Privacy Policy

Last updated: September 28, 2026

Aperon, Inc. ("Aperon," "we," "us") builds software and services for clinical trial sponsors, contract research organizations, and research sites. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit our website at aperontrials.com (the "Site"), contact us, or use our platform and related services (the "Services").

1. Our role

When we act for our customers. Our customers (sponsors, CROs, and research sites) decide what information they put into the Services, which may include information about their staff, investigative site personnel, and, where a customer chooses, clinical trial participants ("Customer Data"). For Customer Data, we act as a service provider or processor on our customer's behalf. We process Customer Data only to provide the Services and as our customer's contract with us allows. That contract, not this policy, governs how Customer Data is handled. If your information is in the Services because of a clinical trial, please contact the sponsor, CRO, or site that collected it. We will help them respond to you.

When we act for ourselves. For information we collect through the Site, our sales and support activities, and account administration, Aperon is responsible for deciding how that information is used. That is what the rest of this policy describes.

Health information. Where a customer that is a HIPAA covered entity engages us to handle protected health information (PHI), we do so as a business associate under a business associate agreement and use PHI only as that agreement permits. The covered entity's Notice of Privacy Practices describes your rights for that information.

2. Information we collect

Information you give us

• Contact details such as your name, work email, phone number, company, and job title, when you request a demo, contact us, subscribe to updates, or apply for a job.
• Account information such as your name, email, organization, role, and login credentials, when you or your organization sets up access to the Services.
• Anything you choose to include in messages or support requests.

Information collected automatically

• Device and usage information such as IP address, browser type, operating system, pages viewed, referring URLs, and dates and times of visits.
• Service logs and security information such as login events and actions taken in the Services, used to operate, secure, and audit the platform.
• Information from cookies and similar technologies, described in Section 6.

Information from others

• Your organization may provide your name and work email to set up your account.
• We may receive business contact information from event organizers, partners, or public professional sources.

3. How we use information

We use personal information to:

• Provide, operate, maintain, and support the Services;
• Create and manage accounts and authenticate users;
• Respond to inquiries and demo requests and communicate with you about the Services;
• Secure the Services, including detecting, investigating, and preventing fraud, abuse, and security incidents;
• Maintain audit trails and records required by regulations that apply to clinical research, such as 21 CFR Part 11, and by our contracts;
• Improve the Site and Services, including through aggregated or de-identified analytics;
• Send business communications you have agreed to receive. You can unsubscribe at any time;
• Comply with legal obligations and enforce our agreements.

We do not use Customer Data to market to trial participants, and we do not use Customer Data to train models or for any purpose other than providing the Services, unless our customer instructs us to in writing.

4. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

• Service providers (subprocessors) that host, store, secure, or support the Services or our business, such as cloud hosting, email, and customer support tools. They are bound by written contracts to protect the information and use it only to provide services to us. A list of subprocessors that may process Customer Data is available to customers on request.
• Our customers: if you are an authorized user, we share information about your use of the Services with the organization that gave you access.
• Legal requirements: we disclose information when required by valid legal process, such as a subpoena or court order. Where Customer Data is requested, we try to redirect the request to our customer and notify them unless the law prohibits it. We disclose only the minimum required.
• Protection of rights and safety, where necessary to prevent imminent harm or to protect the rights, property, or safety of Aperon, our users, or others.
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to this policy's protections.
• With your consent or at your direction.

5. Data retention

We keep personal information only as long as needed for the purposes described in this policy, to meet our contractual commitments, or as required by law. After that, we delete or de-identify it. Customer Data is retained and deleted according to our customer's instructions and contract. By default, we delete it within 90 days after a contract ends, unless the customer directs otherwise or longer retention is legally required, for example under clinical trial record-keeping rules.

6. Cookies and analytics

The Site does not set non-essential cookies. We do not use analytics, advertising, session-replay, or marketing tools on the Site, including Google Analytics, PostHog, Segment, Hotjar, HubSpot, Intercom, or Vercel Analytics.

We use:

• Google Fonts to load the Site's typefaces. When your browser requests those fonts, Google may receive your IP address and browser details.
• Local storage on your device to remember whether you paused animations on the Site. This is not a cookie, it is not sent to Aperon, and it is used only for that preference.

You can control cookies through your browser settings. Blocking cookies does not currently affect how the Site works. Where required by law, we ask for your consent before setting non-essential cookies.

7. Security

We protect personal information with administrative, technical, and physical safeguards, including encryption in transit and at rest, role-based access controls, multi-factor authentication, logging and monitoring, regular access reviews, and employee security and privacy training. No system is completely secure, but we work to protect your information and will notify affected customers and individuals of a data breach as required by law and contract.

8. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate information;
• Delete your information;
• Port your information to another service;
• Restrict or object to certain processing;
• Opt out of marketing communications, and of sale, sharing, or targeted advertising where applicable. We do not sell or share personal information for these purposes;
• Withdraw consent where processing is based on consent;
• Appeal a decision we make about your request.

To exercise these rights, email info@aperontrials.com. We will verify your identity before acting on your request. We may ask for information proportionate to the sensitivity of the data. You may use an authorized agent, and we may ask for proof of their authorization. We respond within the time required by applicable law. We will not discriminate or retaliate against you for exercising your rights.

If your request concerns Customer Data, such as information about you in a clinical trial, we will forward it to the relevant customer and help them respond.

European Economic Area and United Kingdom. Where GDPR or UK GDPR applies and Aperon decides how your information is used, we rely on these legal bases: performing a contract with you or your organization; our legitimate interests in operating, securing, and marketing our business, balanced against your rights; compliance with legal obligations; and your consent, where required. You may also lodge a complaint with your local data protection authority.

California and other US states. Residents of California and other states with consumer privacy laws have the rights listed above, to the extent those laws apply to us. In the past 12 months we have collected the categories of information described in Section 2 for the purposes in Section 3, and we have not sold or shared personal information or knowingly collected sensitive personal information for purposes of inferring characteristics about consumers.

9. International transfers

Aperon is based in the United States, and we and our service providers may process information in the United States and other countries. When we transfer personal information from the EEA, UK, or Switzerland, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

10. Children

The Site and Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children through the Site. Information about minors who participate in clinical trials may be included in Customer Data. That information is controlled by our customers and handled under their instructions.

11. Changes to this policy

We review this policy at least once a year and when our practices change. If we make material changes, we will update the "Last updated" date above and, where required, notify you or our customers in advance.

12. Contact us

Questions, requests, or complaints about privacy can go to our Privacy Officer:

Aperon, Inc.
Attn: Privacy Officer
1 Broadway, 14th Floor
Cambridge, MA 02142
info@aperontrials.com