Privacy Policy

1. Introduction

Parlytics LLC (“Parlytics,” “we,” “us,” or “our”) operates the website located at parlytics.ai and the web application located at app.parlytics.ai (collectively, the “Services”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services.

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of our Services immediately.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide when you submit a demo request or contact form, create or manage an account, or communicate with us by email or other means. This information may include your name, job title, business name, email address, phone number, and any other information you choose to provide.

2.2 Information Collected Automatically

When you visit our Services, we may automatically collect certain technical information, including IP address and approximate geographic location, browser type and version, operating system, pages viewed and time spent on pages, referring URLs, and device identifiers.

2.3 Business Data You Submit

If you are a subscriber to our platform, you may submit business operational data including supply inventory records, purchase order information, vendor data, and related operational information (“Business Data”). We process Business Data solely on your behalf and in accordance with your instructions and our Data Processing Agreement (where applicable).

Business Data may include patient-adjacent records, such as sanitized patient reference identifiers linked to implant placements and device lot numbers used for recall traceability. These references are limited to what is necessary to support lot traceability and are handled as described in Section 9 (Healthcare Data and HIPAA).

2.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Services. You may configure your browser to refuse cookies, though some features of the Services may not function properly if you do so.

3. How We Use Your Information

We use the information we collect to provide, operate, and maintain our Services; process and respond to demo requests and inquiries; create and manage user accounts; send transactional and administrative communications; improve, personalize, and expand our Services; understand how users interact with our Services; detect, prevent, and address technical issues and security incidents; and comply with applicable legal obligations.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Aggregated and Anonymized Data

We may use supply purchasing and pricing data submitted to the Platform in anonymized, aggregated form to generate industry benchmarks and comparative analytics. Before any data is used for this purpose:

• All practice-identifying information is removed
• Patient, provider, and staff information is never included
• Minimum group thresholds (no fewer than five participating practices) are applied to ensure no individual practice can be identified from the resulting benchmarks
• Data is combined with information from multiple practices before any benchmark is generated

You may opt out of benchmark data participation at any time by contacting us at support@parlytics.ai. Opting out does not affect your access to the Platform or any other terms of service. Consistent with our Terms of Service, opt-out is prospective only — data already incorporated into aggregated benchmarks prior to opt-out cannot be removed.

5. Legal Basis for Processing

Where required by applicable law, we process your personal information on the following legal bases:

• Performance of a contract: Processing necessary to provide the Services you have requested
• Legitimate interests: Processing necessary for our legitimate business interests, such as improving our Services and preventing fraud
• Legal obligation: Processing necessary to comply with applicable law
• Consent: Where you have provided explicit consent, which you may withdraw at any time

6. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

6.1 Service Providers

We may share your information with trusted third-party service providers who assist us in operating our Services. Our current service providers include: Vercel, Inc. (application hosting and infrastructure), Supabase, Inc. (database hosting), Anthropic, PBC (AI processing — see Section 6.4), Resend (transactional email delivery), and Sentry (error monitoring). All service providers are contractually obligated to use your information only as directed by us and in accordance with this Privacy Policy. We will update this list as our service providers change.

6.2 Business Transfers

If Parlytics LLC is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any such change via email and/or prominent notice on our Services.

6.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, or when we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a legal request.

6.4 Artificial Intelligence Processing

Certain features of our Services, including supply cost optimization, inventory standardization analysis, demand forecasting, invoice reconciliation, and recall notice processing, utilize artificial intelligence and machine learning capabilities provided by Anthropic, PBC (“Anthropic”) through their Claude API. When these features are used, relevant operational data (such as inventory items, vendor pricing, and usage patterns) is transmitted to Anthropic's API for processing. Data processed by Anthropic includes vendor invoice documents, recall notices, and supply catalog data. These documents may incidentally contain Protected Health Information. Anthropic processes such data only as a subprocessor under an executed Business Associate Agreement. No data containing PHI is submitted to Anthropic until all required BAAs are in place. Anthropic processes this data solely to provide responses to our API requests and in accordance with Anthropic's privacy practices and data processing terms. We do not permit Anthropic to use your data to train their models.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. When your information is no longer needed, we will securely delete or anonymize it.

Subscriber Business Data is retained for the duration of the subscription term and deleted within 90 days following termination, unless you request earlier deletion or applicable law requires otherwise. Deletion applies to identifiable Business Data; anonymized aggregated data already incorporated into benchmarks is not subject to deletion.

8. Data Security

We implement industry-standard technical and organizational measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encrypted data transmission (TLS/SSL), access controls, and regular security assessments.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. Data transmitted to third-party AI processing services is transmitted over encrypted connections and handled as described in Section 6.4.

We will notify affected users of any confirmed security breach affecting their Business Data within seventy-two (72) hours of discovery, or as otherwise required by applicable state or federal law.

9. Healthcare Data and HIPAA

Parlytics is a supply chain management platform and is not intended to collect, store, or process Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) unless a Business Associate Agreement (“BAA”) has been executed between your organization and Parlytics. The platform enforces this requirement: PHI may not be stored in the Services until a BAA is in place.

Where a BAA has been executed, Parlytics handles PHI in accordance with the BAA and applicable HIPAA requirements, including the administrative, physical, and technical safeguards of the HIPAA Security Rule. In the event of a conflict between this Privacy Policy and an executed BAA, the BAA controls with respect to PHI.

The Services may store patient-adjacent data — such as sanitized patient reference identifiers linked to implant placements and device lot numbers — to support FDA recall traceability, as described in Section 2.3. If your use of the Services requires HIPAA compliance, please contact us at hello@parlytics.ai to execute a Business Associate Agreement before submitting any PHI.

10. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to certain exceptions
• Portability: Request transfer of your personal information in a structured, machine-readable format
• Objection: Object to processing of your personal information in certain circumstances
• Withdrawal of Consent: Where processing is based on consent, withdraw that consent at any time

To exercise any of these rights, please contact us at support@parlytics.ai. We will respond to your request within 30 days.

State privacy rights. If you are a resident of California, Virginia, or another state with a comprehensive consumer privacy law, you may have additional rights under those laws, including the right to appeal a denial of a rights request and the right not to receive discriminatory treatment for exercising your rights. We do not sell personal information and do not share personal information for cross-context behavioral advertising. To appeal a decision regarding a privacy rights request, contact us at support@parlytics.ai with “Privacy Appeal” in the subject line.

11. Children's Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

12. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any information.

13. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on this page with a revised “Last Updated” date, and where appropriate, by sending you an email notification. Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at: