Privacy Policy.

§ 01 · Information we collect

What we actually ask for.

The information we collect depends on the services you use and how you interact with us. This includes information you provide through forms, email, and Instagram messages, as well as records received through our authorized messaging integration.

• Contact form submissions. Name, clinic or practice name, professional email, phone number, and the body of the message you send us.
• Clinic verification. Professional license number, NPI (National Provider Identifier) where applicable, business address, and supporting documentation requested at account-opening.
• Order data. Items ordered, quantities, ship-to address, billing address, and the masked payment reference our processor returns to us (we never see the full card number).
• Support tickets. Anything you write to us about a product, an order, or a clinical question, plus the metadata of the conversation (timestamps, agent assigned).
• Exocellure AI Marketing and Instagram messaging. Instagram usernames and account identifiers; messages and inquiries sent to our Instagram business account; message timestamps and conversation records; contact information you voluntarily provide, such as your name, email address, telephone number, clinic name, or business details; customer service correspondence; and technical records associated with our Instagram messaging integration.
• Newsletter opt-ins. Only if you affirmatively check the box. Email address, the date of opt-in, and the source page.
• Server logs. IP address, user-agent string, request timestamps, and the URL path requested. Held for the period stated in § 06.

Our Instagram integration may use Meta's Instagram API and authorized technology providers, including workflow automation services, to process messages and manage inquiries. Do not send your Instagram password, access tokens, or other sensitive login credentials.

§ 02 · How we use information

Use is tied to a purpose.

Every category of data above has a defined use. We do not repurpose data later for something you did not consent to at collection.

• Fulfill orders. Verify clinic eligibility, prepare the shipment, hand it to a carrier, and confirm delivery.
• Eligibility verification. Match license numbers against the issuing board's public registry before any clinical product leaves the facility.
• Respond to and manage inquiries. Receive, organize, route, and respond to messages received through our website, email, Instagram business account, and Exocellure AI Marketing application. Messaging and workflow automation services may be used to manage conversations and provide customer service about products, orders, and other inquiries.
• Transactional email. Order confirmations, shipping notifications, and account security notices, sent through Resend infrastructure.
• Clinical updates. Sent only to recipients who have actively opted in. Unsubscribe link in every send. No silent re-additions to the list.
• Site and service quality. Aggregate server log analysis to monitor uptime, error rates, and abuse patterns. Not joined to identifiable accounts.
• Legal obligations. Tax records, controlled-product distribution records, and lawful response to subpoenas, warrants, or court orders.

§ 03 · Sharing & disclosure

We never sell. We share narrowly.

Exocellure does not sell personal data. We do not rent, trade, or barter it. We do not feed it into advertising audiences or lookalike models.

We use service providers to operate our services and disclose information where legally required. Relevant information may be processed by the following parties for the purposes described:

• Payment processor. Stripe handles card data. We receive only the masked reference, not the full card number.
• Shipping carriers. FedEx and UPS receive ship-to address, phone number, and parcel metadata to deliver your order.
• Email infrastructure. Resend transmits transactional and opt-in clinical emails on our behalf under a data processing agreement.
• Instagram messaging and automation providers. Meta's Instagram API and authorized technology providers may process relevant information to support Instagram messaging, workflow automation, customer service, and secure data storage for Exocellure AI Marketing.
• Cleanroom and QC partners. Operate under signed NDAs. They handle lot data, never customer identity.
• Legal recipients. Courts, regulators, and law-enforcement agencies, only when legally compelled, and only to the scope the order requires.

Information held independently by Instagram or Meta is governed by their respective privacy policies and account controls. For details, review Instagram's Privacy Policy and Meta's Privacy Policy.

§ 04 · Cookies & analytics

Minimal by design.

This site runs on the smallest cookie footprint that still works. There are no third-party tracking pixels, no advertising trackers, and no browser fingerprinting scripts loaded from any page.

• Session cookie. A first-party cookie that keeps your cart and login session alive while you browse. Expires when the session ends.
• Preferences cookie. A single localStorage entry named exo_theme that stores your chosen site palette (Obsidian or Royal Navy). Removable from your browser at any time.
• No third-party scripts. No Google Analytics, no Meta Pixel, no LinkedIn Insight Tag, no Hotjar, no FullStory, no advertising remarketing tags.
• No fingerprinting. We do not load any library whose purpose is to identify a returning visitor across sessions without their consent.

If we ever add a first-party analytics tool, it will be self-hosted, IP-anonymized, and disclosed here before launch.

§ 05 · Patient data & HIPAA

Patient data stays with the clinic.

Our website, customer service, Instagram messaging, and Exocellure AI Marketing services are not intended to collect patient health information. Do not send patient names, medical records, identifiable patient photographs, or other sensitive health information through these channels. Patient treatment records should remain with the treating practitioner inside their clinical system; we do not request access to those records.

If a clinic chooses to share de-identified outcome data with us for research, formulation development, or a published case series, that exchange is governed by a separate research agreement. All such data is held to the HIPAA Safe Harbor de-identification standard before it reaches our systems.

