Privacy & Cookie Policy

Who we are

EpiAxis Therapeutics Pty Ltd ("EpiAxis", "we", "us", "our") is an oncology biotechnology company based in Australia. We operate the website at epiaxistherapeutics.com (the "website").

This policy explains what personal information we collect through the website or when you contact us, how we use and share it, and the choices you have. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the European Union or the United Kingdom, the section on your rights under the GDPR also applies to you.

If you have a question about this policy or your information, email enquiries@epiaxistherapeutics.com.

The short version

• You can read the whole website without telling us anything about yourself.
• We don't use advertising or social media tracking. The cookie banner lets you choose whether to allow anything beyond what the website needs to work, and nothing optional runs until you agree.
• If you email us, we use your details only to reply and to keep a record of the conversation.
• We don't sell personal information, and we don't share it for marketing.

Information we collect

When you contact us. If you email us, we receive your name, email address and anything you choose to include, such as your organisation, role, phone number or the reason for your enquiry (general, partnering, collaboration or investment).

When you visit the website. Like every website, ours is served by a hosting provider that keeps short-lived technical logs to deliver pages and protect the site from abuse. These logs can include your IP address, browser type, the page requested and the time of the request. We don't combine them with other information to identify you, and we don't run analytics on our visitors.

We don't collect sensitive information, such as health information, through the website. Please don't send us health information about yourself or anyone else.

How we use information

We use personal information to:

• reply to your enquiry and keep a record of our correspondence
• assess and progress partnering, collaboration and investment discussions you start with us
• keep the website secure and working, and investigate problems
• meet our legal obligations and enforce our rights

We don't use your information for direct marketing. If that ever changes, we will ask for your consent first and every message will include a way to unsubscribe.

Cookies

Cookies are small files a website stores in your browser. Similar technologies, such as your browser's local storage, work the same way, so this section covers both.

Your choice. When you first visit, a banner asks which cookies you allow. Strictly necessary cookies are always on, because the website can't work without them. Anything else stays off unless you turn it on. You can change your choice at any time with the cookie button in the corner of the page.

The banner is provided by Up Strategy Lab, the agency that builds and maintains the website. It remembers your choice in your browser's local storage (as usl_cookie_consent) for six months, and then asks again.

What we use today. The website currently sets only strictly necessary cookies:

• Your consent choice, as above.
• Website editors only. When an authorised EpiAxis editor logs in to update content, the website sets payload-token (keeps the editor logged in, for up to two hours), __prerender_bypass (shows unpublished drafts while previewing) and epiaxis-edit (turns on editing directly on the page). The last two expire at the end of the browser session. None of these is ever set for visitors.

We don't run analytics, advertising or social media tracking today. Our fonts are hosted on our own servers, so reading the site doesn't send your details to font providers either. If we add analytics later, it will only run if you allow it in the banner, and we will update this policy first.

Cookie declaration. The full, current list of cookies and similar technologies on the website is shown below this policy. It is produced by scanning the website regularly.

Managing cookies. You can also block or delete cookies in your browser settings. Doing so won't affect your use of the website as a visitor.

Who we share information with

We don't sell, rent or trade personal information. We share it only with:

• Service providers who run the website for us: Up Strategy Lab (website development, maintenance and the cookie consent tool), Vercel (hosting, content delivery and image storage) and Supabase (database). They process information only to provide their service to us and under contract.
• Our email provider, which stores the messages you send us.
• Professional advisers, such as lawyers and accountants, where we need their help.
• Authorities where the law requires it, or to protect the rights, safety or security of EpiAxis, our website or others.

If EpiAxis is involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner, who must protect it in line with this policy.

Overseas disclosure

Some of our service providers store or process information outside Australia, including in the United States (Vercel) and the European Union (Supabase and Up Strategy Lab, in Sweden). We take reasonable steps to make sure overseas providers handle personal information in a way that is consistent with the Australian Privacy Principles.

How long we keep information

We keep correspondence for as long as we need it to deal with your enquiry and any relationship that follows, and then for as long as the law requires us to keep business records. Hosting logs are kept by our provider for a short period, typically days, for security and troubleshooting. When we no longer need information, we delete or de-identify it.

Security

We protect personal information with reasonable technical and organisational measures. The website is served only over encrypted connections (HTTPS), access to our systems is limited to people who need it, and editor accounts are protected against repeated login attempts. No system is completely secure, so please think about what you choose to send us by email.

Accessing and correcting your information

You can ask to see the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date or incomplete. Email enquiries@epiaxistherapeutics.com. We may need to confirm your identity first, and we will respond within a reasonable time, usually 30 days.

Your rights in the EU and UK

If you are in the European Union or the United Kingdom, the GDPR also gives you the right to:

• access, correct or delete your personal data
• restrict or object to how we process it
• receive it in a portable format
• withdraw consent at any time, where we rely on consent

We process personal data on the following legal bases: to take steps at your request before entering into an agreement (replying to your enquiry), our legitimate interests (running and securing the website, and progressing discussions you start with us), and legal obligation.

Complaints

If you have a concern about how we handle your personal information, please contact us first at enquiries@epiaxistherapeutics.com so we can try to resolve it. We will respond within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. If you are in the EU or UK, you can also contact your local data protection authority.

Children

The website is not directed at children, and we don't knowingly collect personal information from anyone under 16.

Links to other websites

The website links to other sites, such as LinkedIn and our collaborators' websites. We don't control those sites and aren't responsible for their privacy practices, so please read their policies.

Changes to this policy

We may update this policy from time to time, for example if we add new features to the website. The date at the top of the page shows when it was last changed.