Privacy Policy

Effective date: 10/1/2026 Last updated: 10/1/2026

Summary

• Ryght, Inc. provides generative AI software that helps life-sciences organizations select and assess clinical trial sites. This policy covers our websites and our platform.
• We collect information you give us (for example, when you request a demo or create an account), information collected automatically (device, usage, cookies), and professional information about clinical investigators and research sites from other sources.
• We use advertising and analytics cookies from partners such as Google, HubSpot, LinkedIn and Meta. In the EEA and UK, we use them only with your consent. In the US, you can opt out through Your Privacy Choices or a Global Privacy Control signal.
• We don't sell personal information for money. We don't use customer content to train generative AI models.
• You can contact us at privacy@ryght.ai to exercise your privacy rights.

Contents

1. Who we are and what this policy covers
2. Information we collect
3. How we use information
4. AI features
5. How we disclose information
6. Cookies and similar technologies
7. Your choices
8. US state privacy rights
9. EEA and UK privacy rights
10. International transfers
11. Data retention
12. Security
13. Children's privacy
14. Third-party sites
15. Changes to this Privacy Policy
16. Contact us

1. Who we are and what this policy covers

Ryght, Inc. and its affiliates ("Ryght," "we," "our," or "us") value the privacy of the people who use our websites, including www.ryght.ai (the "Website"), and our related generative artificial intelligence platform and services (together, the "Services" or "Platform"). This Privacy Policy explains how we collect, use, and disclose personal information about users of our Services ("Users") and others described below.

"Personal information" means information that identifies, relates to, or can reasonably be linked to an individual. It includes "personal data" as defined in the EU and UK General Data Protection Regulations (GDPR).

Ryght as controller. Ryght, Inc., 1950 Corporate Way, Suite 12489, Anaheim, CA 92801, United States, is the controller of personal information processed as described in this policy.

Ryght as processor or service provider. When our business customers upload or submit content to the Platform ("Customer Content"), we process it on their behalf and under their instructions, as set out in our agreement with them. The customer's own privacy notice governs that processing. If your personal information is in Customer Content, please send privacy requests to the relevant customer. We will help them respond.

Your use of the Services is also subject to our Terms of Service.

2. Information we collect

A. Information you provide to us

• Website forms and demo requests. When you request a demo, a site list or a free site search, or contact us, we collect your name, email address, phone number, company, and details about your study (such as indication or therapeutic area, target region, and ClinicalTrials.gov NCT ID), plus any other information you choose to provide.
• Account and profile information. When you register for the Platform, we collect your name, title, business email address, phone number, company, login credentials, and your preferences.
• Communications. When you contact us, subscribe to our newsletter, or take part in surveys or events, we collect your contact details, the content of your messages and any attachments. Our vendors receive and store these communications on our behalf.
• Careers. If you apply for a job, we collect your contact details, resume, education and employment history, and any other information you provide. If you apply through LinkedIn, we receive the profile information you choose to share.
• Payment information. If you purchase through the Services, our third-party payment processor collects your payment card details on our behalf. We receive only limited details, such as billing contact, transaction history and the last four digits of the card.

B. Information we collect automatically

• Device information. IP address, browser type and version, operating system, device type and similar identifiers.
• Usage information. The pages and content you view, searches you run, features you use, referring pages, and the dates and times of your visits.
• Approximate location. We infer your general location (for example, country or city) from your IP address.
• Cookies and similar technologies. See Section 6.
• Email interactions. Our marketing emails may contain tracking pixels that tell us whether an email was opened or a link clicked. In the EEA and UK we use them only with your consent. See Section 6.

C. Information we receive from other sources

• Professional and investigator information. To power site selection and feasibility features, the Platform includes information about clinical research sites, principal investigators, and site staff. This can include names, professional titles, institutional affiliations, business contact details, specialties, and trial participation and performance history. We obtain it from public sources such as ClinicalTrials.gov, EU CTIS, and other public trial registries, from licensed data providers, and from our customers and partners. We don't collect patient health information for this purpose.
• Third-party accounts and integrations. If you connect a third-party account or application (such as single sign-on or a CRM), we receive information from that service in line with your settings there.
• Business partners and marketing sources. We may receive business contact information from event organizers, co-marketing partners, and advertising and analytics partners.

