Privacy Policy

Effective date: August 3, 2026

1. Introduction

RediCell Biologics is a trading name of Auvum LLC, doing business as RediCell ("RediCell," "we," "us," or "our"). This Privacy Policy explains what information we collect through redicell.com (the "Site"), how we use it, how we protect it, and the choices you have. It applies to visitors to the Site, applicants for a RediCell account, account holders who submit requests for quote, and applicants to our sales team.

The Site is a business-to-business resource for licensed healthcare practitioners, medical practices, research institutions and laboratories. RediCell products are for physicians and clinical use only. RediCell products are not approved, licensed or cleared by the U.S. Food and Drug Administration or by any other regulatory authority, and no product has an approved indication. RediCell makes no claim of safety or efficacy, supplies no clinical, dosing or protocol guidance, and takes no part in any clinical decision.

By using the Site, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Site.

2. Information We Collect

(a) Information you give us. We collect the information you choose to submit through the Site or send to us directly:

• Account application. When you apply for an account, we collect your full name, organization name, work email address, telephone number, delivery country, and any optional message you include.
• Account credentials. If your application is approved, you choose your own password. We never receive or store your password in plain text; we store only a salted scrypt hash of it. We also record whether your application is pending, approved, or rejected, and, for each sign-in, the time, the IP address and the browser identification string, so that we can see unauthorized access to your account.
• Requests for quote. When you are logged in and submit a request for quote, we collect the products and quantities you select, any purchase-order reference and delivery country you give, any notes or comments you include, the prices and totals we calculate for it, and the date and time of the request. The request is linked to your account record.
• Delivery details. If you accept a written quotation and we ship to you, we collect the delivery address, the name of the person or department receiving the shipment, and any contact or handling details needed to complete delivery.
• Sales team applications. If you apply to join our sales team, we collect your name, email address, telephone number, territory, relevant experience, any LinkedIn or website address you give, and any message you include.
• Correspondence. If you email office@redicell.com or telephone 512 541 2026, we keep the message, or a note of the call, so that we can respond and maintain our business records.
• Customer records. We keep an internal customer record for everyone who applies for an account, applies to join our sales team, or requests a quote. It holds the contact details you gave us, a link to your account and to any requests you have made, a status showing where the enquiry has reached, the RediCell person responsible for it, dated notes written by our staff about our dealings with you, and reminders for us to follow up. These notes are our own business records, written by us rather than collected from you. You may ask for a copy of what we hold about you under Section 9.

The Site does not process payments and does not collect payment card or bank account details.

Please do not send us patient names, medical records, or any other individually identifiable health information. We do not need it, we do not want it, and we will delete it if we receive it. See Section 4.

(b) Information collected automatically. The Site runs on RediCell's own server. When you visit, that server records ordinary web-server log data, which may include:

• your Internet Protocol (IP) address;
• your browser type and user agent string;
• the date and time of your request;
• the pages or files you requested and the referring page, if any;
• the HTTP response status and the amount of data transferred.

If you log in, we also set a single session cookie so the server can recognize your browser for the length of your session. We do not use advertising cookies, tracking pixels, web beacons, fingerprinting, session-replay tools, or any third-party analytics service. We do not buy or receive personal information about you from data brokers or other outside sources.

3. How We Use Your Information

We use the information described above only for the following business purposes:

• to review your account application and decide whether to approve or reject it, including confirming that you represent a legitimate research organization;
• to create and administer your account, authenticate you at login, and keep your session secure;
• to make pricing and volume tier information available to you once your account is approved;
• to receive, evaluate, and respond to your requests for quote and to prepare and send written quotations. A request for quote is not an order and not a contract; only a written quotation accepted in writing forms an order;
• to fulfill, ship, and invoice accepted orders, including arranging cryogenic shipment on dry ice and providing the information a carrier needs to deliver to you;
• to communicate with you about your application, account, quotation, shipment, or inquiry;
• to evaluate sales team applications and contact applicants;
• to maintain accurate business, accounting, tax, shipping, and product traceability records;
• to operate, secure, troubleshoot, and improve the Site, including detecting and preventing fraud, abuse, and unauthorized access; and
• to comply with applicable law and to respond to lawful requests from government authorities.

We do not use your information to build advertising profiles, and we do not use automated decision-making that produces legal or similarly significant effects about you. Applications are reviewed manually by RediCell personnel.

4. No Protected Health Information

RediCell does not collect, receive, create, maintain, or transmit Protected Health Information ("PHI") as that term is defined by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 CFR Parts 160 and 164 ("HIPAA"). The Site has no patient portal, no intake form, no scheduling function, and no clinical records of any kind. RediCell does not provide treatment, does not bill any health plan, and does not act as a HIPAA covered entity or as a business associate of one.

Free-text fields on the Site, such as the optional message on the account application and the notes field on a request for quote, are for business and technical information only. If you submit patient-identifiable information anyway, we will delete it from our records as soon as we identify it and will not use it for any purpose.

