Introduction
EviClaim LLC, a Florida limited liability company with its principal office at 2525 W 4th Ave, Hialeah, FL 33010 ("EviClaim," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the EviClaim website and platform (the "Service"). This Policy applies to website visitors, registered accounts, and authorized users at customer organizations ("Customer," "you").
By using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service. This is a business-to-business regulatory compliance platform. We do not knowingly collect personal information from individual consumers in connection with the products our customers sell.
1. Information We Collect
NOTICE AT COLLECTION - This Privacy Policy also serves as our CALIFORNIA NOTICE AT COLLECTION. At or before collection, we inform individuals of the categories of personal information collected, the purposes of collection, whether Sensitive Personal Information is collected, and our retention criteria. The categories and examples of personal information collected includes the following:
- Account and contact information. Name, business email address, phone number, company name, role, and authentication identifiers from Firebase (our account-authentication provider), collected when you create an account.
- Billing information. Billing name and address, and payment details, which are processed by our payment provider, Stripe. EviClaim does not store full payment card numbers.
- Job content. Product names, formulations, ingredient lists, marketing claims, labels, and related materials that Customer submits to generate a Report ("Job Content"). This may include Customer's confidential or trade-secret business information.
- Usage data. Pages visited, features used, job status events, IP address, and browser/device type, collected automatically through server logs and analytics tools.
- Cookies. See Section 9 below.
We do not intentionally collect sensitive personal data, such as health information about identifiable individuals - Job Content concerns products and published scientific literature, not personal medical records.
Third Parties - Categories of recipients may include but are not limited to cloud hosting providers, payment processors, identity verification providers, tenant-screening providers, analytics providers, communications providers, professional advisers, regulators, and governmental authorities.
2. How We Use Information
- Provide, operate, and improve the Service, including processing Job Content through the pipeline to generate Reports.
- Process payments and manage accounts.
- Communicate with you about jobs, account activity, and service updates.
- Maintain the audit trail (evidence sources, scoring history, approvals) associated with a job, to preserve the integrity of Reports as audit artifacts.
- Perform aggregated, de-identified analysis to improve the platform, scoring rubrics, and Service quality. This analysis does not use Customer's identifiable confidential formulation or claim details in a form usable by other customers.
- Comply with legal obligations and enforce our Terms of Service.
3. How Job Content Is Processed - AI and Third-Party Subprocessors
To generate a Report, Job Content and related data may be transmitted to the following categories of subprocessors, strictly to perform the requested analysis:
- Large language model providers (for example, Anthropic), used for report drafting, natural-language analysis, and advisor stress-testing functionality.
- AI-assisted search and market-intelligence providers (for example, Perplexity), used to retrieve current, source-linked market and regulatory information with verifiable, timestamped citations.
- Public biomedical literature databases (for example, PubMed/NCBI), used to retrieve published scientific literature. These are public sources, and queries to them do not include Customer's confidential business information beyond the ingredient and claim search terms necessary to find relevant literature.
- Cloud infrastructure providers (for example, Google Cloud Platform), used for hosting, database storage, file storage, and background task processing.
- Payment processor (Stripe), used to process payments. EviClaim does not receive or store full card numbers.
- Firebase, used for account authentication and session management.
These providers are used solely to deliver the Service and are restricted, contractually or by their own policies, from using Job Content to train their own public or shared models where such controls are available to us.
4. Data Storage and Security
- Job data - including job records, retrieved literature, evidence sources, scoring history, and formulation records - is stored in an access-controlled database hosted on private cloud infrastructure, with encryption in transit and automated backups.
- Generated Reports are stored in cloud file storage and delivered through time-limited, signed download links rather than public URLs.
- Access to Customer data within EviClaim is limited to personnel who need it to operate, support, or improve the Service.
- No method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.
5. Data Retention
Account and job data is retained for as long as an account is active, and for a reasonable period afterward to preserve audit trails, respond to support or regulatory inquiries, and meet legal and recordkeeping obligations. After that period, data is deleted or de-identified, except where longer retention is required by law or necessary to resolve an active dispute (for example, a Report tied to an ongoing regulatory matter). Any data records may be retained for several years following account closure where required by law.
You may request deletion of your account data, subject to the audit-trail and legal-retention exceptions described above, by contacting us at info@eviclaim.com.
6. Confidentiality of Formulation and Trade-Secret Data
We understand that product formulations and claim strategy are commercially sensitive. Job Content is not shared with unrelated customers, is not used to train shared or public AI models beyond what is described in Section 3, and is not sold. In a white-label contract-manufacturer ("CMO") arrangement, a CMO administrator account may have visibility into jobs submitted by its own affiliated brand clients, consistent with the service the CMO has arranged for those brands; this scope is disclosed to the brand client when its account is created.
8. Your Privacy Rights / Sensitive Personal Information Notice
Sensitive Personal Information - We may collect Sensitive Personal Information, including date of birth, financial account information, authentication credentials, government-issued identifiers where permitted, income information, and related information solely for purposes permitted by applicable law. We do not use or disclose Sensitive Personal Information for purposes requiring a right to limit unless we provide any notice and choice required by law.
Depending on where you are located, you may have rights to access, correct, delete, or restrict our use of your personal information.
California residents. Under the CCPA/CPRA, you have the right to know what personal information we collect and how we use it, and the right to request deletion, opt-out of any sale or targeted advertising if ever applicable, and appeal qualifying denials, subject to applicable exceptions. EviClaim does not sell personal information as defined under the CCPA.
EU/UK individuals. If EviClaim processes personal data of individuals located in the EU or UK - for example, in connection with cosmetics customers using our EU-market output - we do so in accordance with applicable data protection law (such as the GDPR), acting as a processor or controller depending on context. Individuals may have rights to access, rectify, erase, or port their data, and to object to certain processing.
To exercise any of these rights, contact us at info@eviclaim.com. We may need to verify your identity before fulfilling a request. If you are in the European Economic Area or United Kingdom, you may also lodge a complaint with your local supervisory authority.
10. Children's Privacy
The Service is intended for business use by adults and is not directed to children under 16. We do not knowingly collect personal information from children.
11. International Data Transfers
Our infrastructure is hosted in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. and in other countries where our subprocessors operate, which may have data protection laws that differ from those in your jurisdiction.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will post material changes on our website with an updated effective date and, where required by law, provide additional notice.
13. Contact Us
Questions about this Privacy Policy or your data can be directed to info@eviclaim.com.
EviClaim LLC, 2525 W 4th Ave, Hialeah, FL 33010.