Privacy Policy

1. Personal Information We Collect

A. Information You Provide Directly

Account Registration: When you create or update an account on Herbalytics or Growlytics, we collect your name, email address, username, password, phone number, organization or institution, country, and preferred communication method.

Purchases & Service Requests: When you request access to paid features, submit a research inquiry, or complete a transaction, we collect your name, email address, billing and shipping address, phone number, order details, and payment information. Payment details are processed by PCI-compliant third-party processors and are not stored on our servers.

Platform-Generated Data:

• Herbalytics: Plant records, compound notes, clinical consultation entries, patient outcome records (de-identified), research study data, formulation designs, and interaction checker queries you submit within the platform.
• Growlytics: Plant profiles, growth logs, photos, measurements, health scores, environmental conditions, location (region/climate zone), and community posts you contribute.

Marketing & Communications: When you sign up for newsletters or promotional communications, we collect your email address, name, organization, product interests, and engagement data such as email open rates and link clicks.

Customer Support: When you contact us, we collect your name, email, contact details, and the content of your message.

B. Information Collected Automatically

As you use our Services, we automatically collect technical and usage information through log files, cookies, and similar technologies, including:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device type and screen resolution
• Pages visited, features used, and time spent
• Referring URLs and navigation paths
• Search queries made within the Services

C. Information from Third Parties

We may receive personal information from third-party sources, including:

• Social Networks: If you connect or interact with our content via platforms such as LinkedIn, we may receive profile information, user IDs, and engagement data.
• Analytics Providers: Aggregated demographic and behavioral data from analytics services we use to improve our Services.
• Public Scientific Databases: For Herbalytics, we integrate publicly available natural product and botanical databases (e.g., LOTUS) that may include attributed research contributions.
• Business Partners: Professional contact information from partners, vendors, or collaborators who refer users to our Services.

2. How We Use Personal Information

Pham Holdings uses the personal information we collect to:

• Provide, operate, and improve our Services, including PhamBioscience.com, Herbalytics, and Growlytics
• Create and manage your user account and authenticate access
• Process transactions and fulfill service requests
• Send you administrative notices, service updates, and security alerts
• Deliver personalized content, research recommendations, and platform features tailored to your usage
• Send marketing communications about our products and services where you have consented or where we have a legitimate interest in doing so
• Conduct research, analyze usage trends, and improve platform performance and user experience
• Aggregate and anonymize data to contribute to open bioscience research and platform intelligence
• Detect, prevent, and respond to fraud, abuse, security incidents, or illegal activity
• Comply with applicable laws, regulations, and legal obligations
• Enforce our Terms of Service and other applicable agreements

Legal Basis for Processing (EEA Users)

If you are located in the European Economic Area, we process your personal information only when we have a valid legal basis, including:

• Consent: Where you have freely given, specific, and informed consent. You may withdraw consent at any time without penalty, with future effect.
• Contract Performance: Where processing is necessary to provide Services you have requested or to fulfill a contractual obligation.
• Legal Obligation: Where processing is required to comply with applicable tax, regulatory, or legal requirements.
• Legitimate Interests: Where we have a legitimate business interest, such as improving the safety, security, and performance of our Services, provided those interests are not overridden by your fundamental rights.

3. Cookies & Tracking Technologies

Technologies We Use

Cookies are small text files placed on your device when you visit our Services. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired).

Web Beacons are small graphic images embedded in pages or emails that help us understand user behavior and measure engagement.

Embedded Scripts collect interaction data temporarily to analyze how you use our Services.

What We Collect via Cookies

• Browser and device information (type, resolution, operating system)
• Actions taken on our Services (pages viewed, features clicked, downloads)
• IP address and session duration
• Traffic sources and referral URLs

Purposes

We use tracking technologies to maintain your login session, personalize your experience, measure feature adoption, diagnose technical issues, and serve relevant content and advertising. We may use data to recognize you across multiple devices or sessions.

Google Analytics

We use Google Analytics to understand how users interact with our Services. Google Analytics may transmit information, including your IP address, to Google servers in the United States. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Your Cookie Choices

Most browsers allow you to refuse or delete cookies through their settings. You may also opt out through any cookie consent banner displayed on our Services. Please note that disabling cookies may limit certain features or functionality.

4. When We Disclose Personal Information

We do not sell your personal information. We may share it in the following circumstances:

Service Providers: We engage trusted third-party vendors to support our operations, including cloud hosting, email delivery, payment processing, customer support, analytics, and security monitoring. These providers access personal information only as necessary to perform their services and are bound by confidentiality obligations.

