Privacy Policy

Part I: Privacy Policy#

1. Introduction#

Plinthos Holdings LLC, a Florida limited liability company doing business as “Acrova” (“Acrova,” “we,” “us,” or “our”), provides a business-to-business software platform that helps clinical-research organizations, including study sponsors, contract research organizations (“CROs”), research sites, and recruitment teams, convert study protocols and public study records into organized study facts and draft participant-recruitment materials for their own review, revision, approval, and export (the “Platform”).

This Privacy Policy, which includes information about cookies in Section 6 and supplemental state notices in Annexes A through C, describes how we collect, use, disclose, and protect personal information when you:

• visit our websites, including www.acrova.ai, and any pages that link to this Privacy Policy (collectively, the “Site”);
• register for or use the Platform as an authorized user of one of our business customers (each, a “Customer”);
• communicate with us or receive our communications, including sales, support, and marketing communications; or
• interact with us at demonstrations, webinars, or events.

We refer to the Site and the Platform together as the “Services.” “Personal information” means information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual. This Privacy Policy is incorporated into and forms part of our Terms of Use. If you do not agree with this Privacy Policy, please do not use the Services.

2. Important Scope Notice: A Business Platform Not Directed to Patients or Study Participants#

The Services are offered for business use only. In its current phase, the Platform helps Customer personnel organize study-level information and prepare draft recruitment materials. The Platform does not include participant-recruitment operations: Acrova does not collect participant records, conduct live pre-screening, communicate with prospective participants, determine eligibility, or process protected health information.

• Not directed to participants. The Services are not intended for use by patients, study participants, or prospective participants, and we do not knowingly collect personal information from them. If you are a patient or prospective study participant, please direct questions about a study to the study team identified in the study’s own materials, which are governed by the sponsor’s or site’s separate notices and consents, not by this Privacy Policy.
• No protected health information. Customers and their authorized users are contractually prohibited from uploading patient records, participant-identifiable information, or other protected health information (“PHI”) to the Platform. If we become aware that information was submitted in violation of this prohibition, we will promptly notify the Customer and delete or return the information in accordance with our customer agreements.
• HIPAA status. Acrova is not a health plan, health-care clearinghouse, or health-care provider, and is not a “covered entity” as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA,” 45 C.F.R. § 160.103). Because the Services are not designed or offered to create, receive, maintain, or transmit PHI on behalf of covered entities, Acrova does not act as a HIPAA “business associate” in providing the Services described in this Privacy Policy.
• Study protocols are study-level documents. Protocols and public study records processed on the Platform may contain study objectives, eligibility criteria, visit schedules, procedures, sponsor and site information, and professional contact information for study personnel. They are not intended to contain information about identifiable patients or prospective participants.
• Future functionality. If Acrova later offers participant-facing functionality, such as inquiry forms, health-related screening, messaging, scheduling, or site routing, we will first conduct a separate legal and privacy review and will provide the appropriate participant notices, consents, contracts, and safeguards before any such feature is activated. Any such processing would be governed by separate or updated notices, not by this Privacy Policy as currently written.

3. Personal Information We Collect#

We collect personal information in three ways: directly from you, automatically when you visit or use the Services, and from other sources.

3.1 Information You Provide to Us#

• Contact details. Name, work email address, company, role, and the contents of your message, provided when you submit our demo-request form, contact sales, subscribe to updates, register for a webinar or event, or otherwise communicate with us. Please do not include sensitive personal details in free-text message fields.
• Account and profile information. Name, business email address, job title, organization, workspace role and permissions, login credentials, and optional profile details, provided when you or your organization registers you for the Platform.
• Billing information. Billing contact details, billing address, and transaction records, including for consulting and professional-services engagements billed by invoice or ACH. Payment-card details for self-service purchases are collected and processed directly by our third-party payment processor; we do not store full payment-card numbers.
• Support, feedback, and survey information. Support requests, revision feedback and approvals submitted through the Platform, survey responses, and related correspondence.