We are not a HIPAA Covered Entity for the purpose of patient records. Where any incidental Business Associate relationship is created (rare, project-specific), we sign a BAA before any data transfer.

§ 06 · Data retention

We keep what we must, and we set clocks.

The following retention periods apply to our existing website and practitioner service records. When the applicable period ends, records are deleted, de-identified, or retained only where a continuing legal or other necessary retention requirement applies.

• Contact inquiries. 24 months from last reply, then purged.
• Clinic accounts. Duration of the partnership, plus 7 years after closure for accounting and tax compliance.
• Order records. 10 years per US tax and controlled-product distribution regulations.
• Server logs. 90 days, then aggregated to anonymous counters and the raw records deleted.
• Newsletter list. Held until unsubscribe, at which point the address is removed from the active list and recorded only as a suppression hash.
• Support tickets. 36 months from last activity, then archived without identifiers.

Information processed through Exocellure AI Marketing and Instagram messaging is retained only as necessary to manage inquiries and support the service, subject to deletion requests and applicable retention requirements. Certain information may need to be retained for accounting and tax obligations, order and transaction records, regulatory compliance, fraud prevention, security, or legal claims. Any retained information is limited to what is necessary and protected according to our privacy and security policies.

§ 07 · Security

Defense in layers.

We treat security as a clinical-grade discipline because the people we serve operate at clinical-grade standards themselves. The same engineering teams who build product also harden infrastructure.

• Encryption in transit. TLS 1.3 across the public site, the ordering portal, and all internal API surfaces.
• Encryption at rest. AES-256 for sensitive operational records, customer profiles, and document attachments.
• Role-based access. Least-privilege defaults. Production data is read-only outside a defined break-glass workflow.
• Multi-factor authentication. Required for every staff account, every vendor portal, and every administrative interface.
• Access reviews. Quarterly. Every active credential is reviewed against current role; stale credentials are revoked the same day.
• Vendor audits. We require SOC 2 Type II reports or equivalent from any vendor that processes customer or order data on our behalf.
• Breach notification. If we confirm a breach affecting identifiable data, we notify affected parties and applicable regulators within 72 hours of confirmation.

§ 08 · Your rights · US, GDPR, CCPA

You can ask. We have to answer.

You may request access, correction, or deletion of your personal information. We review and verify requests and aim to respond within 30 days, subject to applicable legal requirements. If additional time is required, we explain the reason. We send confirmation once a deletion request has been processed.

• Access. Request a copy of the personal data we hold about you.
• Correction. Update any record that is inaccurate or out of date.
• Deletion. Request removal of your personal information. Necessary information may be retained for accounting and tax obligations, order and transaction records, regulatory compliance, fraud prevention, security, or legal claims, subject to applicable law.
• Portability. Receive your data in a machine-readable format you can move to another provider.
• Opt-out of marketing. Withdraw consent from clinical updates or any other opt-in communication at any time.
• Object to processing. Where we rely on legitimate interests, you can object and we will reassess.

Submit any of the above to privacy@exocellure.com. California residents have additional rights under the CCPA, including the right to know what categories we have collected, sold, or disclosed in the preceding 12 months. We do not sell personal information.

For Exocellure AI Marketing and Instagram messaging, email privacy@exocellure.com with the subject Data Deletion Request — Exocellure AI Marketing. Include your Instagram username, if applicable, the email address used in previous communications, if relevant, and a description of the information you would like deleted. Do not send passwords, access tokens, or other sensitive login credentials.

We may request reasonable information to verify that the request relates to your account. When processing a valid deletion request, we address relevant information held by Exocellure and instruct applicable service providers to delete covered information where required.

You may also review or remove access to Exocellure AI Marketing through Instagram's connected application settings, if it is listed. Removing access does not necessarily delete information already stored in Exocellure's systems. Follow our Data Deletion Instructions to request deletion and review the full process.

§ 09 · International transfers

Where the data sits.

For our website and practitioner ordering infrastructure, primary data residency is the United States. Those production databases, document storage, and operational infrastructure are hosted in US regions.

A small number of vendors process data in their own regional jurisdictions as part of how they operate: Stripe (payment data, US and EU), Resend (email delivery, US), and shipping carriers (parcel data, route-dependent).

Instagram and Meta describe their own international processing and transfer practices in their respective privacy policies. Authorized messaging and workflow automation providers may process information in the jurisdictions where they operate, subject to applicable requirements.

For EU and EEA visitors whose data is transferred to the US in the course of using this site, transfers are conducted under the European Commission's Standard Contractual Clauses, with supplementary measures where required. A copy of the applicable SCCs is available on request to privacy@exocellure.com.

§ 10 · Children

Not for minors.

This site and its products are not directed at children under 16. We do not knowingly collect data from anyone under that age. If we learn that data from a minor has reached our systems, we delete it.

Our products are clinic-only. They are administered by licensed practitioners as part of an adult treatment plan. They are not sold direct-to-consumer, and they are not appropriate for pediatric use.