Privacy Policy

01Who we are

This website is operated by Galaxbiotech Solution Private Limited (“Galaxbiotech”, “we”, “us”), a company incorporated in India. For personal data collected through this website, Galaxbiotech is the data fiduciary under India's Digital Personal Data Protection Act, 2023 and the controller for the purposes of the EU and UK General Data Protection Regulation.

This policy covers the public website only. Clinical trial data processed in our eClinical platforms or biometrics services is governed by the contract, data processing agreement and protocol agreed with each sponsor, not by this policy.

02Personal data we collect

We collect only what we need to respond to you and run the site:

• Enquiry details you provide: name, business email, job title, company, country or region, area of interest, how you heard about us and any comments, when you use the request-a-demo form or email us. The form opens your own email application; the website itself does not store the submission.
• Business correspondence: emails, call notes and meeting records exchanged with you during an enquiry or vendor qualification.
• Technical data: IP address, browser type, device information and request timestamps processed automatically by our hosting and security provider to deliver the site and protect it from abuse.
• Demo requests: the details you enter in the request-a-demo form (name, business email, job title, company, country, interest and comments), together with the page you sent it from and how you reached our site, so we can respond and arrange the demonstration.
• Website usage (always): pages viewed in a visit and time spent on each, scroll depth, the referring site or campaign link (for example a LinkedIn post), device and browser type, and an approximate location (country, region and city) derived from your IP address. A random visit identifier is kept in your browser tab only for that visit. The IP address itself is not stored with this data. IP geolocation is provided by DB-IP (db-ip.com).
• Optional analytics (only with your consent): if you choose “Accept analytics”, we also keep a random identifier in your browser to recognise a returning visit, record where on a page you click to build aggregate heatmaps, and make a session recording of how the pages were used (scrolls, clicks and page changes). Text typed into form fields is masked and never recorded. You can change your choice at any time with “Cookie settings” in the footer.

We do not use advertising cookies, we do not sell or share usage data with advertisers, and we do not knowingly collect patient health data through this website. Please do not send protected health information or unblinded study data through the enquiry form.

03How and why we use it

Where we rely on consent, you can withdraw it at any time by emailing [email protected]. Withdrawal does not affect processing that took place before it.

04Who we share it with

We do not sell or rent personal data. We share it only with:

• Galaxbiotech team members and our offices in India, the United States and Mexico who need it to respond to you;
• service providers that host the website, deliver email and store business records, under contracts that require confidentiality and appropriate security;
• professional advisers, auditors, regulators or authorities where the law requires it or to establish, exercise or defend legal claims.

05International transfers

We operate from India, the United States and Mexico, and our providers may process data in other countries. When personal data moves across borders we use safeguards appropriate to the source jurisdiction, such as the European Commission's Standard Contractual Clauses for data from the EU or UK, and we comply with any transfer restrictions notified under India's Digital Personal Data Protection Act, 2023.

06How long we keep it

Enquiries that do not lead to an engagement are kept for up to 24 months and then deleted. Correspondence relating to a contract, vendor qualification or audit is kept for as long as the engagement requires and for the retention period set by applicable law or the sponsor agreement. Technical logs are kept by our hosting provider for short, security-driven periods.

07How we protect it

We apply the same controlled, documented approach we use for regulated clinical work: encryption in transit, role-based access, least-privilege permissions, audit trails, backup and restoration testing, and staff training on confidentiality. No system is completely secure, so we also maintain an incident response process and will notify you and the relevant authority of a personal data breach where the law requires it.

08Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a summary of how it is used;
• correct, complete, update or erase it;
• withdraw consent or object to processing based on legitimate interests;
• restrict processing or receive your data in a portable format (EU/UK);
• exercise ARCO rights of access, rectification, cancellation and opposition (Mexico);
• know, delete and correct personal information, and not be discriminated against for exercising these rights (California and other US states);
• nominate another person to exercise your rights in the event of death or incapacity (India);
• lodge a complaint with your data protection authority, including the Data Protection Board of India.

Email [email protected] with the subject “Privacy request”. We will verify your identity and respond within the time the applicable law allows. We do not sell or share personal information for cross-context behavioural advertising.

09Grievance redressal

Questions or complaints about how we handle personal data can be sent to our Grievance Officer at [email protected] (subject: “Grievance Officer”) or by post to the registered office above. We acknowledge grievances promptly and aim to resolve them within 30 days.

10Cookies

This site uses strictly necessary browser storage and, only if you accept them, analytics storage for returning-visit recognition, heatmaps and session recordings. See the Cookie Notice for details.

11Children

This website is intended for business users. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

12Changes to this policy

We may update this policy as our services or the law change. The date at the top of the page shows when it was last revised; material changes will be highlighted on this page.