Privacy Policy

1. Introduction

United Research Group LLC ("United Research Group," "URG," "we," "our," or "us") respects the privacy of people who visit our website, contact us, or submit information through our online services. This Privacy Policy explains how we collect, use, share, retain, and protect personal information in connection with our public website, general business inquiries, partner inquiries, and investigator applications. Separate notices, agreements, or laws may govern clinical trial participation, employment, and other specialized activities.

URG is a Wyoming-organized limited liability company with its stated headquarters in Raleigh, North Carolina. Headquarters designation and the appropriate public description of the street address remain subject to business verification.

Website: https://www.urgsites.com | Telephone: (866) 203-3105 | General email: info@urgsites.com. Proposed headquarters address, subject to verification: 414 Fayetteville Street, Raleigh, NC 27601.

2. Information We Collect

A. Contact and business inquiries.

Depending on the form used, we may collect name, email address, telephone number, organization or professional affiliation, inquiry category, and information included voluntarily in messages.

B. Investigator and research professional applications.

We may collect name, professional contact information, credentials, specialties, therapeutic and clinical research experience, affiliations, potential collaboration information, and an optional curriculum vitae (CV). The currently configured upload accepts PDF CVs up to 5 MB; it is not a general-purpose document-upload service. If an applicant saves unfinished application progress, related draft and resume information may be processed by the application system; details of resume-link handling require final technical verification.

C. Future-opportunity preference evidence.

The application records the applicant's optional selection, receipt timestamp, and the version of the notice shown. Where applicable, the system also retains a record of subsequent preference withdrawal or changes. A missing or unselected preference is not treated as affirmative opt-in.

D. Website technical information.

Website infrastructure may process IP addresses, device and browser characteristics, security and diagnostic logs, and other technical information necessary for operation and protection. The precise categories and service-provider practices require verification. The most recent audit reported no analytics or nonessential tracking tools installed.

E. Sensitive information not requested.

General inquiry and investigator application forms are not intended for patient records, identifiable trial-participant information, protected health information, Social Security numbers, financial account credentials, or other highly sensitive data. Please do not submit such information through these forms. If unexpectedly received, URG will assess appropriate restriction, preservation, or deletion under applicable obligations.

3. How We Use Personal Information

We may use information to respond to inquiries; evaluate investigator qualifications and potential site partnerships; review submitted CVs; communicate about the application under consideration; maintain the website; prevent abuse and investigate security concerns; maintain necessary business and compliance records; and meet applicable legal, regulatory, or contractual duties.

Use of application information for outreach about unrelated future opportunities is separate from evaluating the current application. URG will use the optional future-opportunities preference described in Section 4 for that outreach unless another lawful basis has been established and approved. Retaining an application for records-management purposes does not, by itself, authorize future-opportunity outreach.

4. Investigator Applications, CVs, and Future Opportunities

Investigator application information and optional PDF CVs are processed for qualification review and potential research collaborations. Access is intended to be limited to authorized reviewers with a legitimate business need. Submission does not guarantee selection, partnership, employment, or study participation.

Future opportunities.

The application presents an optional, unchecked-by-default choice to have professional information considered for future clinical research studies and investigator partnerships beyond the current application. Declining or leaving the choice blank does not affect consideration of the current application. URG records the selection, timestamp, and notice version to document the choice. The original selection evidence and any subsequent withdrawal history may be retained as required for accountability.

Withdrawal.

An investigator may withdraw the future-opportunities preference by contacting info@urgsites.com or, once its receipt and monitoring have been verified for public use, privacy@urgsites.com. URG will verify and record the request as appropriate and suppress future outreach based on the withdrawn preference. Withdrawal does not automatically erase the original application, CV, or consent history; requests for deletion are evaluated separately under Section 11 and applicable retention obligations.

Application and CV retention follow URG's management-approved records standards, subject to legal review, operational adoption, applicable exceptions, and any valid legal hold. Details appear in Section 7.

5. Information Sharing and Service Providers

We may share information with authorized URG personnel; providers supporting website hosting, storage, authentication, email, and security; professional advisers under appropriate confidentiality obligations; authorities when required by law; and other recipients with authorization or another lawful basis. Information relevant to potential research collaborations may be shared with sponsors, CROs, or research partners only where necessary, permitted, and subject to applicable obligations. The optional future-opportunities preference and the scope of the original application must be respected.

URG does not sell personal information submitted through its general contact or investigator application forms. A final provider inventory and review of applicable service arrangements are pending. No claim is made that all providers store data only in the United States, that backups are erased immediately, or that any unverified provider practice applies.

6. Data Security

URG uses administrative and technical safeguards designed to protect information, which may include authentication, role-based reviewer restrictions, private CV storage, server-side validation, and logging. Lovable's latest reported assessment identified private CV storage and restricted reviewer access, and reported completion of server-side blocking for inactive HR and workplace-concern forms. These findings require final launch verification and do not establish that every possible safeguard is in place.

