Privacy Policy of Echo Biotech

This Privacy Policy explains how Echo Biotech collects, processes, stores, protects and manages personal data submitted through its website and business services.

1. Introduction & Scope of Application

1.1 Echo Biotech (“we”, “us” or “our”) is an innovative high-tech enterprise dedicated to exosome R&D, GMP-grade large-scale exosome manufacturing, multi-omics testing and engineered exosome development. We operate the official website: https://www.echobiotech.com (the “Website”).

1.2 This Privacy Policy applies to all users (“you”) who access, browse, submit consultation forms, download materials, apply for technical services, purchase GMP exosome raw materials/research reagents, or participate in academic events via the Website.

1.3 By accessing or using the Website, you acknowledge that you have fully read, understood and agreed to all clauses of this Privacy Policy. If you disagree with any terms herein, you must cease using the Website immediately and refrain from submitting any personal data to us.

1.4 We adhere to six core data protection principles: lawfulness, fairness, necessity, transparency, data minimization and full-cycle security protection, to safeguard your personal information and commercial data.

2. Personal Data We Collect & Collection Channels

2.1 Information Voluntarily Submitted by You (Business Inquiry & Cooperation)

When you fill out consultation forms, communicate via email, negotiate cooperation, apply for testing services or customize CDMO engineered exosome services, we collect:

Basic identity data: full name, mobile number, email address, affiliated institute/hospital/university name, job title, business unified social credit code (corporate clients);

Business demand data: research directions, exosome experimental requirements, project plans, sample type & quantity, purchasing specifications, delivery terms, project budget;

Supplementary supporting documents: institutional qualification certificates, cooperation authorization papers, invoicing information (only for contract performance & tax invoice issuance).

2.2 Automatically Collected Device & Access Data (Cookies & Logs)

When you visit the Website, our system automatically collects non-sensitive access logs, including anonymized IP address, browser type, operating system, visited pages, dwell time, referral source, device identifier and blurred geographic location. We use Cookies to optimize browsing experience and analyze website traffic.

You may disable Cookies via browser settings; however, certain functions such as document download and online consultation may become unavailable after disabling Cookies.

2.3 Restriction on Sensitive Personal Data Collection

We will not proactively collect ID numbers, bank card details, medical records, genetic data, biometric identifiers or other sensitive personal data. If medical/research sample data is required for business purposes, we will sign a separate non-disclosure agreement and obtain your explicit written consent before processing such data.

3. Purposes of Processing Your Personal Data

We only process your data for the legitimate purposes notified upon collection and will never expand processing scope without new consent:

1. Respond to your inquiries and deliver products & technical services including exosome research reagents, GMP-grade exosome raw materials, multi-omics testing, customized engineered exosomes and CDMO large-scale manufacturing;

2. Perform contractual obligations: order coordination, sample delivery, report issuance, logistics, reconciliation and invoicing, after-sales technical support;

3. Academic & business communication: send industry whitepapers, latest extracellular vesicle journal publications, academic conferences and new product technical materials (you may opt out of marketing communications at any time);

4. Website optimization: traffic statistics, page function iteration and website bug fixing;

5. Compliance risk control: fulfill CNAS, ISO9001, FDA DMF compliance obligations and respond to regulatory inspections or legal investigations required by law;

6. Cybersecurity protection: identify malicious access, defend against cyberattacks and secure website & business data.

4. Rules for Sharing, Transfer & Disclosure of Personal Data

4.1 We will NOT sell, rent or trade any user personal data to third parties.

4.2 We may share your data only under the following limited scenarios, and all third parties shall sign strict confidentiality agreements with equivalent data security standards:

(1) Authorized service providers: server hosting vendors, logistics carriers, third-party testing labs, email delivery service providers; only necessary data for performance will be shared;

(2) Affiliated group entities: internal technical, production and sales teams for project coordination, limited to personnel with business access authorization;

(3) Mandatory legal requirements: competent authorities including judicial, market supervision, drug regulatory and cyberspace administrations submitting formal legal documents;

(4) Your separate written consent: you explicitly authorize us to share data with designated partners.

4.3 Cross-border data transfer: For overseas research institutions and EU clients, we will complete cross-border data compliance assessment before transferring your data outside China, obtain your explicit consent complying with GDPR, and implement encryption & anonymization safeguards.

5. Data Storage & Retention Period

5.1 Storage Security: All online data is stored with AES encryption. Our GMP workshops and server rooms adopt hierarchical access control, full operation log recording and regular vulnerability inspections; offline paper documents are stored in confidential archives with lock management.

5.2 Retention Terms:

Inquirers without signed cooperation: data retained for 3 years, anonymized or permanently deleted upon expiry;

Contracted cooperative clients: data retained for 5 years after contract termination, to meet CNAS and drug regulatory archiving legal requirements;

Data related to regulatory supervision or litigation: stored in accordance with statutory minimum retention periods.

5.3 Post-expiry Disposal: All data exceeding retention limits will undergo irreversible deletion or physical shredding with no recovery possibility.

6. Your Rights Over Personal Data

You may submit written requests via privacy@echobiotech.com. After identity verification, we will respond and resolve your requests within 15 working days, and you are entitled to the following rights:

6.1 Right to know & right of access: Enquire all personal data stored by us, processing purposes and shared third parties;

6.2 Right to rectification: Request revision or supplementation of inaccurate information;

6.3 Right to erasure: Request full deletion of your personal data after business termination or consent withdrawal;

6.4 Right to withdraw consent: Unsubscribe marketing emails/SMS and terminate data processing based on prior consent;

6.5 Right to restriction of processing: Request temporary suspension of data usage (excluding mandatory processing for regulatory compliance or contract performance);

6.6 Right to data portability: Request export of your submitted project & business documents in machine-readable format;

6.7 Right to lodge complaints: File objections regarding our data processing activities with local cyberspace regulatory authorities.

7. Minors Protection

The Website serves biomedical researchers and corporate business clients, and we do not provide services for individuals under 18 years old. If minors submit personal data without guardian consent, legal guardians may contact us for immediate data deletion.

8. Cookie Policy

8.1 We deploy functional and statistical Cookies only; no advertising tracking Cookies are used on the Website.

8.2 You may clear or reject Cookies via browser settings, but this may restrict online form filling and document download functions.

8.3 Third-party traffic analytics tools process anonymized IP data and cannot identify individual natural persons.

9. Privacy Policy Updates

9.1 We reserve the right to revise this Policy to comply with updated laws, regulations or business adjustments. Revised versions will be prominently displayed on the Website homepage.

9.2 Material changes (cross-border data rules, sensitive data processing adjustments) will be notified to existing cooperative clients via email.

9.3 Your continued use of the Website after updates constitutes acceptance of the revised clauses.

10. Data Security & Risk Disclaimer

10.1 We deploy industry-leading technical and administrative safeguards to protect data, yet absolute security of internet data transmission cannot be fully guaranteed. In case of confirmed data leakage, we will notify affected users and report to relevant regulatory authorities without delay.

10.2 Please refrain from uploading sensitive data such as ID cards, bank statements or complete medical records via consultation forms or emails.

11. Contact Information for Privacy Inquiries

Privacy Compliance Email: privacy@echobiotech.com

Entity Name: Echo Biotech (fill in full business registration name)

Address: GMP Industrial Park Office Address

Applicable Laws: Laws of the People’s Republic of China; GDPR for visitors located within the European Economic Area.

12. Dispute Resolution

Any disputes arising out of this Privacy Policy shall be resolved through amicable negotiation first. If negotiation fails, disputes shall be submitted to the people’s court with jurisdiction at our corporate domicile for litigation.