Privacy Policy

Effective Date

Effective Date: October 2, 2026. Last reviewed: October 2, 2026.

This Privacy Policy is effective as of the date above and governs how Burna AI handles personal information through the Website, its free tools and pre-contract interactions, and states which agreement governs each of Burna AI's mobile applications. We will update the Effective Date whenever we make material changes, as described in the Changes to This Policy section. Section references in this Policy are by name rather than by number, so that adding a section cannot silently misdirect a reference.

Introduction

Burna AI, Inc. ("Burna AI," "we," "us," or "our") builds the AI platform for accelerated clinical research. Research sites, pharmaceutical and biotechnology sponsors, and contract research organizations use it to grade, attribute and report adverse events.

This Privacy Policy explains how Burna AI collects, uses, discloses, and protects personal information through its public website at burna.ai (the "Website"), the free tools on the Website, and in connection with prospective customer interactions, marketing communications, and resource requests (collectively, the "Services covered by this Policy"). Burna AI also operates ctcae.ai and Protocol Studio, which publish their own privacy policies at ctcae.ai/privacy-notice and protocolstudio.ai/privacy-notice.

Who this Policy covers

• Visitors to the Website.
• Individuals who submit inquiries, book a conversation, sign up for the quarterly briefing or other email communications, request briefs and resources, or use the free tools on the Website.
• Personnel of prospective customers (clinical, administrative, legal, security, procurement) who interact with Burna AI before a customer agreement is executed.

HIPAA CARVE-OUT When Burna AI provides its platform to a HIPAA Covered Entity or to another Business Associate, Burna AI acts as a Business Associate as defined under HIPAA. In those cases, Burna AI's handling of Protected Health Information ("PHI") is governed by the executed Business Associate Agreement ("BAA") and the underlying customer agreement, not by this Privacy Policy. The Website is designed for business inquiries and for free tools that use de-identified or invented content, and it does not ask for PHI.

Burna AI may provide additional privacy notices for specific products, regions, or processing activities (for example, a Cookie Policy, a Subprocessor List, and region-specific notices). Where another notice applies, that notice supplements this Policy.

Information We Collect

We collect the categories of personal information described below. The specific information we collect depends on how you interact with the Website and Services covered by this Policy.

Information you provide to us. Identifiers and contact information: name, business email address, telephone number, professional title or role, and employer or institution name.

Inquiry information: information you provide when you contact us, book a conversation, request a brief or other resource, register for an event, or take part in a conversation about a potential evaluation of Burna AI.

Commercial and engagement information: information shared during pre-contract conversations, including stated needs, evaluation criteria, technical environment summaries, and procurement timelines, to the extent voluntarily provided.

Communications: the content of emails, web form submissions, scheduling notes, and other communications you send to us.

Marketing preferences: email subscription preferences and unsubscribe selections.

Forms and free tools on the Website. The Website collects the following through its own forms and tools:

• Newsletter sign-up: the email address you enter in the sign-up form at the foot of each page.
• Resource requests: your name, email address, organization and role, the resource you requested, your stated interest if you give one, and whether you asked to receive the quarterly briefing.
• Booking a conversation: the booking form on the request-a-demo page is provided by Cal.com, which receives the details you enter, such as your name, email address and the time you choose, and passes them to us.
• Grade My Note: the clinical note you paste, which you confirm is de-identified before submitting; the treatment regimen, if you name one; your email address; and the page that referred you. A member of our team grades the note and replies by email. We store the submission in our database and send our team an internal notice containing your email address, the regimen and the length of the note, without the note itself.
• Fishbone board: when you open the board, the Website starts an anonymous session that carries no name or email address. What you draw is sent to the language model providers that read it, so the board can show you the result, and nothing you draw is kept unless you export it. To export, you give your email address. We store the exported image and its readings until the download link expires, up to seven days later, and then delete them. We keep a record of the export, including your email address, and send our team an internal notice with a masked form of the address.

