Privacy Policy

Effective Date: January 1, 2026
Last Updated: January 2026

1. Introduction

Xylvaron Biotech Inc. ("Company," "we," "us," or "our") is committed to protecting your privacy and ensuring you have a positive experience on our website and when using our services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, use our services, and interact with us.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our services. Your use of our services indicates your acceptance of this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you voluntarily provide to us, including:

• Contact information (name, email address, phone number, mailing address)
• Account information (username, password, preferences)
• Genomic data and biological samples (when applicable to our services)
• Communications and correspondence
• Payment information (processed securely through third-party providers)
• Survey responses and feedback

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and browsing behavior:

• IP address and device identifiers
• Browser type, version, and operating system
• Pages visited, time spent on pages, and referral sources
• Cookies and similar tracking technologies
• Geographic location data (inferred from IP address)

2.3 Information from Third Parties

We may receive information about you from third parties, including business partners, payment processors, analytics providers, and publicly available sources. This information helps us maintain accurate records and improve our services.

3. How We Use Your Information

We use the information we collect for various purposes, including:

• Providing, maintaining, and improving our services
• Processing transactions and sending related information
• Sending promotional communications (with your consent)
• Responding to inquiries and customer support requests
• Conducting research, analytics, and service optimization
• Complying with legal obligations and protecting our rights
• Preventing fraud, security breaches, and other harmful activities
• Personalizing your experience and delivering targeted content

4. Legal Basis for Processing

Under Canadian privacy law and GDPR (where applicable), we process your personal data on the following legal bases:

• Consent: You have explicitly consented to the processing
• Contract: Processing is necessary to fulfill a contract with you
• Legal Obligation: We are required by law to process your data
• Legitimate Interests: Processing serves our legitimate business interests (e.g., security, fraud prevention)
• Public Task: Processing is necessary for a task carried out in the public interest

5. How We Share Your Information

We may share your information with:

5.1 Service Providers

We work with third-party service providers who assist us in operating our website, conducting our business, and serving you. These providers are contractually obligated to use your information only as necessary to provide services to us.

5.2 Business Partners

We may share information with partners for collaborative research, product development, and service delivery. We ensure appropriate data protection agreements are in place.

5.3 Legal Requirements

We may disclose your information when required by law, court order, or government request, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

If we are involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

6. Data Security

We implement comprehensive security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Secure password management and authentication protocols
• Regular security assessments and penetration testing
• Limited access to personal information on a need-to-know basis
• Staff training on data protection and privacy practices
• Incident response procedures and breach notification protocols

While we strive to protect your information, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security.

7. Genomic Data and Biological Samples

When you provide genomic data or biological samples for our services, we treat this sensitive information with the highest level of care:

• Your genomic data is stored securely and separately from identifying information where possible
• We use de-identified data for research and quality improvement purposes (unless you opt in to identified research)
• You retain full control over your biological samples and can request destruction at any time
• We comply with all regulations governing genetic testing and biospecimen handling
• We do not sell your genomic data without your explicit written consent

8. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, analyze website usage, and deliver personalized content. Types of cookies include:

• Essential Cookies: Necessary for website functionality
• Performance Cookies: Help us understand how you use our site
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used to deliver targeted advertisements

You can control cookie preferences through your browser settings. Note that disabling certain cookies may affect website functionality.

9. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

9.1 Canadian Residents

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy laws, you have the right to:

• Access your personal information
• Request correction of inaccurate information
• Request deletion of your information
• Withdraw consent for processing
• File complaints with privacy authorities

9.2 EU Residents (GDPR)

If you are in the European Union, you have additional rights under the GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making and profiling

9.3 How to Exercise Your Rights

To exercise any of these rights, please submit a written request to lab@xylvaron.bond or contact us at the address provided below. We will respond to your request within 30 days (or as required by applicable law).

10. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes outlined in this Privacy Policy or as required by law. Our retention practices include:

• Contact and account information: retained for the duration of your account and 3 years thereafter
• Transaction records: retained for 7 years for accounting and legal compliance
• Genomic data: retained according to your preferences and applicable regulations
• Website analytics data: retained for 24 months
• Marketing communications: retained until you unsubscribe

11. International Data Transfers

Xylvaron Biotech Inc. is based in Canada. If you are accessing our services from outside Canada, your information may be transferred to, stored in, and processed in Canada or other countries where we operate. These countries may have data protection laws different from your home country. By using our services, you consent to the transfer of your information to countries outside your country of residence, which may provide a different level of data protection.

12. Third-Party Links and Services

Our website and services may contain links to third-party websites and services that are not operated by us. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services before providing your information.

13. Children's Privacy

Our services are not directed to individuals under 18 years of age, and we do not knowingly collect personal information from children. If we become aware that we have collected information from a child without parental consent, we will take steps to delete such information promptly. Parents or guardians who believe we have collected information about their child should contact us immediately.

14. California Residents (CCPA)

If you are a California resident, you have specific privacy rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, and shared
• Right to delete personal information collected from you
• Right to opt-out of the sale of your personal information
• Right to non-discrimination for exercising your CCPA rights

15. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last Updated" date at the top of this policy indicates when it was last revised. We will notify you of any material changes by posting the updated policy on our website and updating the "Effective Date." Your continued use of our services following the posting of revised Privacy Policy means that you accept and agree to the changes.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

17. Privacy Officer

We have appointed a Privacy Officer responsible for our compliance with this Privacy Policy and applicable privacy laws. You may contact our Privacy Officer with any questions or concerns regarding your privacy and our data protection practices.

18. Complaints and Dispute Resolution

If you have a complaint or dispute regarding our privacy practices, we encourage you to contact us first so we can attempt to resolve the matter. If you are not satisfied with our response, you may file a complaint with the appropriate privacy authority in your jurisdiction:

• Canada: Office of the Privacy Commissioner of Canada (OPC)
• EU: Your local Data Protection Authority
• California: California Attorney General