VOKA Privacy Policy

This Policy applies to the voka.io website and to the business communications you have with us through it — contact and demo request forms, call bookings, and email correspondence.

This Policy does not apply to:

• the VOKA 3D Anatomy & Pathology mobile applications, which are governed by their own in-app privacy notice and by the privacy practices of the App Store, Google Play, and HUAWEI AppGallery;
• third-party websites, platforms or services that we link to, each of which has its own privacy notice;
• personal information we process on behalf of a client under a separate services agreement, where the client is the controller and its own privacy notice applies.

If you do not agree with this Policy, please do not use the Website.

2.1 Information you provide to us

You can browse most of the Website without giving us any personal information. We collect the following when you choose to submit it:

• Contact and inquiry data — your name, email address, phone number, company, country, and the content of your message when you complete a contact form, request a quote, or otherwise write to us.
• Scheduling data — when you book a call with us, the name, email address and time slot you enter on our scheduling page. See Section 10.
• Correspondence — records of our email and other written exchanges with you.

2.2 Information collected automatically

When you visit the Website, we and our service providers may automatically collect:

• Device and connection data — IP address, browser type and version, operating system and device type, screen resolution, language settings, and internet service provider.
• Usage data — pages viewed, referring and exit pages, time and duration of visits, clicks, and scroll depth.
• Interaction recordings and heatmaps — where you allow statistics cookies, our analytics providers record how visitors interact with individual pages, including mouse movement, clicks, taps and scrolling, and combine these into heatmaps and session recordings used to diagnose usability problems. Our providers apply masking to text entered into form fields, and we do not use these recordings to identify individual visitors.
• Campaign parameters — the marketing campaign, referrer and click identifiers attached to the link you arrived through, used to attribute your visit to the campaign that generated it.
• Approximate location — country and, in some cases, region or city, derived from your IP address. We also store your approximate location so that the correct consent rules for your jurisdiction are applied. We do not collect precise GPS location from the Website.

This data is collected through cookies and similar technologies as described in Section 5. Most of it is aggregated or pseudonymized; where it can be linked to you, we treat it as personal information.

2.3 Information from third parties

We may receive information about you from:

• analytics and advertising providers, which supply aggregated audience and campaign data;
• professional and business networks (for example, LinkedIn) where you interact with our content or advertising;
• publicly available sources and business databases, where we verify or supplement business contact details of professional contacts in the healthcare, pharma and life sciences sectors.

2.4 Sensitive and special category data

We do not ask for and do not intentionally collect special category or sensitive personal information through the Website — including data about your health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data, precise geolocation, or government identification numbers. We also do not collect information about criminal convictions or offences.

Please do not include health information about yourself or any other person in messages you send us through the Website. If you do send us such information, we will delete it as soon as we reasonably can.

3.1 To respond to you and arrange our work together

• Answering your inquiries and quote requests, and giving you information about our services
  • - Data used: contact and inquiry data, correspondence.
  • - Legal basis (EEA/UK): performance of a contract, or our legitimate interest in responding to business inquiries.
• Arranging and holding the calls and meetings you request
  • - Data used: scheduling data, contact and inquiry data.
  • - Legal basis (EEA/UK): steps taken at your request before entering into a contract, or performance of a contract.

3.2 To run, secure and maintain the Website

• Keeping the Website running, protecting our forms against spam and automated abuse, and storing your cookie choices
  • - Data used: device and connection data, usage data, approximate location.
  • - Legal basis (EEA/UK): legitimate interest in the security and integrity of our systems; legal obligation to record your consent.

3.3 To understand and improve the Website

• Measuring and improving Website performance, content and user experience, including heatmaps and session recordings
  • - Data used: usage data, interaction recordings, approximate location.
  • - Legal basis (EEA/UK): consent.

