Privacy policy

1) Scope and who we are

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use cirrustx.com and related pages (the “Site”). It does not cover employee data or data we process under separate contracts.

We are a life sciences company. The Site is informational and includes a simple “Contact Us” form. We do not provide medical care via the Site and we do not request or require protected health information.

2) What we collect

• Identifiers and contact info: name, email, organization, role, phone, and the content of your message if you choose to provide it.
• Internet/activity data: IP address, device and browser type, settings, pages visited, time on page, and referral source.
• Inferences: high-level interest categories derived from site interactions (e.g., “partner interest,” “media inquiry”) where applicable.

We do not intentionally collect sensitive personal information via the Site (e.g., precise geolocation, government IDs, health diagnoses). Please do not submit sensitive information through open text fields.

3) How we collect it

• Directly from you via forms or email.
• Automatically via cookies and similar technologies for essential operations, analytics, and limited performance measurement.
• From service providers that operate our website, analytics, security, and communications.

4) Why we use personal information

• Respond to inquiries and operate the Site.
• Maintain security, debug, and prevent fraud or misuse.
• Measure and improve Site performance and content.
• Comply with law, enforce terms, and protect our rights.

We do not use personal information for decisions that produce legal or similarly significant effects about you.

5) Cookies and similar technologies

We use:

• Essential cookies to run the Site.
• Analytics cookies to understand traffic and improve content.
  You can set your browser to block or delete cookies and you can enable a Global Privacy Control (GPC) signal; we honor GPC where required.

6) “Sale,” “sharing,” and targeted advertising

We do not “sell” personal information and do not “share” it for cross-context behavioral advertising as defined under California law. If our practices change, we will update this Policy and provide required opt-outs.

For states that regulate targeted advertising (e.g., CO, CT, VA, TX, OR, DE, NJ), we currently limit analytics to non-profiled, aggregate uses. If we later engage in targeted advertising, we will provide state-specific opt-outs and honor universal opt-out mechanisms where applicable.

7) How we disclose information

We disclose personal information to:

• Service providers/Processors under contract (hosting, analytics, security, email, form handling).
• Corporate transactions (merger, acquisition, financing) subject to appropriate protections.
• Legal compliance (to fulfill law enforcement or lawful requests).

We do not permit service providers to use your data for their own purposes.

8) Security and retention

We use reasonable administrative, technical, and physical safeguards. No system is perfect. We keep personal information only as long as needed for the purposes above, then delete or de-identify it according to our retention practices.

9) Children

The Site is for adults and is not directed to children under 13. We do not knowingly collect children’s personal information.

10) Consumer health data (Washington and similar laws)

We do not intend to collect “consumer health data” as defined by Washington’s My Health My Data Act or similar laws. Do not submit health diagnoses, treatment information, or other sensitive health details through the Site. If you choose to provide health-related information, we will handle it only to respond to your specific request and then delete it where feasible, and we will provide any required notices or consents if our practices materially change.

11) Your privacy rights (by state)

Depending on your state, you may have the right to:

• Access, correct, or delete personal information.
• Opt out of targeted advertising, certain profiling, or (where applicable) sale/sharing.
• Obtain a portable copy of certain information.
• Appeal our decision on your request (CO, CT, VA, etc.).
• Use an authorized agent to submit requests (CA).

How to exercise your rights: Email info@cirrustx.com with the subject “Privacy Request.” We will verify your identity and respond within the timelines required by your state. You may also send a written request to our postal address.
Appeals: If we deny your request in a state that provides an appeal right, you may appeal by replying “Appeal” to our response. If you remain unsatisfied, you can contact your state attorney general.

We will not discriminate against you for exercising your rights.

12) International visitors

Our Site is intended for use in the United States. If you access it from outside the US, you understand your information may be processed in the US.

13) Third-party links

Third-party sites are governed by their own policies. We are not responsible for their practices.

14) Changes to this Policy

We will update this Policy as needed and post the effective date above. Material changes will be highlighted for a reasonable period.

15) Contact us

Questions or requests: info@cirrustx.com | 780 Main Street, Cambridge, MA 02139