5. Cookies

We use one cookie: a strictly necessary session cookie that is set only after you log in. Its sole function is to keep you authenticated as you move between pages. It contains a random session identifier, not your name, email address, or password.

The session cookie expires when you log out or when your session expires eight hours. You can block or delete cookies in your browser settings, but if you block this cookie you will not be able to log in or view pricing.

We do not use advertising cookies, third-party analytics cookies, social media cookies, or any cross-site tracking technology. No advertising network, analytics vendor, or data broker receives information about your visit. Because we do not track you across sites, we have nothing to disable in response to a "Do Not Track" or Global Privacy Control signal; our practice is the same either way.

6. How We Store and Protect Your Information

The Site is self-hosted. It runs on RediCell's own server and stores data in a local SQLite database controlled by RediCell. We do not use a third-party e-commerce platform, payment processor, customer relationship management system, marketing automation platform, or analytics provider, and none of them holds a copy of your data. Notification emails are sent through RediCell's own mail account.

Our safeguards include:

• passwords stored only as salted scrypt hashes, never in plain text and never in a reversible form;
• encryption in transit using HTTPS/TLS, enforced across the whole Site — not only on the pages where you apply, sign in, or submit a request for quote;
• access to the administrative panel and the database limited to authorized RediCell personnel who need it to do their jobs;
• routine patching of the server and its runtime, and review of the Site's own activity log, which records account approvals, sign-ins, price changes and administrative actions; and
• daily backups of the database, encrypted at rest with AES-256-GCM before they leave the server and held on storage under RediCell's own control, separate from the hosting provider's infrastructure. Backups are retained for thirty (30) days and then destroyed. An encrypted backup cannot be read by the hosting provider or by anyone who obtains the file without RediCell's key.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you send information to us at your own risk. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law. Keep your password confidential and notify us at office@redicell.com if you believe your account has been compromised.

7. Disclosure of Your Information

We do not sell your personal information, and we never have. We do not rent, trade, or share it with third parties for their own marketing purposes. We disclose personal information only in these limited circumstances:

• Shipping and courier carriers. To deliver a shipment, a carrier receives the recipient name, organization, delivery address, telephone number, and email address, together with the handling information a cryogenic shipment on dry ice requires. We ship with FedEx. A carrier may use that information only to complete the delivery.
• Communications and infrastructure. Notification email is carried by RediCell's own mail account. The website and that mail account are hosted by Namecheap, which as our hosting provider necessarily holds the server and the mailbox your data sits in. Beyond Namecheap and the network services needed to carry a message to you, no outside platform receives your information: there is no analytics vendor, payment processor, advertising network, customer-relationship service or email delivery service involved at any point.
• Professional advisers. Our accountants and legal advisers may see transaction records — invoices, quotations and shipping documents — where they need them to do that work. They receive no access to the Site, the administrative panel or the database, and they are bound by professional duties of confidentiality.
• Legal requirement. When we are required to do so by law, subpoena, court order, or other lawful request from a government or regulatory authority, including customs authorities.
• Protection of rights and safety. When we reasonably believe disclosure is necessary to enforce our Terms of Service, investigate suspected fraud or misuse of our products, or protect the rights, property, or safety of RediCell, our customers, or the public.
• Business transfer. In connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, in which case your information may be transferred as a business asset. We will require the recipient to honor this Privacy Policy or notify you of any material change.
• With your direction. When you ask us to share information with a specific person or organization, such as your institution's purchasing office.

8. Data Retention

We keep personal information only as long as we need it for the purposes described in this policy or as long as the law requires. Our periods are:

• Rejected or abandoned account applications: deleted after twelve (12) months, measured from the decision or the last contact, whichever is later.
• Approved accounts: retained while the account is active. An account with no sign-in and no request for quote for twenty-four (24) months may be treated as dormant and closed; we email you before we do. After closure or a verified deletion request, we delete the account record and its personal fields within thirty (30) days, except for records we must keep as described below.
• Requests for quote, quotations, orders, shipping records, and invoices: retained for seven (7) years from the end of the calendar year in which the transaction occurred, to meet our accounting, tax, export and product traceability obligations.
• Sales team applications: retained for twelve (12) months, then deleted, unless you ask us to delete them sooner or you are engaged by RediCell.
• Server logs and sign-in history: retained for twelve (12) months, then deleted or aggregated so that they no longer identify an individual.
• Email correspondence, and the copy of each notification we send: retained for twenty-four (24) months from the last message in the thread, or longer where it forms part of a transaction record.
• Customer records (Section 2): retained while you are a customer or an active prospect, and for twenty-four (24) months after our last contact with you, then deleted.

