1. Scope and responsibility

This Privacy Policy explains how Hoodin AB, organisation number 556911-9778, Humlegatan 4, 211 27 Malmö, Sweden, processes personal data in connection with Compliance Studio.

It covers the application and related account, subscription and service communications. It does not cover general browsing of Hoodin’s external websites, which is addressed in the relevant website privacy information.

Hoodin acts as:

• Data controller where it determines the purposes and means of processing, including its own account administration, customer communications and service security.

• Data processor where it processes personal data in customer-controlled project content on the customer organisation’s behalf.

Processing performed as a processor is governed by the applicable data processing provisions. Individuals seeking to exercise rights concerning customer-controlled content should normally contact the relevant customer organisation. Hoodin assists that organisation as required.

2. Personal data processed

The personal data involved depends on how the service is used.

Compliance Studio is not intended for patient records, clinical trial subject data or sensitive health information. Users should avoid including unnecessary personal data in regulatory content.

3. Purposes and legal bases

Where Hoodin acts as controller, processing is based on the purpose and circumstances concerned.

Hoodin assesses legitimate-interest processing against the rights and interests of the individuals concerned.

Where Hoodin acts as processor, it processes personal data on the customer’s documented instructions. The customer is responsible for determining the appropriate legal basis for that processing.

Providing an email address is necessary to establish an account. Without it, Hoodin cannot provide that account.

4. AI-supported processing

Compliance Studio uses OpenAI’s Responses API to provide AI-supported functionality.

Information sent for processing can include user questions, product or company information, rationale and other context relevant to the function. If that information contains personal data, those personal data may also be processed by OpenAI.

Optional data-sharing settings for model training are disabled in Hoodin’s OpenAI configuration. Inputs and outputs are not shared for model training through those optional settings.

OpenAI may retain response data and associated logs under the applicable API service arrangements. Disabled model-training sharing does not mean that no provider-side storage occurs.

AI-supported functionality is intended to assist professional regulatory work. It is not intended to make solely automated decisions producing legal or similarly significant effects on individuals.

Further information about the role and limitations of AI is provided in the AI Literacy Statement. Technical processing arrangements are described in Security & data handling overview.

5. Recipients and service providers

Personal data may be disclosed to the providers needed to operate the relevant functions.

Authorised Hoodin personnel may access information where required for operation, maintenance, troubleshooting or handling customer requests.

Information may also be disclosed to professional advisers or competent authorities where necessary and legally permitted or required.

Recipients may act as processors, subprocessors or independent controllers, depending on their activities. Relevant subprocessor information and contractual arrangements apply where processing is performed on the customer’s behalf.

Hoodin does not sell personal data.

6. Payments

Subscription purchases are sold through Link, LLC, 354 Oyster Point Boulevard, South San Francisco, California 94080, United States.

Payment information is handled through the external checkout and relevant payment providers. Hoodin does not have access to full payment card details.

Processing performed by Link, LLC and payment providers for their own purposes is governed by their applicable privacy information. Hoodin remains the provider and operator of Compliance Studio.

7. Processing locations and international transfers

Compliance Studio’s primary production application and database are hosted on AWS within the European Union.

External services, including AI and payment services, may involve processing outside the European Economic Area. Primary EU hosting does not establish that all processing remains within the EEA.

Where personal data are transferred outside the EEA, Hoodin must establish the applicable transfer basis, such as an adequacy decision or appropriate safeguards, including Standard Contractual Clauses where relevant.

Information about applicable processing locations and transfer safeguards, including how to obtain a copy of relevant safeguards subject to necessary redactions, can be requested through Contact Hoodin.

8. Retention and deletion

Active accounts and subscriptions

Personal data are retained to the extent necessary for the relevant purposes and applicable obligations.

Downgrading a paid subscription to freemium does not close the account or itself trigger deletion. Information may remain necessary to provide the continuing service.

Inactive freemium accounts

For freemium accounts that have been inactive for 12 months, Hoodin will send an email asking whether the user wishes to retain the account.

Unless the user logs in or confirms within 30 days, the account will be closed and deleted. Information in shared projects is assessed separately so that closing one account does not improperly remove information required by other authorised users or the customer organisation.

Requests for closure or deletion

Compliance Studio does not provide self-service account deletion. Users can request closure or deletion through Contact Hoodin. Requests are handled manually, following appropriate identity and authority checks.

An individual account request is distinguished from an instruction to delete an organisation’s shared project.

Other retention considerations

Service correspondence and security records are retained according to their continuing operational, security or legal purpose. Information required for statutory obligations or legal claims may be retained separately where justified.

Deletion from active systems is distinct from expiry of backup copies. Provider-side records are subject to the applicable processing and retention arrangements. Customer-controlled personal data are also subject to the applicable data processing provisions and customer instructions.

9. Security

Production data are encrypted at rest, and production communications are protected using TLS.

Access to project information is controlled through authentication and project permissions. Administrative AWS access is protected by two-factor authentication.

No service can guarantee absolute security. Further information about implemented arrangements, backups and access is provided in Security & data handling overview.

Where Hoodin acts as controller, it assesses and fulfils applicable personal data breach notification obligations. Where it acts as processor, it notifies and assists the customer in accordance with applicable law and data processing provisions.

10. Cookies and analytics

Compliance Studio does not currently use cookies or analytics tools.

This statement does not cover external websites, identity-provider login pages or payment pages.

Hoodin may introduce analytics to understand service usage and improve functionality. Before introducing such processing, Hoodin will update the relevant privacy information, establish the appropriate legal basis and obtain consent where required. This policy does not provide advance consent to future tracking.

11. Individual rights

Subject to the conditions and exceptions in applicable law, individuals may request:

• Access to their personal data.

• Correction of inaccurate or incomplete information.

• Erasure.

• Restriction of processing.

• Portability where applicable.

• Objection to processing based on legitimate interests.

• Withdrawal of consent where processing relies on consent.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Requests can be submitted through Contact Hoodin. Hoodin may request information reasonably necessary to verify identity.

Hoodin responds without undue delay and normally within one month. Where a lawful extension is necessary, the individual will be informed within that period, including the reasons.

Where the request concerns processing controlled by a customer organisation, Hoodin will direct or refer the request to that organisation as appropriate.

Individuals may lodge a complaint with the Swedish Authority for Privacy Protection, IMY, or another competent supervisory authority. Information is available at www.imy.se.

12. Changes to this policy

Hoodin may update this policy to reflect changes in processing or applicable requirements.

Material changes will be communicated directly to affected users through an appropriate service notification or email. Where relevant, information will be provided before the changed processing begins.

Publication of an updated policy does not, by itself, establish consent to processing that requires consent.

13. Contact

Hoodin AB

Organisation number: 556911-9778

Humlegatan 4

211 27 Malmö

Sweden

Contact Hoodin