Information collected automatically. Internet and network activity information: Internet Protocol (IP) address, browser type and version, operating system, device type, language preferences, referring and exit pages, pages viewed, links clicked, campaign parameters in the link you arrive by, page performance measurements, and dates and times of access. Our product analytics on the Website (PostHog) runs without cookies or browser storage: PostHog counts visitors with a daily hash of the IP address, user agent and site that it computes on its servers. Our hosting providers record requests to the Website, including IP addresses, in server logs. If you choose Accept All on the cookie banner, the analytics and advertising tags described in the Cookies and Tracking Technologies section also collect information about your visit.

Information from third parties and automated research. When you sign up through the Website's newsletter form, we run automated research on the sign-up. A web research service (Exa) searches public sources for information about you and your organization using the details you gave us. An AI model (OpenAI) then writes a summary of that research, a draft reply and a lead score from 1 to 100 that estimates how closely your organization fits Burna AI's work. The result is stored in our database, recorded in our sales database (Notion) and posted to our team's internal messaging (Slack), and you receive a confirmation email. We also receive information from service providers who help us operate the Website, deliver email, or analyze Website usage; from Cal.com when you book a conversation; from Apollo.io's website visitor tracker, after you choose Accept All, which can identify the organization a visit comes from; and from partners and referrers who introduce you to Burna AI with your knowledge.

Inferences. Based on the information above, we draw limited inferences about a visitor's professional role, organization type (for example, academic medical center, pharmaceutical sponsor, contract research organization), likely interest in particular Burna AI resources, and, for newsletter sign-ups, the lead score described above.

What we ask you not to send. The Website is not designed to collect payment card information, government identification numbers, or sensitive personal information beyond what is reasonably necessary to respond to a business inquiry. Its free tools are designed for de-identified or invented clinical content, so please do not submit PHI through them. PHI handling on the Burna AI platform is governed by the applicable customer agreement and BAA.

How We Use Information

For individuals in jurisdictions that require a lawful basis for processing, we identify the basis or bases on which we rely under the European Union General Data Protection Regulation ("GDPR") and the United Kingdom General Data Protection Regulation ("UK GDPR").

Purposes of processing. Respond to inquiries and requests: reply to questions, fulfill brief and resource requests, arrange conversations and demonstrations, and provide requested information. Lawful bases: performance of a contract or pre-contract steps (GDPR Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)).

Provide the free tools: grade a submitted note and reply to it, read a fishbone drawing, and deliver an export you request. Lawful bases: steps taken at your request; legitimate interests.

Deliver resources and communications: provide the materials you request. Lawful bases: contract or pre-contract steps; legitimate interests; consent where required (Art. 6(1)(a)).

Send marketing communications: the quarterly briefing and other newsletters, event invitations, and product updates. Lawful bases: consent; legitimate interests in promoting our Services where permitted.

Research and prioritize sign-ups: run the automated research and lead scoring described in the Information We Collect section, so our team can decide how to follow up. Lawful bases: legitimate interests.

Evaluate fit: assess whether a prospective customer is a good fit for Burna AI. Lawful bases: pre-contract steps; legitimate interests.

Operate, maintain, and improve the Website: monitor performance, analyze usage trends, debug issues, develop new features. Lawful bases: legitimate interests in operating a secure and effective Website; consent, for the tags that load after you choose Accept All.

Security, fraud prevention, and protection of rights: detect, investigate, and prevent fraudulent, unauthorized, or unlawful activity. Lawful bases: legitimate interests; legal obligation (Art. 6(1)(c)); establishment, exercise, or defense of legal claims.

Comply with legal obligations: comply with laws, regulations, court orders, and lawful requests by public authorities. Lawful bases: legal obligation; legitimate interests.

Corporate transactions: evaluate, negotiate, and complete mergers, acquisitions, reorganizations, or sales of assets. Lawful bases: legitimate interests; legal obligation.

Withdrawal of consent. Where we rely on consent, you may withdraw consent at any time by following the instructions in the relevant communication or by contacting [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

How We Share Information

We do not sell personal information. We share personal information only as described in this Section.

Service providers and subprocessors. We share personal information with service providers and subprocessors that perform services on our behalf, subject to written contracts that restrict their use of the information. The providers we use today include hosting and databases (Railway, in the United States); file storage and content delivery (Cloudflare); language model providers for AI features (Anthropic, OpenAI, Google, and models reached through OpenRouter); speech recognition for recordings (Microsoft Azure, and xAI for recordings made in the Care Journal app); email delivery and newsletter lists (Resend); web research on sign-ups (Exa); our sales database (Notion) and internal messaging (Slack); product analytics (PostHog); booking (Cal.com); and professional services firms (legal, accounting, audit).

Analytics and advertising tags. Only after you choose Accept All on the cookie banner, the Website loads Google Analytics, the LinkedIn Insight Tag, Plausible and Apollo.io's website visitor tracker, and those services receive information about your visit as described in the Cookies and Tracking Technologies section.

The current list of subprocessors is maintained at burna.ai/subprocessors.

Customers and prospective customers. When you communicate with Burna AI on behalf of a customer or prospective customer, we may share relevant information internally and with the corresponding organization for the purpose of advancing the engagement.

Legal and safety disclosures. We may disclose personal information when we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process (such as a subpoena or court order), or governmental request; cooperate with law enforcement or regulators; enforce our terms, agreements, or policies; or protect the rights, property, or safety of Burna AI, our customers, our personnel, or others, including in connection with security incidents.

Corporate transactions. If Burna AI is involved in a merger, acquisition, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, personal information may be transferred or disclosed as part of that transaction, subject to standard confidentiality protections and, where required, notice to affected individuals.

With your direction or consent. We may share personal information with other parties at your direction or with your consent.

International Data Transfers

Burna AI is headquartered in the United States. Our databases are hosted in the United States, and our service providers may process personal information in the United States and in other countries where they operate. These countries may have data protection laws that differ from those of your country of residence.

Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision from the relevant authority, we rely on appropriate safeguards. These include the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the United Kingdom International Data Transfer Addendum or the UK International Data Transfer Agreement; adequacy decisions where issued by the relevant authority; and other safeguards permitted under applicable law.

The platform's databases, including those holding PHI processed under a BAA, are hosted in the United States. Platform data handling is separate from the data handling described in this Policy, which concerns the Website, its free tools and pre-contract interactions.

You may request a copy of the safeguards we use for international transfers by contacting [email protected], subject to redaction for confidentiality and legal reasons.

Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, regulatory, or reporting requirements, to resolve disputes, and to enforce our agreements. When personal information is no longer required, we delete or de-identify it in a secure manner.

Your Rights

Depending on where you reside, you may have certain rights regarding your personal information. To exercise any right, contact [email protected]. We will respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request.

GDPR and UK GDPR. Right of access: obtain confirmation of processing and a copy of your information. Right to rectification: request correction of inaccurate or incomplete information. Right to erasure: request deletion in certain circumstances. Right to restriction of processing. Right to data portability: receive certain information in a structured, machine-readable format and, where technically feasible, request its transmission to another controller. Right to object, including to direct marketing and profiling, and including to the automated research and lead scoring of newsletter sign-ups described in the Information We Collect section. Right to withdraw consent, without affecting the lawfulness of prior processing. Right not to be subject to solely automated decision-making: the lead score helps our team decide how to follow up with a sign-up, and a person makes that decision. Right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office).

California (CCPA and CPRA). Right to know, delete, correct. Right to opt out of sale: Burna AI does not sell personal information as defined under California law. Right to opt out of sharing for cross-context behavioral advertising: on the Website, the LinkedIn Insight Tag and the other tags described in the Cookies and Tracking Technologies section load only after you choose Accept All on the cookie banner. Choosing Decline All, or making no choice, keeps them off. Right to limit use and disclosure of sensitive personal information. Right to non-discrimination: we will not discriminate against you for exercising any CCPA right.

Notice of financial incentives. Burna AI does not offer financial incentives or price differences in exchange for the retention or sale of personal information. Shine the Light. Burna AI does not disclose personal information to third parties for their direct marketing purposes.

Other United States state privacy laws. Residents of states with comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia (as applicable laws come into effect), may have rights similar to those described above, including the right to access, correct, delete, port, and opt out of certain processing, as well as the right to appeal a denial of a request. Contact [email protected].

International rights. Canada (PIPEDA): access, correction, withdrawal of consent. Australia: access and correction under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Japan (APPI): disclosure, correction, addition, deletion, suspension of use, erasure. Korea (PIPA): access, correct, delete, and suspend processing. Singapore (PDPA): access, correction, withdrawal of consent. Brazil (LGPD): confirm processing, access, correct, anonymize, block or delete, port, withdraw consent, oppose processing. UAE and KSA: rights under applicable federal, free zone, or national data protection laws.

How to exercise your rights. Email [email protected] with sufficient information for us to identify you and the nature of your request. You will not be charged a fee unless your request is manifestly unfounded or excessive. If we deny your request, you may appeal our decision by replying to our response with the word "Appeal" in the subject line. If your appeal is denied, you may contact your local supervisory or data protection authority.

Cookies and Tracking Technologies

The Website uses a small set of cookies and similar technologies (local storage, tags and scripts):

• Product analytics (PostHog) runs on every page without cookies or browser storage.
• A cookie banner offers two choices, Accept All and Decline All, and stores your choice in your browser's local storage. Until you choose Accept All, the Website loads none of the tags described in the next item.
• If you choose Accept All, the Website loads Google Tag Manager, which loads Google Analytics, the LinkedIn Insight Tag, Plausible and Apollo.io's website visitor tracker. These services set their own cookies and receive information about your visit, such as your IP address, browser and the pages you view. LinkedIn can use it to measure advertising and build advertising audiences, and Apollo.io uses it to identify the organization a visit comes from.
• To change your choice, clear the Website's stored data in your browser. The banner then appears again on your next visit.
• The Website stores your light or dark theme preference in your browser. The fishbone board starts an anonymous session, held in a cookie, so the board can be read and exported. The booking form on the request-a-demo page is provided by Cal.com, which may set its own cookies.

For a detailed description of the cookies and similar technologies we use, please see our Cookie Policy.

Children's Privacy

The Website and Services covered by this Policy are intended for business audiences and are not directed to children. Burna AI does not knowingly collect personal information from children under the age of 16 (or such other age established under applicable law). If you believe a child has provided personal information to us, please contact [email protected], and we will take appropriate steps to delete the information.

Security

Burna AI maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, and destruction. These safeguards include encryption of data in transit and at rest, provided through our hosting and storage providers; role-based authorization in our applications; a database for health information that is separate from account and sign-in data; an audit record of access to health information on the platform; continuous database backups; and written procedures for reviewing the service providers we use. Our SOC 2 Type 2 audit is in progress.

No method of transmission over the internet or method of electronic storage is fully secure. Although we strive to use commercially acceptable means to protect personal information, we cannot guarantee its absolute security.

For additional information about Burna AI's security and compliance posture, see burna.ai/it. To report a suspected security vulnerability or incident, contact [email protected].

HIPAA Notice

Where Burna AI provides services to a HIPAA Covered Entity or to another Business Associate, Burna AI operates as a Business Associate under HIPAA. The handling of PHI in that context is governed by the executed Business Associate Agreement and the underlying customer agreement, not by this Privacy Policy.

The Website does not ask for PHI. Grade My Note asks you to confirm that a note is de-identified before you submit it, and the fishbone board asks for invented or de-identified values. Information about Burna AI's HIPAA program, the BAA, and PHI handling on the platform is provided to customers as part of the procurement and contracting process and is summarized in customer documentation. If you believe you have submitted PHI to Burna AI through the Website in error, please contact [email protected] so we can take appropriate steps to address the submission.

Mobile Applications

Burna AI publishes two mobile applications. Neither is a Website surface, so this section states how each handles information and which agreement governs it.

CTCAE by Burna AI is used by clinicians and research coordinators at a study site, under their institution's agreement with Burna AI. The app collects account identifiers, device and diagnostic information, and an audit record of the actions a user takes. On iPhone, it asks for the system's tracking permission and sends product analytics only if the user allows it. Clinical information a user enters, records or reviews in the app is PHI, and Burna AI handles it as a Business Associate under the executed BAA with the institution or sponsor, under the terms of that agreement rather than under this Policy. Requests to access or correct a clinical record are directed to the institution holding it.