3. How we use information

We use personal information to:

• Provide, maintain, secure, and improve the Services, and authenticate your access
• Deliver Platform features, including site recommendations and feasibility insights
• Personalize your experience and remember your preferences
• Understand how the Services are used and develop new products and features
• Respond to inquiries and demo requests, provide customer support, and send service-related communications
• Send marketing communications and measure how well they work
• Show relevant advertising on other websites and measure advertising campaigns (see Section 6)
• Facilitate transactions and billing
• Evaluate job applications and manage recruiting
• Create de-identified or aggregated data that no longer identifies individuals. We maintain such data in de-identified form and do not attempt to re-identify it
• Detect and prevent fraud, abuse and security incidents
• Comply with legal obligations, enforce our Terms of Service, and protect our rights and those of others
• For other purposes we describe to you when we collect the information

4. AI features

The Platform uses generative AI and machine learning to analyze protocols, site and investigator data, and the content you submit, and to generate site recommendations and insights. When you use AI features, you're interacting with an AI system. Outputs may be inaccurate, and qualified people should review them before relying on them.

• Model providers. We use OpenAI in Azure to deliver AI features. These providers act as our service providers or processors under contracts that restrict their use of the data.
• Training. We don't use Customer Content or your inputs to train generative AI models. We won't start using previously collected data for AI training without giving notice and, where required, getting consent.
• Aggregated insights. Datasets generated from your content are available only to Ryght and to users in your network you authorize. We may use aggregated, de-identified data to improve the Services.
• Automated decisions. We don't make decisions about individuals based solely on automated processing that produce legal or similarly significant effects on them. Site and investigator rankings are decision-support tools for our customers' qualified staff.

5. How we disclose information

We disclose personal information only as described below or as we tell you when we collect it:

• Affiliates. Our affiliated companies, for uses consistent with this policy.
• Vendors and service providers. For example, cloud hosting, CRM and marketing automation (HubSpot), analytics, AI model providers, customer support, payment processing, and recruiting tools. They may use personal information only to provide services to us.
• Other Platform users. Content and datasets you generate on the Platform are not made public. They are available only to users in your organization or network whom you grant access. We aren't responsible for how those users use information you choose to share.
• Third-party integrations. When you connect a third-party application, we share only what is needed to make the integration work.
• Advertising and analytics partners. Partners such as Google, LinkedIn and Meta collect information through cookies and pixels on our Website to measure and deliver ads (see Section 6). Under some US state laws this may count as "sale," "sharing," or "targeted advertising." You can opt out as described in Sections 6 and 8.
• Legal and safety. We disclose information when we believe it is required or appropriate to comply with law or legal process, respond to lawful requests from public authorities, or protect the rights, property, or safety of Ryght, our users, or others.
• Corporate transactions. We may share information with advisors and actual or prospective counterparties in a merger, acquisition, financing, reorganization, or sale of assets. Personal information may transfer as part of that transaction, subject to this policy.
• With your consent. For any other purpose, when you ask us to or agree to it.

No sale for money. We don't sell personal information in exchange for money. We don't knowingly sell or share the personal information of anyone under 16.

6. Cookies and similar technologies

We and our partners use cookies, pixels, tags, web beacons, and similar technologies ("Cookies") to operate the Website, remember preferences, understand usage, and deliver and measure advertising. These third parties may collect information about your online activities over time and across different websites.

• EEA and UK visitors. We place non-essential Cookies (functional, analytics, and advertising) only after you consent through our cookie banner. You can accept or reject all or some categories, and you can change your choice at any time through Cookie Settings in the Website footer.
• US visitors. You can opt out of advertising Cookies through Your Privacy Choices in the footer. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of targeted advertising and "sale" or "sharing" for that browser.
• Do Not Track. There is no accepted standard for responding to Do Not Track signals, and we don't respond to them. We do honor GPC as described above.
• Other tools. You can block or delete Cookies in your browser settings, opt out of interest-based ads from participating companies at optout.aboutads.info and optout.networkadvertising.org, and opt out of Google Analytics with Google's browser add-on. Blocking strictly necessary Cookies may stop parts of the Website from working.
• Email tracking. You can prevent email tracking by turning off automatic image loading in your email client. In the EEA and UK we use email tracking only with consent.

7. Your choices

• Marketing emails. Unsubscribe using the link in any marketing email or by contacting us. We will still send you service-related and administrative messages.
• Account information. Update your profile or close your account in your account settings, or contact us.
• Cookies and advertising. See Section 6.

8. US state privacy rights

Depending on where you live, and subject to exceptions (including exceptions for information about people acting in a business-to-business or employment capacity), you may have the right to:

• Confirm whether we process your personal information, and access it
• Correct inaccuracies
• Delete personal information
• Get a portable copy of your personal information
• Opt-out of targeted advertising, "sale," or "sharing" of personal information, and of profiling that produces legal or similarly significant effects
• Get a list of the categories of third parties (or, in some states, the specific third parties) we have disclosed your personal information to.
• Not be discriminated against for exercising these rights

How to make a request. Email privacy@ryght.ai or via the web form - https://www.companyinformer.net/. To opt out of targeted advertising, use Your Privacy Choices in the footer or enable GPC. We will verify your identity by matching information you give us against our records, and may ask for more information if needed. You may use an authorized agent. We may ask the agent for proof of authorization and may ask you to verify your identity directly. We respond within 45 days, which can be extended as the law allows.

Appeals. If we decline your request, you can appeal by emailing privacy@ryght.ai with the subject line "Privacy Request Appeal" within [45] days of our decision. We will respond within the time the law requires. If you disagree with the outcome, you can contact your state Attorney General.

Sensitive data. We don't collect sensitive personal information (such as precise geolocation, health, or biometric data) through the Website.

Nevada residents. We don't sell covered information as defined under Nevada law. You can still send an opt-out request to privacy@ryght.ai.

9. EEA and UK privacy rights

Controller and representatives

The controller is Ryght, Inc., 1950 Corporate Way, Suite 12489, Anaheim, CA 92801, United States.

Legal bases

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for more information about that assessment. Providing personal information is generally voluntary, but if you don't provide information we need to deliver the Services or respond to your request, we may not be able to do so.

Your rights

You have the right to access, correct, or delete your personal data, to restrict or object to its processing, and to data portability. You have an absolute right to object to direct marketing, including profiling related to it. Where we rely on consent, you can withdraw it at any time, free of charge, without affecting processing that happened before you withdrew it. To exercise these rights, contact privacy@ryght.ai. We respond within one month, which can be extended by two further months for complex requests, and we don't charge a fee unless requests are manifestly unfounded or excessive. We may need to verify your identity.

If you have concerns, please contact us first so we can try to resolve them. You also have the right to complain to a data protection supervisory authority, in particular in the EU or EEA member state where you live, work, or where the alleged infringement took place, or in the UK to the Information Commissioner's Office (ico.org.uk).

10. International transfers

Ryght is based in the United States, and we and our service providers may process personal information in the United States and other countries whose data protection laws may differ from those where you live. When we transfer personal data out of the EEA, UK, or Switzerland, we use appropriate safeguards. These include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, [and our certification to the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework — include ONLY if certified; if so add the required DPF disclosures], or an adequacy decision. You can request a copy of the relevant safeguards by contacting privacy@ryght.ai.

11. Data retention

We keep personal information only as long as we need it for the purposes described in this policy, unless the law requires or permits us to keep it longer. We then delete it or de-identify it. Typical retention periods:

12. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. More information is available on our Security page (www.ryght.ai/security) and Trust Center (trust.ryght.ai). No transmission or storage of information is completely secure, so we can't guarantee the security of your information.

13. Children's privacy

Our Services are intended for business professionals and aren't directed to children. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact privacy@ryght.ai and we will delete it.

14. Third-party sites

Our Services may link to websites, products, or services we don't own or operate, such as LinkedIn and YouTube. This policy doesn't cover them, and we aren't responsible for their privacy practices. Please review their privacy policies.

15. Changes to this Privacy Policy

We may update this policy from time to time. We will post changes on this page and update the "Last updated" date. If we make material changes, we will notify you in advance by email or through the Services. Material changes to how we use personal information we have already collected will apply only prospectively, or with your consent where required. We review this policy at least once a year.

16. Contact us

Ryght, Inc. · 1950 Corporate Way, Suite 12489, Anaheim, CA 92801, United States · privacy@ryght.ai