Privacy Policy

1. Overview and Scope

This Privacy Policy governs the collection, processing, storage, and protection of information obtained through the websites, platforms, APIs, software, and services (collectively, the "Services" or "PMX OS") operated by PRIMEXIA PRIVATE LIMITED, an incorporated company having its registered office at 1002 PL 119 RSC 11 Nr, Ekvira School, Sector-1, Charkop, Kandivli West, Mumbai - 400067, Maharashtra, India ("ThePriMexia", "we", "us", or "our").

We recognize the critical sensitivity of the engineering designs, medical device specifications, software source code, hazard analyses, and clinical trial evidence ingested into our systems. Our business model is founded upon enterprise trust and absolute customer data confidentiality.

2. Roles: Data Controller vs. Data Processor

With respect to individual website visitors, contact form submitters, and administrative account holders, PRIMEXIA PRIVATE LIMITED acts as the Data Controller.

With respect to all proprietary customer engineering artifacts, CAD models, Bills of Materials, software repositories, Design History Files, clinical risk assessments, and regulatory submission dossiers ingested into PMX OS by enterprise subscribers ("Customer Product Data"), the customer organization acts as the Data Controller, and PRIMEXIA PRIVATE LIMITED acts strictly as a Data Processor operating under strict contractual instructions.

3. Customer Product Data and IP Sovereignty

We enforce categorical protections regarding Customer Product Data:

• No Data Monetization: We do not sell, rent, license, or monetize customer data, metadata, or telemetry under any circumstances.
• No Model Weight Commingling: Customer proprietary designs, code, CAD geometries, or hazard files are never utilized to train or fine-tune public foundation models, shared commercial weights, or third-party algorithms.
• Strict Tenant Boundary: All customer data is cryptographically and logically isolated within dedicated tenant schemas or private cloud enclaves.

4. Information We Collect

We collect information across the following categories:

• Institutional Account Information: Professional name, corporate email address, employer name, job title, and authentication credentials when creating enterprise accounts.
• Inquiry & Evaluation Data: Information submitted through our contact and demo forms, including portfolio focus, device classification scope, and message contents.
• Technical System Telemetry: Log records necessary for platform stability, audit trails, and security monitoring, including IP addresses, browser agent headers, API access timestamps, and cryptographic session tokens.
• Cookies & Local Storage: Essential cookies and local state items strictly necessary for session persistence, user interface theme state (light/dark preference), and authentication security.

5. Purposes and Legal Bases for Processing

We process personal and technical data under the following legitimate legal bases:

• Contractual Performance: Delivering PMX OS services, processing change impact simulations, and generating automated audit matrices as agreed in enterprise subscription agreements.
• Legitimate Interests: Protecting our infrastructure against cyberattacks, verifying software reliability, and maintaining immutable audit provenance for regulatory transparency.
• Legal & Statutory Compliance: Retaining financial records, corporate disclosures, and contractual archives as mandated under applicable statutory laws.

6. Data Retention and Archival

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by statutory law. Customer Product Data is retained throughout the active term of the enterprise agreement and is subject to immediate export or secure, certified cryptographic erasure upon contract termination, subject to agreed regulatory archival hold periods.

7. Security Safeguards

We maintain defense-in-depth security measures designed to protect information from unauthorized access, loss, or alteration. These measures include TLS 1.3 encryption in transit, AES-256 bit encryption at rest, granular role-based access control (RBAC), multi-factor authentication, and append-only cryptographic audit logging. For full technical details, refer to our Security Architecture.

8. Data Subject Rights

Depending on your jurisdiction and applicable data protection regulations (including the Digital Personal Data Protection Act, GDPR, and other international privacy frameworks), you may hold rights to:

• Request confirmation of whether we process your personal data and obtain a copy of such data.
• Request rectification of inaccurate or incomplete personal information.
• Request erasure of your personal data where statutory retention obligations have lapsed.
• Object to or request restriction of processing on legitimate grounds.

To exercise any of these rights, contact our Data Protection Officer at privacy@theprimexia.com.

9. Contact and Data Protection Inquiries

For questions, notices, or formal requests regarding this Privacy Policy or our information practices, please reach our governance team at: