information for Residents of California

If you are a California resident, our California Consumer Privacy Statement provides additional information concerning our processing of personal information and your rights under applicable California privacy law. The California Consumer Privacy Statement supplements this Policy and applies to processing within its scope. Where its provisions conflict with this Policy, the California Consumer Privacy Statement applies to the relevant processing.

The California Consumer Privacy Statement is available here.

Additional Information for Individuals Located in India

Where, and to the extent that, India’s Digital Personal Data Protection Act, 2023 and applicable implementing rules are in force and apply to our processing, we will process personal data in accordance with their applicable requirements.

Individuals may contact privacy@perceptive.com to exercise applicable rights or raise a grievance. We will handle grievances through our privacy complaints process and respond within the period required by applicable law. Where required, individuals may escalate unresolved grievances to the Data Protection Board of India after using our internal grievance mechanism. Where India-specific transfer restrictions or additional safeguards apply, we will implement them before the relevant processing or transfer takes place.

Changes to this Policy

We may update this Policy from time to time to reflect changes to our processing activities, services, or applicable legal requirements. When we make changes, we will update the Effective Date shown at the beginning of this Policy. Where required by applicable law, or where changes materially affect how we process personal information, we will provide additional notice before the relevant changes take effect.

Contacting Us

If you have any questions about this Policy or our processing of personal information, wish to exercise an applicable data protection right, or wish to raise a privacy concern or complaint, you may contact our DPO at privacy@perceptive.com or by mail at either of the following addresses;

Data Protection Officer, Perceptive Informatics, LLC, 55 Blue Sky Drive, Burlington, MA 01803
Data Protection Officer, Perceptive, Part Fourth Floor, East West, Tollhouse Hill, Nottingham, NG1 5FS, United Kingdom

If you have a concern or complaint about our handling of your personal information, we will investigate it and respond in accordance with applicable law. You may also have the right to lodge a complaint with a relevant data protection or regulatory authority.