No internet-based service is completely secure. URG reviews and updates safeguards as appropriate. Security incidents and any legally required notices are handled under applicable law and URG's internal incident-response procedures.

7. Records Retention

URG has management-approved retention standards, subject to legal and regulatory review and implementation verification. Management approval of a schedule does not mean every operational control or automated disposal process has been activated. No automatic deletion has been authorized.

• General website inquiries: ordinarily 2 years after documented resolution.
• Investigator applications and CVs: ordinarily 3 years after the most recent documented meaningful investigator interaction, with submission date as fallback when no qualifying interaction exists.
• Active investigator partnership records: during the relationship and ordinarily 6 years after its documented end.
• Routine website security logs: ordinarily 90 days from creation, excluding separately preserved incident evidence.
• Contact email copies and attachments: ordinarily 2 years after the related inquiry is resolved, unless another category applies.

Additional approved internal categories include abandoned application drafts (30 days after last activity); consent and withdrawal evidence (3 years after the associated application's ordinary retention endpoint); investigator application audit histories (3 years after that endpoint); privacy request records (3 years after formal closure); legal-hold records (6 years after formally authorized release); failed upload remnants (up to 7 days after failure or abandonment); security incident register entries (6 years after incident closure); disposal register entries (6 years after documented disposal); and superseded approved policy versions and approval evidence (6 years after supersession or withdrawal). These internal record categories do not mean that all categories are collected through the public website.

HR and clinical quality report periods remain deferred for separate review. Clinical trial regulatory records follow study-specific laws, sponsor requirements, and contracts. Third-party backups follow verified provider-specific lifecycles, not a universal fixed deletion promise.

A meaningful investigator interaction includes substantive investigator communication, updated CV or credentials, or a documented substantive application or partnership discussion involving the investigator; passive website visits, automated messages, and internal record viewing do not restart the period. Missing or disputed trigger dates require manual review. Legal holds, regulatory requirements, and contractual preservation obligations may extend retention. Any disposal requires appropriate review and authorization; withdrawal of future-opportunities consent does not itself trigger deletion. The precise operational status of each retention and disposal procedure will be verified before this policy becomes effective.

8. Cookies and Website Analytics

Essential website technologies may be used to operate and secure the website. The most recent read-only audit reported no analytics or nonessential tracking tools installed. URG will verify actual cookies, local storage, fonts, and third-party technical services before publication and update this notice if technologies change. Any legally required choices or consent mechanisms will be implemented before enabling applicable nonessential tracking. Browser controls may allow users to manage certain technologies.

9. Human Resources and Workplace Concern Reporting

HR, general career-application, and workplace-concern public submission features are not currently activated. Lovable reported implementing server-side rejection of direct submissions to inactive HR and workplace-concern handlers; final verification remains required. These features are not represented as currently available to the public. Any future activation requires separate approval, appropriate confidentiality and access controls, applicable notices, and category-specific retention decisions.

10. Third-Party Websites

Our website may link to independently operated websites. URG does not control their privacy practices; visitors should review those sites' notices. An external link does not necessarily imply affiliation, sponsorship, or endorsement.

11. Individual Privacy Requests and Preference Withdrawal

Individuals may request access, correction, or deletion of personal information where applicable law provides such rights. Investigators may separately withdraw their optional future-opportunities preference. Requests may be sent to info@urgsites.com. URG also maintains privacy@urgsites.com as an alias, but its receipt and monitoring must be confirmed before designation as the primary public privacy contact.

URG may use proportionate identity verification before disclosing or changing records. URG's internal targets are acknowledgment within 3 business days and a response within 30 calendar days where feasible, subject always to any shorter or otherwise controlling legal deadline. The internal target for processing verified future-opportunity withdrawals is 5 business days where feasible, without delaying a legally required action.

Some information may need to be preserved for legal, regulatory, contractual, security, or documented legal-hold purposes. Withdrawing a future-outreach preference is not the same as requesting deletion of a CV or application, and deletion of a CV does not necessarily erase the related application or audit evidence.

12. Children's Privacy

URG's general business website is not directed to children under 13, and URG does not knowingly solicit their personal information through general inquiry or investigator application forms. If such information is received, URG will evaluate appropriate action under applicable law.

13. Changes to This Privacy Policy

URG may update this policy as operations, technology, or legal obligations change. Following formal approval, the published policy will display its effective date and version identifier. Material changes will be communicated when legally required. Prior approved versions and approval records will be maintained under URG's internal policy-governance procedures.

14. Contact Information

United Research Group LLC | Website: https://www.urgsites.com | Telephone: (866) 203-3105 | General inquiries and privacy requests: info@urgsites.com. Privacy alias (pending final receipt/monitoring confirmation): privacy@urgsites.com. Security alias (pending final receipt/monitoring confirmation): security@urgsites.com.

Proposed headquarters address, subject to verification of its proper public designation: 414 Fayetteville Street, Raleigh, NC 27601.