Privacy Policy

1 Introduction & Who We Are

KAITALK is a governed AI platform for clinical participant recruitment, eConsent, and retention, used by sponsors, CROs, and research sites across the United States, Mexico, and beyond. The service is provided by Chany Ventures, S. de R.L. de C.V., a company organized under the laws of Mexico, operating under the trade name KAITALK.

KAITALK is a Q Bridge product. For company information, see qbridge.ai.

This Privacy Notice describes how we collect, use, disclose, and safeguard personal information when you use our platform, website, or participant outreach services. It applies to account holders, participants who interact with our AI, and visitors to kaitalk.online.

If you have any questions about this policy, please contact us:

• General inquiries: vamsy@kaitalk.online
• Privacy / data protection: privacy@kaitalk.online
• Mailing address: Monterrey, Nuevo León, México

2 Data We Collect

We collect only the personal data necessary to deliver and improve the KAITALK service. The table below describes each category, what is included, and the source from which we collect it.

We do not collect sensitive personal data (special categories under GDPR Art. 9), government ID numbers, or financial account credentials.

3 Legal Basis for Processing

The legal basis for processing your personal data depends on your jurisdiction:

• Mexico (LFPDPPP): We rely on explicit consent obtained at registration for non-essential data processing, and on legitimate interest for service delivery, security, and fraud prevention. Our full Aviso de Privacidad is available at /aviso-privacidad.
• EU / EEA (GDPR Art. 6):
  • Contract performance (Art. 6(1)(b)) — processing necessary to provide the service you signed up for.
  • Legal obligation (Art. 6(1)(c)) — retention of billing records for tax compliance.
  • Legitimate interests (Art. 6(1)(f)) — security monitoring, fraud prevention, service improvement.
  A Data Processing Agreement (DPA) is available on request.
• California / USA (CCPA / CPRA): We disclose the categories of personal information collected at the point of collection. We do not sell personal information to third parties. We do not share personal information for cross-context behavioral advertising.

4 Retention Periods

We retain personal data only as long as necessary for the stated purpose or as required by law:

5 Sub-Processors

We engage the following third-party service providers (sub-processors) who may process personal data on our behalf. Each is bound by a Data Processing Agreement or equivalent legal instrument.

A complete, up-to-date sub-processor list is maintained at /subprocessors.

6 Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

To exercise any of these rights, contact privacy@kaitalk.online or submit a request through your dashboard at /account/compliance.

7 Data Subject Requests

You may submit a Data Subject Request (DSR) by either:

• Email: Send a request to privacy@kaitalk.online with the subject line "Data Subject Request — [your request type]". Please include your registered email address and a description of your request.
• Dashboard: Log in and navigate to /account/compliance for a guided DSR submission form.

All requests are logged in our data_subject_requests table with jurisdiction-specific deadlines enforced. We may require identity verification before processing requests involving deletion or portability.

8 International Transfers

KAITALK is headquartered in Mexico and uses sub-processors primarily located in the United States. Personal data may be transferred outside Mexico when processed by these sub-processors.

• EU / EEA data: Transfers to US sub-processors are covered by Standard Contractual Clauses (SCCs) approved by the European Commission, or the applicable adequacy decision.
• Mexico (LFPDPPP Art. 37): International transfers are disclosed in this notice. We require sub-processors to maintain data protection standards equivalent to those required by LFPDPPP.
• All transfers: We conduct due diligence on sub-processors and maintain Data Processing Agreements that impose obligations consistent with applicable privacy law.

9 Children's Data

KAITALK is a business-to-business service directed exclusively at small and medium businesses and their adult employees. We do not knowingly collect personal data from individuals under the age of 16.

If you believe we have inadvertently collected personal data from a minor, please contact privacy@kaitalk.online immediately and we will delete the data promptly.

10 Breach Notification

In the event of a personal data breach that is likely to result in risk to individuals' rights and freedoms, we will:

• Notify affected account holders within 72 hours of becoming aware of the breach (GDPR requirement; we apply this standard globally).
• Notify INAI (Mexico's data protection authority) within the timeframe required by LFPDPPP for Mexico-affecting incidents.
• Notify affected US users in compliance with applicable state breach notification laws.
• Document the breach, its scope, likely consequences, and remedial measures taken in our security_incidents log.

Our full incident response procedure is documented internally at docs/incident-response.md.

11 Cookies

We use a minimal set of cookies and browser storage:

• kai_session (httpOnly, Secure cookie) — Required for authenticated sessions. No consent needed; essential to service operation. Expires after 30 days or on logout.
• kai_lang (localStorage) — Stores your language preference. Non-essential; set without consent as no personal data is involved.
• polsia_vid (localStorage) — Anonymous visitor identifier for aggregate analytics. Non-essential — only set after you accept analytics cookies via our consent banner.

We do not use advertising cookies, third-party tracking pixels, or cross-site behavioral profiling. You can withdraw analytics consent at any time by clearing browser storage or using the consent banner preferences link in the page footer.

12 Changes to This Policy

We may update this Privacy Policy from time to time. For material changes — changes that affect your rights, our data collection practices, or the legal bases for processing — we will provide at least 10 days advance notice by email to registered account holders before the changes take effect.

Non-material changes (such as clarifications or corrections) may be made without advance notice. The "Last updated" date at the top of this page will always reflect the most recent revision.

Continued use of KAITALK after the effective date of a material change constitutes acceptance of the revised policy.

13 Contact