Deletion is triggered by one of the following: expiry of the applicable period above; closure of your account; a verified deletion request from you under Section 9; or our determination that the information is no longer needed for any lawful purpose. Where we must keep a transaction record for legal reasons, we retain the minimum necessary and delete the rest.

9. Your Rights

Subject to applicable law, you may ask us to:

• confirm whether we hold personal information about you and give you access to it;
• correct information that is inaccurate or out of date;
• delete information we no longer need to keep;
• provide a copy of the information you gave us in a portable format;
• stop sending you marketing messages; or
• close your account.

To make a request, email office@redicell.com from the email address on your account, or write to us at the address in Section 16, with the subject line "Privacy Request." So that we do not disclose your information to the wrong person, we may ask you to verify your identity, for example by confirming details we already hold. We will respond within the time applicable law allows, which is forty-five (45) days under California law, and will tell you if we need more time. We do not charge a fee for a reasonable request, and we will not deny you products or services, charge you a different price, or give you a lower level of service because you exercised a privacy right.

California residents. Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), you have the right to know the categories and specific pieces of personal information we have collected, the sources, the business purpose, and the categories of third parties to whom we disclose it; the right to delete personal information we collected from you; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising these rights. RediCell does not sell personal information and does not share it for cross-context behavioral advertising, and it has not done so in the preceding twelve (12) months. We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit. The categories we collect are identifiers (name, email, telephone, delivery address, IP address), professional or employment-related information (organization, territory, experience), and commercial information (products requested, quotations, and orders). You may use an authorized agent to submit a request if you give the agent written permission and we can verify it. Residents of other states with comparable privacy laws may have similar rights and may use the same contact method.

10. Third-Party Links

The Site may link to third-party websites, such as the standards bodies and reference resources cited on our range page, or a shipping carrier's tracking page. Those sites are not operated or controlled by RediCell. This Privacy Policy does not apply to them, and we are not responsible for their content, security, or privacy practices. Read the privacy policy of any site you visit before giving it your information.

11. Email and SMS Communications

Transactional messages. We send email that is necessary to the relationship you have asked for: confirmation that we received your application, notice that your application was approved or rejected, password and account notices, quotations, order confirmations, shipping and dry ice handling notices, and replies to your inquiries. These are not marketing messages, and you cannot opt out of them while your account is open. If you no longer want them, ask us to close your account.

Marketing messages. We do not currently operate a marketing mailing list. The email we send is transactional — acknowledging an application, confirming a decision on it, delivering a password-setup link, and confirming a request for quote. If we later send occasional messages about additions to the range or technical resources, every such message will carry an unsubscribe link, and you may at any time email office@redicell.com with the subject "Unsubscribe." Transactional messages about your own account and orders continue either way.

Mobile information. No mobile information, including telephone numbers and SMS consent, will be sold, rented, or shared with any third party or affiliate for their marketing or promotional purposes. Mobile information may be shared only with the service providers that help us deliver the messages you asked for, and those providers may not use it for any other purpose.

12. International Users

RediCell operates in the United States. The Site and its database run on servers located in the United States, and encrypted backups are held on storage under RediCell's own control, also in the United States. If you access the Site or apply for an account from outside the United States, you understand that your information will be transferred to, stored in, and processed in the country where our server is located, where privacy laws may differ from those of your country. Where required, we rely on your consent and on appropriate safeguards for that transfer.

We ask for your delivery country so we can determine whether we can ship to you and so we can meet the customs, export, and dry ice handling requirements that apply to a cryogenic shipment. We may share that information with carriers and customs authorities as necessary to complete a shipment. Products are supplied for physicians and clinical use only in every country, without exception.

13. Children's Privacy

The Site is intended for professional and institutional users and is not directed to anyone under 18 years of age. We do not knowingly collect personal information from anyone under 18, and no one under 18 may apply for an account, submit a request for quote, or apply to our sales team. If we learn that we have collected information from a person under 18, we will delete it promptly. If you believe a minor has given us information, contact us at office@redicell.com.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our products, or the law. When we do, we will post the revised policy on this page and change the effective date at the top. If the change is material, we will give notice by email to the address on your account or by a notice on the Site before the change takes effect. Your continued use of the Site after the effective date means you accept the revised policy. We encourage you to review this page periodically.

15. Governing Law

Auvum LLC, doing business as RediCell, is a limited liability company organized under the laws of the State of Texas. This Privacy Policy, and any dispute arising out of it, are governed by the laws of the State of Texas, without regard to its conflict of laws rules.

16. Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right, or want to report a concern, contact us:

• RediCell Biologics, Auvum LLC, doing business as RediCell
• Email: office@redicell.com
• Telephone: 512 541 2026
• Office hours: Monday through Friday, 8:00 a.m. to 4:00 p.m. Eastern Time
• Mailing address for privacy and legal notices: 1005 Congress Ave, Suite 925, Austin, TX 78701

Please write "Privacy Request" in the subject line so your message reaches the right person.