3.2 Visitor Information We Collect Automatically#

When you visit the Site or use the Platform, we and our service providers automatically collect device, usage, and log information, such as IP address, browser type and version, operating system, device identifiers, the pages and features you view or use, links clicked, referring and exit pages, date and time stamps, error and diagnostic data, and approximate (city-level) location inferred from your IP address. Our basic website analytics are cookieless and measure Site usage in aggregate. If you accept optional cookies, Meta Pixel may also receive limited information about visits to our public business website, including page URL, referral information, browser and device information, IP address, Meta cookie identifiers, and whether a demo-request form was completed. We do not place the Meta Pixel in the customer review workspace, on patient-recruitment landing pages, or in Customer Content. Section 6 explains the technology and your choices.

3.3 Information from Other Sources#

• Public sources. Public study records, such as records published on ClinicalTrials.gov, which may include the names and professional contact information of sponsor and site personnel associated with a study.
• Your organization. A Customer administrator may provide your name, business contact information, and role to provision and manage your account.
• Service providers and business partners. Our service providers and event co-hosts. We do not purchase marketing contact lists.

3.4 Information We Ask You Not to Submit#

The Services are not designed to collect sensitive personal information from or about individuals (such as government identifiers, precise geolocation, biometric identifiers, or information about health, race or ethnicity, religion, or sexual orientation), and we ask that you not submit such information to the Site or the Platform. Section 2 describes our prohibition on uploading PHI and participant-identifiable information, and Annex B addresses consumer health data.

4. Customer Content and Our Role as a Service Provider#

“Customer Content” means the materials that Customers and their authorized users submit to or generate on the Platform, including uploaded study protocols, imported public study records, campaign instructions, generated draft copy and imagery, revision feedback and approvals, exported materials, and associated operational logs.

Customer Content submitted to the Services is processed under our customer agreements; this Privacy Policy does not apply to it. We use Customer Content only to provide the Services to the Customer. To the extent Customer Content includes personal information (for example, the professional contact information of study personnel appearing in a protocol), Acrova processes that information as a service provider or processor for the Customer, and the Customer is responsible for it as the controller or business. If you have questions or requests about Customer Content, including requests to access, correct, or delete personal information contained in it, please contact the relevant Customer; we will support the Customer’s response as required by our agreements and applicable law.

This Privacy Policy governs the website and the people on it (Site visitors, demo-form submissions, prospective customers, and account holders), along with the related marketing, billing, and support data for which Acrova determines the purposes and means of processing. If this Privacy Policy conflicts with a customer agreement with respect to Customer Content, the customer agreement controls.

5. How We Use Personal Information#

We collect and process personal information for the following purposes:

• To provide and operate the Services. Authenticate users, provision and administer accounts and workspaces, process Customer Content at the Customer’s direction, generate and export draft study facts and campaign materials, and provide technical support.
• To administer billing and our business. Process transactions, maintain records, and manage our relationships with Customers and vendors.
• To communicate with you. Respond to inquiries and support requests and send administrative and transactional messages, such as service, security, and billing notices.
• To improve and develop the Services. Analyze usage, troubleshoot, test features, and understand how the Services perform, including through the analytics described in Section 6.
• To measure our marketing. If you accept optional cookies, measure visits to our public business website and completed demo-request forms so we can understand which Acrova marketing produces business inquiries.
• For marketing. Send newsletters, product updates, and event invitations to business contacts, consistent with applicable law, including the CAN-SPAM Act. You may opt out of marketing communications at any time, as described in Section 11. We do not use study-personnel contact information obtained from protocols or public study records for our own marketing or unsolicited outreach.
• For security and fraud prevention. Monitor for, detect, investigate, and prevent fraudulent, unauthorized, or unlawful activity and misuse of the Services, and enforce our agreements.
• For legal compliance. Comply with applicable laws and lawful requests, respond to legal process, and establish, exercise, or defend legal claims.
• With your consent or as otherwise disclosed to you at the time of collection.