Affiliated Companies: We may share information with subsidiaries and affiliates of Pham Holdings Inc. that operate under privacy practices equivalent to or stronger than this policy.

Business Transactions: If Pham Holdings is involved in a merger, acquisition, asset sale, joint venture, or reorganization, personal information may be transferred to the relevant third parties as part of that transaction. We will notify you via email or a prominent notice on our Services before your information is transferred and becomes subject to a different privacy policy.

Legal Compliance & Protection: We may disclose personal information when required by law, court order, or governmental authority, or when we reasonably believe disclosure is necessary to protect the rights, property, or safety of Pham Holdings, our users, or the public.

With Your Consent: We may share your information for any other purpose with your explicit consent.

Aggregated or De-identified Data: We may share aggregated, anonymized data that cannot reasonably identify you for research publications, platform benchmarks, or product improvement purposes — including contributions to open bioscience initiatives.

5. International Data Transfers

Pham Holdings Inc. is headquartered in the United States, and our servers are located in the United States. If you are located outside the United States, your personal information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards for international transfers, including:

• Transfers to countries recognized by the European Commission as providing adequate protection
• Standard Contractual Clauses approved by the European Commission
• Other legally recognized transfer mechanisms as applicable

You may request a copy of the transfer safeguards we have in place by contacting us using the details in Section 11.

6. Data Security & Retention

We maintain administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encrypted data transmission (TLS/HTTPS), access controls, secure credential storage, and regular security assessments.

We retain personal information for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. Factors we consider when determining retention periods include:

• The nature of the product or service provided
• The duration of our relationship with you
• Whether deletion would impact your access to Services
• Mandatory legal, regulatory, or contractual retention requirements
• Applicable statutes of limitations

When personal information is no longer required for its original purpose and no legal obligation requires us to retain it, we will securely delete or anonymize it.

7. Your Rights & Choices

Marketing Opt-Out

You may unsubscribe from marketing communications at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at privacy@phambioscience.com. Please note that even if you opt out of marketing messages, you will continue to receive transactional and operational communications related to your account.

Cookie Controls

You can manage cookie preferences through your browser settings or through the cookie consent tool displayed on our Services. Opting out of certain cookies may affect your ability to use some features.

Account Data Access & Correction

You may review, update, or correct your account information at any time through your account settings within Herbalytics or Growlytics, or by contacting us directly. We will respond to reasonable requests in good faith and as required by applicable law.

Rights for EEA Residents

If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal information in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected.
• Right to Restriction: Request that we limit how we process your data in specific situations.
• Right to Data Portability: Request a machine-readable copy of your data to transfer to another service provider.
• Right to Object: Object to processing based on legitimate interests, or to direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time at no cost, with future effect.

To exercise any of these rights, please contact us at privacy@phambioscience.com. You also have the right to lodge a complaint with your local data protection authority. We encourage you to contact us first so we can try to resolve your concern directly.

California Residents (CCPA)

California residents have specific rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how it is used, the right to request deletion of your personal information, the right to opt out of the “sale” of personal information, and the right not to be discriminated against for exercising your rights. Pham Holdings does not sell personal information as defined under the CCPA. To submit a California privacy request, contact us at privacy@phambioscience.com.

Nevada Residents

Nevada residents may request that their personal information not be sold. While Pham Holdings does not engage in the sale of personal information for monetary consideration, Nevada residents may submit an opt-out request to privacy@phambioscience.com.

Other Jurisdictions

Depending on your country of residence, you may have additional rights under applicable local law, including the right to access, correct, restrict, object to, or delete your personal information, or to lodge a complaint with a relevant supervisory authority. To exercise any such rights, please contact us using the details below.

8. Links to Other Services

Our Services may contain links to third-party websites, applications, or platforms. The fact that we link to or integrate with a third-party service does not constitute an endorsement, authorization, or representation of affiliation with that third party. We have no control over, and assume no responsibility for, the privacy practices or content of any third-party services.

We encourage you to read the privacy policies of any third-party services you visit before providing any personal information.

9. Limitation of Liability

While Pham Holdings takes reasonable commercial steps to protect personal information from unauthorized access, use, or disclosure, we cannot guarantee the absolute security of any information transmitted to or stored within our Services.

Nothing in this section is intended to limit any rights you may have under applicable consumer protection or data protection laws.

10. Policy Modifications

Pham Holdings may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting a prominent notice on our Services, sending an email to the address associated with your account, or through other appropriate communication channels.

The date of the most recent update is displayed at the top of this page. We encourage you to review this policy periodically. Your continued use of our Services after any changes indicates your acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: