Privacy Policy

AlloDirect, Inc. (“AlloDirect,” “we,” “us,” or “our”) provides a direct sourcing platform that connects surgery centers, hospitals, and other healthcare facilities with AATB-accredited tissue banks. This Privacy Policy explains how we collect, use, and share information when you visit allo.direct, use the AlloDirect platform at app.allo.direct, or otherwise interact with us (together, the “Services”).

By using the Services, you agree to the collection and use of information as described in this policy.

1. Who this policy covers

This policy applies to visitors to our website, people who request access or contact us, and users of the AlloDirect platform acting on behalf of a surgery center, hospital, health system, tissue bank, or other organization. Our Services are built for healthcare organizations and their staff. They are not intended for consumers or patients.

If you use the platform on behalf of an organization, the agreement between that organization and AlloDirect may include additional terms about data. Where that agreement conflicts with this policy, the agreement controls.

2. Information we collect

Information you provide

• Contact and access requests. Name, work email, organization, organization type, job title, and anything you include in a message to us.
• Account and profile information. Name, work email, phone number, role, and the organization you represent when an account is created for you on the platform.
• Facility and eligibility information. Organization name, address, facility type, license or registration details, and other information we or the tissue banks need to confirm that an organization is eligible to receive human tissue.
• Order information. The products ordered, quantities, ship-to and bill-to details, purchase order numbers, delivery instructions, and the lot and UDI documentation associated with each order.
• Payment information. Billing details and payment method information, which is collected and processed by our payment processors. We do not store full payment card numbers.
• Communications. The content of emails, support requests, and other messages you exchange with us.

Information collected automatically

• Usage and device information. Pages viewed, links clicked, referring pages, time on page, browser type, operating system, device identifiers, and IP address.
• Cookies and similar technologies. See the Cookies and analytics section below.

Information from other sources

• Tissue banks and carriers. Order confirmations, shipment tracking, and fulfillment status for orders placed through the platform.
• Business and professional sources. Publicly available business contact information and information from partners and referral sources, used to verify organizations and to reach people who may be interested in the Services.

3. Patient information

The AlloDirect platform is built to source and order tissue without patient information. Ordering, routing, and documentation are tied to the facility and the product, not to a patient. Please do not enter patient names, medical record numbers, dates of birth, or other protected health information into our website, contact forms, or order fields.

If a facility's use of the platform ever requires the exchange of protected health information, that exchange is governed by a written agreement with the facility, including a business associate agreement where one is required by law, and not by this policy.

4. How we use information

• Provide, operate, and support the Services, including creating and administering accounts.
• Verify that organizations and users are eligible to order human tissue, consistent with tissue bank requirements, AATB standards, and applicable law.
• Process orders, route them to the originating tissue bank, coordinate off-catalog sourcing requests, and provide lot and UDI documentation.
• Support traceability, recall notices, and other communications that tissue banks or regulators require.
• Respond to access requests and other inquiries, and communicate with you about your account, orders, and the Services.
• Send information about AlloDirect, including product updates and industry content, where permitted. You can opt out at any time.
• Understand how the Services are used so we can improve them.
• Protect the security and integrity of the Services, prevent fraud and misuse, and enforce our agreements.
• Comply with legal obligations and respond to lawful requests.

5. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share information in the following circumstances:

• Tissue banks and suppliers. When an order is placed, the originating tissue bank receives the facility, contact, shipping, and order details it needs to fulfill, ship, document, and trace the order. Off-catalog requests are shared with the suppliers we contact on the facility's behalf.
• Service providers. Companies that host our website and platform, manage our customer relationship and marketing tools, process payments, deliver email, provide analytics, and support our operations. Our website is hosted on HubSpot and our platform runs on Shopify. These providers may access information only to perform services for us.
• Professional advisors. Lawyers, accountants, insurers, and similar advisors.
• Legal and safety. When required by law, subpoena, or regulatory request, or when we believe disclosure is necessary to protect the rights, property, or safety of AlloDirect, our users, or others.
• Business transfers. In connection with a merger, financing, acquisition, or sale of all or part of our business, subject to this policy.
• At your direction. When you ask us to share information or otherwise consent.

We may use and share aggregated or de-identified information that cannot reasonably be used to identify you for any purpose, including sharing demand and fulfillment trends with tissue banks.

6. Cookies and analytics

We use cookies, pixels, and similar technologies to keep you signed in, remember your preferences, understand how the Services are used, and measure the effectiveness of our communications. Our website uses HubSpot for forms, analytics, and marketing, and HubSpot sets cookies to recognize returning visitors and to connect website activity to a contact record when you submit a form. Our platform uses cookies set by Shopify to operate the store and your session.

You can control cookies through your browser settings, and most browsers let you delete or block cookies. Blocking some cookies may affect how the Services work. Where required, we display a cookie notice that lets you choose which categories of cookies to allow. We do not sell personal information or share it for targeted advertising, so browser opt-out signals such as Global Privacy Control do not change how we process your information. We will update this policy if that changes.

7. Your choices

• Marketing emails. Unsubscribe using the link in any marketing email or by contacting us. We may still send transactional messages about your account and orders.
• Account information. Review and update your account information within the platform or by contacting us.
• Cookies. See the Cookies and analytics section above.

8. Your privacy rights

Depending on where you live, you may have the right to request access to the personal information we hold about you, ask us to correct or delete it, obtain a copy of it, or opt out of certain uses. Many state privacy laws exempt information collected in a business-to-business context and apply only to businesses above certain size thresholds, but we will honor reasonable requests wherever we can.

To make a request, email info@allo.direct with "Privacy request" in the subject line. We may need to verify your identity before responding, and you may designate an authorized agent to submit a request on your behalf. We will not discriminate against you for exercising your rights. If we deny a request, you may appeal by replying to our response.

9. Data retention

We keep personal information for as long as needed to provide the Services, meet legal, regulatory, and contractual obligations, resolve disputes, and enforce our agreements. Order and documentation records, including lot and UDI documentation, are retained for the periods required for tissue traceability under applicable regulations and tissue bank requirements, which can be ten years or longer. Contact and marketing information is retained until you ask us to delete it or it is no longer needed.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, and vendor security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at info@allo.direct.

11. Children

The Services are intended for healthcare organizations and their staff. They are not directed to children under 18, and we do not knowingly collect personal information from children.

12. Where information is processed

AlloDirect is based in the United States, and the Services are intended for use in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your location.

13. Third-party sites

The Services may link to websites and services operated by others, including tissue banks, industry organizations, and scheduling or payment tools. Their privacy practices are governed by their own policies, not this one.

14. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, for material changes, provide notice through the Services or by email. Your continued use of the Services after an update means you accept the revised policy.

15. Contact us

Questions about this policy or about how we handle information can be sent to:

AlloDirect, Inc.
info@allo.direct