Healthnotes is used by people taking part in a clinical study. A participant joins with a code or link issued by their research team. Healthnotes collects the consent record presented at enrolment, the answers a participant submits on the schedule the study protocol sets, the date and time of each submission, the name and email address a participant gives if they create an account, the date of birth, sex at birth, height and weight a participant chooses to add, and device and diagnostic information. Those answers are transmitted to the research team running that study.

A participant can also choose to use the app's other features, each of which collects what it needs to work:

• Photographs and documents: pictures the participant takes or chooses, such as medication labels, rashes and paperwork, and records the participant imports.
• Medications, symptoms, vitals, diary entries, appointments, menstrual cycle entries, and details about the participant's cancer that they add.
• Ask, an AI assistant that reads the information stored in the participant's Healthnotes record to answer their questions, and keeps a memory of earlier conversations that the participant can review, correct or remove.
• Short educational videos and the questions that follow them.
• Sharing: a participant can approve items for their care team and invite a caregiver. The app shows the participant who has access to their record and recent access to it, and the participant can withdraw what they shared.

Healthnotes can also read information from other apps and services, and does so only with a participant's explicit consent, granted separately for each source: calendar information, if the participant connects a calendar, which the app reads to suggest which events look like care appointments and to which it adds the appointments the participant confirms; the participant's own medical record, if they connect a patient portal such as MyChart, read through the health system's own sign-in and never written to; and health data from Apple Health or Health Connect, read category by category. On Android, Health Connect readings can continue in the background and can include earlier history. Healthnotes writes nutrition and water entries back to Apple Health or Health Connect when the participant asks it to. Health data can include reproductive health categories, named at the moment of consent because they are sensitive: menstruation flow, menstrual period, ovulation test results, cervical mucus observations and intermenstrual bleeding. They are collected because treatment can change a cycle, and that change is a treatment effect the study may need to see. A participant can revoke any category on its own at any time in the phone's health settings or in the app, and revocation stops new readings from that category immediately.

To provide these features, Burna AI uses the service providers listed in the How We Share Information section: Ask answers are produced by language model providers; files are stored with Cloudflare; and diagnostic events and error reports go to PostHog in the United States, with session recording turned off. A participant can export their records as a file, and can ask for their account to be deleted, from the app's settings.

For Healthnotes, the study site and the study sponsor determine what is collected, how long it is retained, and who may see it, under the study protocol and the informed consent form the participant signed. Burna AI processes that information on their instruction, under the executed agreement rather than under this Policy. A participant exercising a right over study information, including withdrawal from the study, does so through the research team named on the consent form, and Burna AI supports that team in responding.

Neither application collects device advertising identifiers, and neither builds a behavioral profile of a user for advertising purposes.

Questions about either application may be sent to [email protected]. Where a request concerns study or clinical information, Burna AI will direct it to the institution or research team responsible for that information.

Do-Not-Track Signals

Some browsers offer a "Do Not Track" ("DNT") setting that signals a user's preference not to be tracked across websites. Because there is no industry consensus on how to interpret DNT signals, the Website does not respond differently to DNT signals.

The Website does not change its behavior in response to Global Privacy Control signals. The tags that can be used for cross-context behavioral advertising load only after you choose Accept All on the cookie banner, and choosing Decline All, or making no choice, keeps them off, as described in the Cookies and Tracking Technologies section.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will provide notice by communicating the change by email to active contacts where we have a current business email address and the change is material to the relationship, and by posting a prominent notice on the Website at least 30 days in advance of the effective date of the change, except where a shorter period is required by law or to address security or legal risk.

The "Effective Date" at the top of this Policy indicates when the current version became effective. Continued use of the Website after the effective date constitutes acceptance of the updated Policy, to the extent permitted by law. Prior versions of this Policy will be made available on request to [email protected].

Contact Us

For questions about this Privacy Policy or about Burna AI's privacy practices, or to exercise any of the rights described above, please contact us using the details below. Where applicable law requires a Data Protection Officer or an EU or UK representative, those details are available on request.

If you are located in the EEA, the UK, or another jurisdiction with a supervisory authority, you may also lodge a complaint with your local data protection authority.