De-identified and aggregated data. We may create de-identified or aggregated data, such as usage statistics, and use it for lawful business purposes. Where we maintain de-identified data, we commit to maintaining it in de-identified form, will not attempt to re-identify it except as permitted by law to test de-identification, and will contractually require recipients to do the same.

6. Cookies and Similar Tracking Technologies#

Acrova uses cookies and similar technologies on its public website and software platform. Some are necessary to provide the Services. Others are optional and remain off unless you select “Accept all.”

6.1 Technologies We Use#

• Essential cookies and browser storage. These support sign-in, security, session integrity, service operation, user preferences, and the cookie choice saved in your browser. They cannot be switched off through our cookie banner.
• Cookieless analytics. Our basic website measurement counts aggregate visits, pages viewed, and referral sources without setting analytics cookies or building individual visitor profiles.
• Meta Pixel. If you select “Accept all,” Meta Pixel records page visits on Acrova’s public business website and whether a demo-request form was completed. We use this information to measure our advertising. Meta Pixel is not placed in the customer review workspace, on patient-recruitment landing pages, or in Customer Content.

6.2 Information Meta May Receive#

If you select “Accept all,” Meta may receive the page URL, referring page, browser and device information, IP address, Meta cookie identifiers, and whether a demo-request form was completed. Acrova does not configure this feature to send form answers, study links entered into the form, Customer Content, or health information. Meta handles information it receives under the Meta Privacy Policy.

6.3 Your Cookie Choices#

• Accept or reject. Select “Accept all” to allow Meta Pixel or “Reject all” to keep it off. Rejecting optional cookies does not affect our basic cookieless measurement.
• Change your choice. Select “Cookie settings” in the Site footer at any time. Turning optional cookies off stops future Meta Pixel events from that browser. It does not delete information Meta received before you changed your choice.
• Browser controls. Most browsers let you block or delete cookies through their settings. Blocking essential cookies may prevent parts of the Services from working.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, Acrova keeps Meta Pixel off for that browser.
• Do Not Track. There is no uniform standard for browser “Do Not Track” signals, so Acrova does not respond to them.
• Email pixels. Our marketing emails may contain pixels that indicate whether an email was opened. You can disable image loading in your email application or unsubscribe from marketing emails.

7. How We Disclose Personal Information#

We do not sell personal information. If you accept optional cookies, we disclose limited website activity to Meta as described below. Depending on applicable law, that disclosure may be considered “sharing” or processing for targeted advertising. You can reject or withdraw that choice at any time. We otherwise disclose personal information only as follows:

• Service providers. Vendors that process personal information on our behalf and on our instructions to help us provide the Services, including cloud hosting and infrastructure providers, artificial-intelligence service providers (see Section 8), analytics providers, email and communications providers, payment processors, customer-support tools, and security vendors. Our contracts restrict these providers from using personal information for their own purposes.
• Advertising measurement provider. If you accept optional cookies, Meta Platforms, Inc. receives the limited public-site activity described in Sections 3.2 and 6 so Acrova can measure advertising and completed demo requests. We do not provide Meta with form responses, Customer Content, or health information through this feature.
• Your organization. If you use the Platform through a Customer workspace, your name, role, and activity (such as edits, approvals, and audit logs) are visible to the Customer and its other authorized users as part of the collaborative features of the Platform.
• Affiliates. Current or future corporate affiliates under common ownership or control, who may use personal information only as described in this Privacy Policy.
• Professional advisors. Lawyers, accountants, auditors, bankers, and insurers, under duties of confidentiality, where reasonably necessary.
• Legal, safety, and enforcement. Courts, regulators, law enforcement, or other parties when we believe disclosure is required or permitted by law; to respond to subpoenas or other legal process; to enforce our agreements; or to protect the rights, property, or safety of Acrova, our Customers, or others, including for fraud prevention.
• Corporate transactions. In connection with, or during negotiations of, a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, personal information may be disclosed to the parties and their advisors, subject to customary confidentiality protections, and transferred to a successor as permitted by law.
• With your direction or consent. We may disclose personal information for any other purpose you direct or to which you consent.

