PREVENTIVE CARDIO-ONCOLOGY LLC · POLICY VERSION 2026-08-19

Privacy Policy

Effective August 19, 2026. This Privacy Policy explains how Preventive Cardio-Oncology LLC (“Company,” “we,” “us,” or “our”) handles personal information through the Heart Spark Internship Webinars portal and related programs. Company is the controller or business responsible for the processing described here, except where another provider acts independently.

1. Scope and restrictions

This policy covers portal accounts, internship activities, events, communications, feedback, and support. The portal is for adults and is not directed to children under 18. Do not submit protected health information, patient information, payment-card data, or sensitive personal information unless Company expressly requests it through an approved process.

2. Information collected

We may collect account identifiers received through Sign in with ChatGPT, such as email address and available display name; required profile information, including preferred name, time zone, primary role, optional secondary role, weekly commitment, professional interests, and biography; profile revisions; intern rules, rule versions, and acknowledgment records; eligibility and administrative role; password-verification status without storing the password entered; event registrations; actions, reflections, questions, feedback, consent records, and communications; preferences; cookie choices; device and browser information; the network address presented by the hosting layer; UTC timestamps; request and portal session identifiers; routes, methods, query strings, interface actions and components, outcomes, user agents, referring pages, export events, request and usage logs, related technical metadata; and aggregated platform metrics. VPNs, relays, proxies, address translation, security filtering, and provider processing may cause the presented network address to differ from a device’s original address. We may receive information from authorized program administrators, event providers, video providers, hosting and identity providers, and other services you choose to use.

3. Purposes and legal bases

We process information to authenticate and authorize users; create comprehensive activity and security records; provide, personalize, secure, and improve the Services; attribute submissions and administrative actions; maintain records and progress; administer events and working groups; investigate errors or misuse; protect intellectual property; support legal claims and dispute resolution; respond to requests; send service and preference-based communications; meet legal obligations; and create aggregated or de-identified analytics. Depending on location and context, legal bases include performance of a contract, legitimate interests in security and accountable program administration, consent where required, and compliance with law.

4. Disclosures

Information may be received by Company personnel and contractors who need it; hosting, identity, database, communications, analytics, event, video, security, and professional-service providers; a successor in a merger, financing, reorganization, or sale; and governmental or legal recipients when required or reasonably necessary to protect rights and safety. Providers may include OpenAI for ChatGPT identity and Sites hosting, YouTube/Google when media is enabled, and Zoom when meetings are activated. We do not sell personal information for money. We do not use personal information for cross-context behavioral advertising through this portal.

5. Artificial intelligence and research

Authorized information may be processed with artificial intelligence to organize, summarize, support review, or improve workflows, subject to applicable controls. AI outputs require human review. Research is separate from ordinary platform use and will use separate consent where required. Publications may use aggregated or de-identified information; identifiable publication requires permission or another lawful authorization.

6. Cookies and similar technologies

Necessary technologies support authentication, security, and consent choices. Optional functional, analytics, and third-party media technologies are used only according to applicable choices and law. See the Cookie Policy and reopen Cookie Preferences at any time.

7. Retention and deletion

We retain account, profile, role-assignment, profile-revision, intern-rule acknowledgment, and program records while an account or program is active and for a reasonable period afterward for administration, continuity, disputes, security, and legal obligations. Comprehensive activity and security audit records, including presented network addresses, are generally retained for up to 24 months; policy, intern-rule, and cookie-consent acknowledgments for up to 5 years; support communications for up to 3 years after closure; and de-identified or aggregated information may be retained indefinitely where it cannot reasonably identify a person. Periods may be shorter or longer when law, litigation holds, incident investigation, safety, contractual duties, or documented operational needs require. We delete, anonymize, or securely isolate information when no longer needed.

8. Security and audit access

We use administrative, technical, and organizational safeguards appropriate to the nature of the information, including access controls, authenticated sessions, server-side authorization, encrypted transport, structured audit logging, and restricted owner access. Audit search and export functions require server-verified owner authorization. Authorized providers and personnel may access records when needed for hosting, security, support, legal compliance, or incident response. No system is completely secure. Notify us promptly of suspected unauthorized access.

9. International transfers

The Services may be accessed worldwide, and information may be processed in the United States and other countries whose laws differ from those where you live. Where required, we use recognized transfer mechanisms and supplementary safeguards. Sites does not currently provide data-residency selection, so users who require local-only residency should not use the portal until an appropriate deployment is available.

10. Your rights

Depending on location, you may request access, correction, deletion, portability, restriction, objection, or withdrawal of consent; appeal a denied privacy request; or complain to a regulator. Withdrawal does not affect earlier lawful processing. California and other applicable United States residents may have rights to know, correct, delete, opt out of covered sharing or targeted advertising, and limit certain sensitive-information uses. We do not discriminate for exercising rights. European Economic Area, United Kingdom, and Swiss users may contact their supervisory authority. Canadian and other international users may exercise rights available under local law.

11. Requests and verification

Submit a privacy request through the contact channel in the portal. We may verify identity and authority, request clarifying information, and use an authorized-agent process where required. A dedicated privacy contact and any legally required representative details will be published before the public pilot opens.

12. Changes

We may update this policy prospectively. We will post the effective date and provide additional notice or request consent when required by law.

13. Governing framework

This Privacy Policy is incorporated into the Platform Terms of Use. Wyoming law governs the incorporated agreement as stated in those Terms, subject to privacy rights and mandatory protections that apply in a user’s jurisdiction.