1.Introduction

Welcome to Vivgram, a research operations and lifecycle management platform provided by Vidialabs ("Vidialabs," "Vivgram," "we," "our," or "us"). We are committed to protecting your privacy and handling your data in an open and transparent manner. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Vivgram platform.

2.Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using Vivgram, including:

Account Information: Name, email address, phone number, organization name, job title, and password

Facility Data: Animal records, room configurations, task schedules, health reports, protocols, and operational data

Communication Data: Messages, support requests, and feedback you send to us

Billing Information: Billing contact name, email address, and address used for invoicing

2.2 Information Collected Automatically

When you access our platform, we automatically collect:

Usage Data: Pages viewed, features used, time spent, click patterns, and navigation paths

Device Information: IP address, browser type, operating system, device identifiers

Log Data: Access times, error logs, performance data

Cookies and Tracking: Session cookies, preference cookies, analytics cookies

3.How We Use Your Information

We use collected information for the following purposes:

Service Delivery: To provide, maintain, and improve Vivgram’s animal management features

Account Management: To create and manage your account, authenticate users, and process subscriptions

Communication: To send service updates, security alerts, support messages, and respond to inquiries

Analytics: To understand usage patterns, improve user experience, and develop new features

Security: To detect, prevent, and address fraud, security issues, and technical problems

Compliance: To comply with legal obligations, enforce our Terms of Service, and protect our rights

Marketing: To send promotional materials (with your consent), which you can opt out of at any time

4.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Service Providers

We may share information with trusted third-party service providers who assist us in:

Cloud hosting and data storage
Email delivery and communication services
SMS delivery and one-time login codes
Application monitoring
Usage analytics
AI features
Customer support

These providers are contractually obligated to protect your data and use it only to provide services to us.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to:

Comply with legal obligations
Protect our rights, property, or safety
Prevent fraud or security threats
Enforce our Terms of Service

4.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

5.AI Features

Vivgram includes AI-assisted features. Where they are used, the following applies:

Vivi assistant: When you ask Vivi a question, your question and the page or section you are on are sent to our AI provider, OpenAI, to generate an answer. Vivi does not send your organization’s animal or research records.

IACUC protocol drafting (optional): Where this feature has been enabled for your organization, the research summary and protocol details you enter are sent to OpenAI to generate a protocol draft, which you review and edit before submission.

We use OpenAI’s business API, under terms that prohibit using submitted data to train OpenAI’s models. We do not train our own AI models on customer data.

6.Data Security

Vivgram is a multi-tenant SaaS platform with strict logical data isolation. Customer data is segregated using tenant-specific identifiers, and isolation is enforced at the application layer through role-based access control (RBAC) and tenant-context validation on every request. All data access occurs via secured APIs; direct database access is not exposed to end users.

We implement industry-standard security controls to protect your data:

Encryption at Rest

AES-256 managed encryption

Encryption in Transit

TLS 1.2 or higher on all traffic

Access Controls

RBAC, optional MFA, token-based auth (JWT)

Hyperscale Cloud

SOC 2 Type II certified hosting

Backups

Encrypted, geo-redundant, RTO/RPO ≤ 24h

Security Testing

Scans on every code change; audit every 6 months

Staff Access

No access to your account by default

Confidentiality

All employees sign an NDA on hire

Vivgram runs on a leading hyperscale cloud infrastructure provider that holds SOC 2 Type II, SOC 3 Type II, and CSA STAR Level 1 certifications, with GDPR compliance and a published Data Processing Agreement. Physical data-center security, network perimeter controls, and geographic redundancy are inherited from that provider. Electronic access to customer data is logged and monitored for anomalous patterns.

Staff access. Vidialabs staff have no access to your organization’s Vivgram account by default; direct access requires your organization to add Vidialabs staff to its account. Our development team can access customer data in our back-end database only when your organization authorizes it for a specific support ticket.

Report a suspected security issue at info@vivgram.com.

While we strive to protect your information, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

7.Data Breach Notification

If we confirm a data breach affecting your organization’s data, we will notify your organization’s designated contacts in writing within 72 hours, with details of the scope, impact, and remediation, and provide a written root cause analysis within 10 business days. We will also support your organization in meeting any notification obligations it has under applicable law.

8.Data Retention

We retain your information for as long as:

Your account is active and you continue using our services
Necessary to provide services, support, and fulfill contractual obligations
Required by law, regulation, or legal proceedings
Needed to resolve disputes and enforce our agreements

Upon account deletion, we will delete or anonymize your personal data within 90 days, except where retention is required by law.

9.Your Rights and Choices

Depending on your location, you may have the following rights:

Right	Description
Access	Request a copy of your personal data
Correction	Update or correct inaccurate information
Deletion	Request deletion of your data ("right to be forgotten")
Portability	Receive your data in a machine-readable format
Restriction	Limit how we process your data
Objection	Object to processing based on legitimate interests
Opt-Out	Unsubscribe from marketing communications
Withdraw Consent	Revoke consent for data processing

To exercise these rights, contact us at info@vivgram.com.

10.Cookies and Tracking Technologies

We use cookies and similar technologies to:

Cookie Type	Purpose
Essential	Required for platform functionality and security
Preference	Remember your settings and preferences
Analytics	Understand usage patterns and improve services
Marketing	Deliver relevant advertisements (with consent)

You can control cookies through your browser settings. Note that disabling cookies may limit functionality.

11.Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any information.

12.Children’s Privacy

Vivgram is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we become aware of such collection, we will delete it immediately.

13.Data Location and International Transfers

Vivgram production data is hosted in the United States by default. Customer approval is required before we migrate production workloads across major geographic regions. Where our underlying hyperscale cloud provider transfers personal data across borders as part of infrastructure operations, that provider applies contractual and technical protections described in its published Data Processing Agreement, and a Vidialabs Data Processing Agreement is available on request.

For users in the European Economic Area (EEA), UK, and Switzerland, Vivgram acts as a data processor on behalf of the customer (the data controller). Our processing commitments include:

We process data lawfully, fairly, and transparently
We collect data only for specified, legitimate purposes
We minimize data collection to what is necessary
We ensure data accuracy and allow corrections
We limit data retention to necessary periods
We maintain data security and confidentiality

You have the right to lodge a complaint with your local data protection authority.

15.CCPA Compliance (California Users)

For California residents under the California Consumer Privacy Act (CCPA):

You have the right to know what personal information we collect
You can request deletion of your personal information
You can opt-out of the sale of personal information (we do not sell data)
You have the right to non-discrimination for exercising your rights

16.Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by:

Posting the updated policy on our website
Sending an email notification to your registered address
Posting an in-app announcement

Your continued use of Vivgram after changes are posted constitutes acceptance of the updated policy.

17.Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Support

info@vivgram.com

Security