3.4 To market our services

• Occasionally writing to you about our services after you have contacted us
  • - Data used: contact and inquiry data.
  • - Legal basis (EEA/UK): legitimate interest in business-to-business marketing where permitted by applicable law; consent where it is required.
• Measuring and optimizing our advertising campaigns, and delivering advertising on third-party platforms
  • - Data used: usage data, device data, campaign parameters, third-party campaign data.
  • - Legal basis (EEA/UK): consent.

3.5 To meet our legal obligations

• Complying with legal, tax and accounting requirements, and establishing or defending legal claims
  • - Data used: all of the above, as relevant.
  • - Legal basis (EEA/UK): legal obligation; legitimate interest in protecting our legal rights.

We do not use your personal information for automated decision-making that produces legal effects concerning you, and we do not build profiles about you other than as described in this Policy.

We do not sell your personal information. We disclose it only in the following circumstances:

• Service providers and processors — companies that provide hosting and infrastructure, website and form functionality, call scheduling, IT support and professional services (legal, accounting, audit). They act on our instructions under written agreements and may not use your information for their own purposes.
• Analytics providers — the providers named in Section 5, which process Website usage data on our behalf where you allow statistics cookies.
• Advertising and social media platforms — the platforms named in Section 5, which receive information about your interaction with the Website in order to measure our campaigns and deliver advertising to you, where you allow marketing cookies.
• Software development and technical service partners — vendors engaged to build, maintain and support the Website and our internal systems, acting as our processors under contract.
• Corporate transactions — in connection with a merger, acquisition, financing, reorganization or sale of assets, to the parties involved and their advisers, subject to confidentiality.
• Legal and regulatory disclosure — to law enforcement, regulators, courts or other third parties where we believe disclosure is necessary (a) to comply with applicable law or a lawful request, (b) to exercise, establish or defend our legal rights, or (c) to protect the vital interests of you or another person.
• With your consent — to any other recipient you direct or agree to.

We and our service providers use cookies, pixels, tags, local storage and similar technologies (collectively, "cookies") on the Website. We group them into three categories, matching the categories in our cookie preference centre:

• Essential — required for the Website to function and to record your privacy choices: page delivery, session management, protection against spam and automated abuse, storage of your cookie preferences, and storage of your approximate location so that the correct consent rules are applied.
• Statistics — help us understand how visitors find and use the Website, including heatmaps and session recordings. Set only with your consent.
• Marketing — used to measure campaign performance and to deliver relevant advertising to you on other websites and platforms. Set only with your consent.

5.1 Providers we use

• Essential
  • - Google reCAPTCHA — distinguishes human visitors from automated bots on Website forms and performs risk analysis.
• Statistics
  • - Google Analytics 4 — aggregated Website traffic and behaviour measurement: sessions, page views, traffic sources, device and approximate location.
  • - Microsoft Clarity — heatmaps and session recordings used to diagnose usability problems.
  • - Yandex Metrica — Website traffic measurement and analysis of visitor activity and sessions.
• Marketing
  • - Meta Pixel (Facebook Pixel) — measures the performance of our advertising on Facebook and Instagram and builds advertising audiences.
  • - Google Ads — measures advertising conversions and enables remarketing audiences.
  • - LinkedIn Insight Tag — measures the performance of our LinkedIn advertising and reports aggregated audience characteristics.
  • - OpenAI (ChatGPT Ads Measurement Pixel) — measures conversions from our advertising in ChatGPT: when you arrive after clicking a ChatGPT advert, the pixel stores a click reference so that a later inquiry can be matched to that advert.

Our cookie preference centre lists each of these providers with the individual cookies it sets, their purpose and their lifetime, and links to the provider's own privacy information. Open it from the Cookie settings link in the Website footer.

5.2 Your choices

When you first visit the Website, we ask for your cookie choices through a banner, and we set statistics and marketing cookies only after you accept them. Until you make a choice, only essential cookies are set. Where the law of your jurisdiction requires consent, that consent is always requested before any non-essential cookie is set.

You can review or change your choices at any time — including withdrawing consent you previously gave — through the Cookie settings link in the Website footer, which opens the preference centre and lets you switch the Statistics and Marketing categories on or off individually.

You can also control cookies through your browser settings, which allow you to block or delete cookies already stored on your device. If you reject non-essential cookies, the Website will continue to work, though some features may be limited.

The Website does not respond to browser "Do Not Track" signals, as no common industry standard for them has been adopted. We do honour the Global Privacy Control (GPC) signal: where your browser sends a GPC signal, we automatically decline non-essential cookies for your visit and treat that signal as an opt-out of targeted advertising and of the sharing of personal information. You can review or change your choices at any time as described in Section 5.2.

VOKA INC. is established in the United States, and we work with service providers and technical partners located in the United States, the European Union and other countries. Your personal information may therefore be transferred to, stored in and processed in a country other than the one in which you reside, including countries whose data protection laws differ from those of your own and, in some cases, countries that have not been recognised by the European Commission as providing an adequate level of protection.

Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards — primarily the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable) — together with technical and organizational measures assessed on a case-by-case basis. You can request further information about these safeguards by writing to info@voka.io.

We keep personal information only for as long as necessary for the purposes it was collected for, including to satisfy legal, accounting, tax or reporting requirements, and to resolve disputes or enforce our agreements.

In determining the retention period we consider the volume, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes of processing, whether those purposes can be achieved by other means, and applicable legal requirements. As a general rule:

• contact and inquiry data — retained for the duration of the business relationship and for 3 years afterwards;
• marketing contact details — retained until you ask us to stop writing to you, plus a short period to record your request;
• website analytics data — retained for 14 months;
• heatmaps and session recordings — retained for no more than 12 months from the visit;
• your cookie preferences — retained for 6 months from your choice, and the record of the consent rules applied to your location for 30 days, after which we ask again.

When personal information is no longer needed, we delete it or irreversibly anonymize it.

We apply technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss and destruction. These include encryption of data in transit, access controls that limit access to personnel who need it for their work, network and infrastructure protection, logging, and confidentiality obligations for staff and vendors.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We maintain procedures for handling suspected personal data breaches and will notify you and any competent regulator where we are legally required to do so.

Booking a call. The "Book a call" links on the Website take you to a scheduling page hosted by Brevo, our scheduling provider. You enter your details on that page, where Brevo's own privacy notice applies, and Brevo passes the booking to us so that we can hold the call. Brevo acts on our behalf under a written agreement in relation to that booking.

Emails from us. We do not operate a newsletter, and there is no way to subscribe to one on the Website. If you have contacted us — through a form, by booking a call, or by email — we may occasionally write to you about VOKA services, products and events relevant to the inquiry you made, using the contact details you gave us. These emails are sent from our own mailbox.

You can ask us to stop at any time by replying to any such email or by writing to info@voka.io. This does not stop transactional or service-related messages, such as replies to your enquiries or confirmation of a call you booked.

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the right to:

• access the personal information we hold about you and receive a copy of it;
• rectify inaccurate or incomplete information;
• erase your personal information where there is no overriding lawful basis for us to keep it;
• restrict our processing in certain circumstances;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• data portability — receive the information you provided to us in a structured, commonly used, machine-readable format;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with your local supervisory authority.

To exercise any of these rights, write to info@voka.io. We may ask for information to verify your identity. Exercising your rights is free of charge, though we may charge a reasonable fee or decline to act on requests that are manifestly unfounded, repetitive or excessive. We aim to respond to all legitimate requests within one month and will tell you if we need longer because a request is complex or because you have made several requests.

This section applies to residents of US states with comprehensive privacy laws, including California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas and other states as their laws take effect.

12.1 Categories of personal information we collect

In the twelve months preceding the date of this Policy, we have collected the following statutory categories of personal information through the Website:

• Identifiers — name, email address, phone number, IP address, online identifiers.
• Commercial information — records of the services you inquired about or considered.
• Internet or other electronic network activity information — browsing and interaction data on the Website, including heatmaps and session recordings, referring sources, campaign identifiers, and interaction with our advertising.
• Geolocation data — approximate location derived from IP address.
• Professional or employment-related information — job title and employer or institution, where you provide them.
• Inferences — limited inferences about your professional interests, drawn from the pages you view and the materials you request.

We collect this information from you directly, automatically through your use of the Website, and from the third-party sources described in Section 2.3. We use and disclose it for the purposes set out in Section 3 and to the categories of recipients set out in Section 4.

12.2 Sensitive personal information

We do not collect or process sensitive personal information as defined by the CCPA, and we do not use or disclose personal information for purposes that would require an additional right to limit under California law.

12.3 Sale, sharing and targeted advertising

We do not sell personal information for monetary consideration, and we do not knowingly sell or share the personal information of individuals under 16 years of age.

Where you allow marketing cookies, we disclose Website usage data to the advertising and social media platforms named in Section 5 so that they can measure our campaigns and deliver advertising to you. Under California law these disclosures qualify as "sharing" for cross-context behavioral advertising, and under other state laws as "targeted advertising".

You can opt out of these disclosures at any time by switching off the Marketing category in the preference centre, reachable from the Cookie settings link in the Website footer, by sending a Global Privacy Control signal from your browser, or by writing to info@voka.io.

12.4 Your rights

Subject to your state of residence, you have the right to:

• know what personal information we collect, use and disclose about you, and to request access to it in a portable format;
• request deletion of your personal information;
• request correction of inaccurate personal information;
• opt out of targeted advertising, and of the sale or sharing of personal information;
• not be discriminated or retaliated against for exercising any of these rights;
• appeal a decision we make on your request, where your state law provides for an appeal.

Submit requests to info@voka.io. We will verify your identity before acting on a request, using the information we already hold about you. An authorized agent may submit a request on your behalf with proof of authorization. We will respond within the timeframe required by applicable law, generally 45 days, with one extension where permitted.

12.5 California "Shine the Light" and Nevada residents

California Civil Code Section 1798.83 permits California residents to request, once a year and free of charge, information about the categories of personal information we disclosed to third parties for their direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada residents may submit a verified request that we not sell certain covered personal information. We do not sell covered information as defined by Nevada law, but you may submit a request to info@voka.io.

This Website is intended for medical, scientific and business professionals, students and other adults. It is not directed to children, and we do not knowingly collect personal information from children under 13 years of age through the Website, or under 16 where a higher age applies under local law. If we learn that we have collected personal information from a child below the applicable age through the Website without the required parental consent, we will delete it promptly. If you believe a child has provided us with personal information, please contact info@voka.io.

Our mobile applications are outside the scope of this Policy and are governed by their own in-app privacy notice and by the age settings of the App Store and Google Play.

VOKA provides 3D medical and scientific visualization content, software and services for educational, informational, professional and marketing purposes. VOKA is not a healthcare provider, does not practice medicine, and does not provide medical advice, diagnosis or treatment. Content available on or through the Website must not be used as a substitute for consultation with a qualified healthcare professional.

We do not collect, host or process protected health information (PHI) about you through the Website, and we do not act as a HIPAA covered entity or business associate in relation to the Website. Where VOKA processes health-related or patient data as part of a client engagement, that processing is governed by the agreement with the relevant client — including a business associate agreement or data processing agreement where applicable — and not by this Policy.

The Website contains links to, and embedded content from, third-party websites, platforms and applications, including app stores, video platforms, social networks and the Brevo-hosted page used to book calls with us. We do not control their content or privacy practices, and this Policy does not apply to them. We encourage you to review the privacy policy of any third-party service you interact with.

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, provide additional notice on the Website or by email. Your continued use of the Website after an update takes effect constitutes acceptance of the revised Policy.

Please keep us informed if the personal information we hold about you changes, so that our records stay accurate and current.

For any question about this Policy or about how we handle personal information, or to exercise any of your rights, contact us at:

VOKA INC.
50 Franklin Street, STE 203
Boston, MA 02110
United States

Email: info@voka.io
Phone: +1 814 351 4442
Website: https://voka.io/