Privacy & Data Protection Policy

Last updated: 19 December 2025

This Privacy & Data Protection Policy explains how Cobalt Oak, Zurich, Switzerland (“Company”, “we”, “us”, “our”)
collects, uses, discloses, and protects personal data when you access or use the
Cobalt Oak Platform (the “Platform”).

This Policy applies to all users of the Platform, including visitors, registered users,
and subscribers.

1. Data Controller

The data controller responsible for the processing of your personal data is:

Cobalt Oak
Zurich, Switzerland
contact@cobaltoak.com

2. Personal Data We Collect

We may collect the following categories of personal data:

• Identification and contact data, such as name, email address, organisation, and professional role;
• Account and subscription data, such as login credentials, access level, billing status, and membership information;
• Usage data, such as pages viewed, features used, searches performed, and interaction with platform content;
• Technical data, such as IP address, browser type, device information, operating system, and access logs;
• Communications, such as emails, support requests, or messages you send to us.

We do not intentionally collect sensitive personal data, patient data, or health data.

3. How We Use Your Data

Your personal data is processed for the following purposes:

• to provide, operate, and secure the Platform;
• to manage user accounts, memberships, subscriptions, and billing status;
• to provide access to company profiles, signals, analytics, and research content;
• to improve platform functionality, data quality, and user experience;
• to communicate with you regarding the Platform, account access, updates, or support requests;
• to monitor misuse, protect platform integrity, and comply with legal obligations.

4. Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

• your consent;
• performance of a contract;
• compliance with legal obligations;
• our legitimate interests in operating, improving, and securing the Platform.

5. Data Sharing and Disclosure

We do not sell your personal data.

We may share personal data with trusted service providers, including hosting providers,
analytics providers, payment processors, security tools, email systems, and technical
infrastructure providers, strictly for operating the Platform.

These providers process data subject to confidentiality obligations and applicable data
protection requirements.

Personal data may also be disclosed if required by law, regulation, court order, or competent authority.

6. International Data Transfers

Some service providers may process personal data outside Switzerland or the European Economic Area.
Where applicable, we use appropriate safeguards, including contractual protections consistent
with applicable data protection laws.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in
this Policy, maintain platform records, comply with legal obligations, resolve disputes,
and enforce agreements.

8. Data Security

We implement appropriate technical and organisational measures to protect personal data
against unauthorised access, loss, misuse, alteration, or disclosure.

However, no digital platform, transmission system, or storage environment can be guaranteed
to be completely secure.

9. Your Rights

Subject to applicable law, you may have the right to:

• access your personal data;
• request correction or deletion;
• object to or restrict processing;
• withdraw consent at any time;
• request data portability;
• lodge a complaint with a competent data protection authority.

To exercise your rights, contact us at contact@cobaltoak.com.

10. Cookies and Tracking

The Platform may use cookies or similar technologies for essential functionality,
analytics, performance optimisation, and security.

Where required by applicable law, non-essential cookies are used only with your consent.

You can control cookies through your browser settings or through the cookie preferences
tool available on the website, where applicable.

11. Third-Party Links

The Platform may contain links to third-party websites, databases, publications, or services.
We are not responsible for their content, security, or privacy practices.

12. Platform Content and Company Data

The Platform may include publicly available or manually curated information about companies,
products, regulatory signals, clinical evidence, funding activity, and market developments.

Where such information relates to identifiable individuals, we process it only where relevant
to the legitimate operation of the Platform and subject to applicable data protection law.

13. Changes to this Policy

We may update this Privacy & Data Protection Policy from time to time.
The updated version will be published with a revised “Last updated” date.

14. Contact

If you have questions about this Policy or our data practices, contact:

Cobalt Oak
Zurich, Switzerland
contact@cobaltoak.com