For purposes of state privacy laws, the categories of third parties to which we disclose personal information are: service providers and processors; an advertising measurement provider when a visitor allows optional measurement; affiliates; professional advisors; government entities and other parties where required by law; parties to corporate transactions; and parties you direct. We may also disclose de-identified or aggregated data, which is not personal information, for lawful purposes.

8. Cloud and Artificial-Intelligence Service Providers#

We use contracted cloud-hosting providers to operate the Site and the Platform, and third-party artificial-intelligence service providers to process protocol and campaign content (including any personal information it contains, such as professional contact information for study personnel) and to generate draft study facts, recruitment copy, and imagery for Customer review. These providers act on our documented instructions under written business agreements that restrict their use of the information to providing services to us and prohibit them from using Customer Content to train their general-purpose models. We likewise do not use Customer Content to train general-purpose artificial-intelligence models. Some providers temporarily retain submitted content for a short period to screen for abuse and enforce their safety policies, after which it is deleted. A current list of the service providers and subprocessors used to provide the Services is available by email at privacy@acrova.ai.

9. Data Retention#

We keep personal information only as long as we need it for the purposes described in this Privacy Policy, and then delete or de-identify it. How long that is depends on the type of information and the criteria we apply: the duration of our relationship with you, whether the information is needed to provide the Services, maintain security, or resolve disputes, our legal, tax, accounting, and reporting obligations, and whether the information is subject to a legal hold or needed for a claim. Customer Content is retained, returned, and deleted in accordance with our customer agreements, subject to residual copies in routine backups that are overwritten on a regular cycle.

10. Data Security#

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental loss and unauthorized access, use, alteration, and disclosure. These include industry-standard encryption in transit and at rest, role-based access controls, logging and monitoring, and vendor security diligence. Additional technical detail is available by email at privacy@acrova.ai. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and should notify us immediately at privacy@acrova.ai if you suspect unauthorized access to your account. If a security incident affects your personal information, we will notify you and the appropriate regulators as required by applicable law.

11. Your Privacy Rights and Choices#

11.1 Marketing Opt-Out#

You may opt out of marketing email at any time by using the unsubscribe link in the message or by contacting us at privacy@acrova.ai. We will honor opt-out requests promptly, as required by the CAN-SPAM Act. We will continue to send transactional and administrative messages, such as service, security, and billing notices, which are not marketing.

11.2 Account Information#

Platform users can review and update certain account information through account settings, or by contacting their Customer administrator or us.

11.3 U.S. State Privacy Rights#

Depending on where you live, state privacy laws, including the Colorado Privacy Act, C.R.S. § 6-1-1301 et seq., the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (see Annex A), Washington’s My Health My Data Act and Nevada’s consumer-health-data law (see Annex B), Nevada’s online privacy-notice law (see Annex C), and similar laws in other states, may give you rights to:

• confirm whether we process your personal information and access a copy of it, including in a portable format;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale of personal information, targeted advertising, and certain profiling; and
• (for California residents) limit the use of sensitive personal information and not be discriminated against for exercising your rights.

Our practices. We do not sell personal information. Optional Meta Pixel measurement may be treated as sharing or targeted advertising under some state laws, and it stays off unless you accept optional cookies. You can opt out through “Cookie settings” in the Site footer or through a supported Global Privacy Control signal. We do not use sensitive personal information for purposes requiring a right to limit, and we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.

Please note that many state privacy laws apply only to businesses that meet certain thresholds and exempt personal information processed in a business-to-business or employment context, so some rights may not apply to the information we process about you. We will honor valid requests as required by applicable law, and we will consider reasonable requests from any individual even where the law does not require us to act on them.

11.4 How to Exercise Your Rights#

To exercise a privacy right, email us at privacy@acrova.ai (or use the contact form on our Site) with the subject line “Privacy Request,” and tell us your name, your state of residence, your relationship with us, and the right you wish to exercise. We may need to verify your identity before acting on a request, and we may ask for additional information to do so; we will use that information only for verification. Authorized agents may submit requests on your behalf with proof of authorization. We will respond within the time required by applicable law (generally 45 days, with a permitted extension where reasonably necessary). We will not discriminate against you for exercising your rights.

11.5 Appeals#

If we decline to act on your request, you may appeal by replying to our decision or emailing privacy@acrova.ai with the subject line “Privacy Appeal” within a reasonable period after our decision. We will respond to appeals within the time required by applicable law (45 days for Colorado residents, extendable by 60 days where reasonably necessary). If your appeal is denied, you may contact your state attorney general; Colorado residents may contact the Colorado Attorney General at coag.gov.

11.6 Requests Concerning Customer Content#

As described in Section 4, requests concerning personal information contained in Customer Content should be directed to the relevant Customer. If you contact us about Customer Content and we can identify the Customer, we will forward your request.

12. Children’s Privacy#

The Services are intended for business users who are 18 or older. They are not directed to children, and we do not knowingly collect personal information from anyone under 13 (or from any minor as defined by applicable law), consistent with the Children’s Online Privacy Protection Act. If you believe a child has provided us personal information, please contact us at privacy@acrova.ai, and we will delete it as required by law.

13. Visitors from Outside the United States#

Acrova is based in the United States, and the Services are operated from and hosted in the United States and other locations where our service providers operate. If you access the Services from outside the United States, you understand that your personal information will be transferred to, stored in, and processed in the United States, where privacy laws may differ from those of your jurisdiction. If we begin offering the Services to customers in the European Economic Area, the United Kingdom, or other jurisdictions with data-transfer requirements, we will provide the additional disclosures and enter into the data-transfer agreements those laws require.

14. Third-Party Sites and Services#

The Services may link to third-party websites and services (for example, ClinicalTrials.gov or a Customer’s own sites) that we do not control. This Privacy Policy does not apply to those sites and services, and we are not responsible for their privacy practices. We encourage you to review their privacy notices.

15. Changes to This Privacy Policy#

We may update this Privacy Policy from time to time. If we make changes, we will post the revised version on the Site and update the “Last Updated” date above. If we make material changes, we will provide additional notice as required by law, such as by email or a notice within the Platform, before the changes take effect. Please review this Privacy Policy periodically.

16. How to Contact Us#

If you have questions about this Privacy Policy or our privacy practices, or need this Privacy Policy in an alternative accessible format, please contact us:

Acrova, Attn: Privacy

Plinthos Holdings LLC d/b/a Acrova

382 NE 191st St #105769, Miami, FL 33179

Email: privacy@acrova.ai

Or use the contact form on our Site.

Annex A: Supplemental Disclosures for California Residents#

This Annex supplements the Privacy Policy and applies to California residents. It is provided in the format contemplated by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA,” Cal. Civ. Code § 1798.100 et seq.). [Note: Acrova may not currently meet the CCPA’s thresholds for a covered “business”; this Annex is included so the notice remains accurate as Acrova grows.]

A.1 Categories of Personal Information#

In the preceding 12 months, we have collected the following categories of personal information, as those categories are defined in Cal. Civ. Code § 1798.140(v)(1):

We do not collect the following categories: characteristics of protected classifications; biometric information; audio, electronic, visual, thermal, olfactory, or similar information (other than routine call or meeting recordings made with notice); education information; precise geolocation; or sensitive personal information beyond log-in credentials.

A.2 Sources, Purposes, and Retention#

We collect these categories from the sources described in Section 3, use them for the purposes described in Section 5, and retain them per the criteria in Section 9. We disclose them for business purposes to the recipients described in Section 7.

A.3 No Sale; Optional Advertising Measurement#

We do not sell personal information. If a visitor accepts optional cookies, we disclose limited identifiers and internet or electronic network activity to Meta to measure Acrova advertising and completed demo requests. To the extent that disclosure is “sharing” under the CCPA, visitors can opt out by rejecting optional cookies, reopening “Cookie settings” in the Site footer, or using a supported Global Privacy Control signal. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We do not use or disclose sensitive personal information for purposes other than those permitted by Cal. Civ. Code § 1798.121(a) and its regulations.

A.4 Your California Rights#

California residents have the right to know and access the personal information we collect (including the categories, sources, purposes, and recipients); the right to correct inaccurate personal information; the right to delete personal information; the right to opt out of sale or sharing; the right to limit use of sensitive personal information where applicable; and the right not to be discriminated against for exercising these rights. You can opt out of optional Meta measurement through “Cookie settings” in the Site footer or a supported Global Privacy Control signal. You may exercise other rights, directly or through an authorized agent, using the methods in Section 11.4; we will verify and respond to requests as the CCPA requires.

A.5 Shine the Light#

Under Cal. Civ. Code § 1798.83 (“Shine the Light”), California residents may request certain information about disclosure of personal information to third parties for their direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes.

Annex B: Consumer Health Data Privacy Notice (Washington and Nevada)#

This Annex addresses “consumer health data” as defined in the Washington My Health My Data Act, RCW ch. 19.373 (“MHMDA”), and Nevada’s consumer health data law, S.B. 370 (2023), NRS ch. 603A (together, the “CHD Laws”). Consumer health data generally means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.

B.1 Our Practices: We Do Not Collect Consumer Health Data#

Acrova is a business-to-business platform for research professionals. We do not offer the Services to consumers, and we do not collect, process, share, or sell consumer health data. Study protocols and public study records processed on the Platform are study-level documents about research studies, not records about identifiable individuals’ health, and Customers are contractually prohibited from uploading patient records, participant-identifiable information, or other individually identifiable health information (see Section 2). The fact that a person works on or is professionally associated with a clinical study is business contact information; we do not use it to identify or infer anything about that person’s own health.

B.2 Our Commitments#

• We will not collect or share consumer health data without first obtaining any consent the CHD Laws require, and we will not sell consumer health data without first obtaining the separate, valid authorization those laws require.
• We do not use geofencing around any facility that provides in-person health-care services to identify, track, or collect data from, or send messages or advertisements to, consumers.
• If our practices ever change such that we collect consumer health data, we will first publish a separate consumer health data privacy policy with the disclosures the CHD Laws require, linked as required from our homepage, and will implement the required consents, authorizations, and safeguards before any collection begins.

B.3 Your Rights Under the CHD Laws#

Washington and Nevada residents have the right to confirm whether a regulated entity is collecting, sharing, or selling consumer health data about them and to access that data, including a list of the third parties and affiliates with which it was shared; to withdraw consent; and to have consumer health data deleted. Because we do not collect consumer health data, we expect to have none to report; you may nonetheless submit a request using the methods in Section 11.4, and we will confirm and respond within the time the CHD Laws require (generally 45 days). If we decline a request, you may appeal as described in Section 11.5; Washington residents whose appeal is denied may contact the Washington Attorney General at atg.wa.gov, and Nevada residents may contact the Nevada Attorney General at ag.nv.gov.

Annex C: Nevada Online Privacy Notice and Opt-Out (NRS 603A.300 to 603A.360)#

Nevada law requires operators of commercial websites that collect “covered information” from Nevada residents to post a notice and to honor verified requests directing the operator not to sell covered information. The categories of covered information we collect, the third-party recipients, and our practices are described in Sections 3, 6, and 7 of this Privacy Policy. We do not sell covered information for monetary consideration as defined in NRS 603A.333, and we have not done so. Nevada residents may nonetheless submit a verified opt-out request through our designated request address, privacy@acrova.ai; we will respond within 60 days as NRS 603A.345 provides. This Privacy Policy’s effective date appears at the top of the document; we will notify users of material changes as described in Section 15.