Privacy Policy

Last updated: 07/27/2026

This Privacy Policy explains how CreateDevs LLC, doing business as "OMO Medical"("OMO Medical," "we," "us," or "our"), collects, uses, shares, and protects personal information when you visit omomedical.com (the "Site"), complete our Regulatory Readiness Assessment (the "Assessment"), request a consultation, or otherwise interact with us.

If you do not agree with this Policy, please do not use the Site.

This Policy applies to the Site and related business communications.

This Site is a business marketing and informational site. It is not a healthcare service, and we do not intend to collect protected health information (PHI) through it. Please do not submit patient data, PHI, clinical records, trade secrets, or other confidential or regulated information through any form on the Site. If you need to share sensitive material with us, contact us first so we can arrange an appropriate secure channel under a signed agreement.

This Policy does not cover:

• Personal data we process on behalf of clients under a separate services agreement, business associate agreement (BAA), or data processing agreement (DPA); those agreements control;
• Third-party websites or services we link to.

2.1 Information you give us directly

Through our contact and consultation forms, we collect:

• Full name
• Work email address
• Company name
• Your role
• The message you write us

If you book a consultation or correspond with us, we also collect the contents of that correspondence, scheduling details, and any information you choose to share.

2.2 Assessment responses

When you complete the Regulatory Readiness Assessment, we collect the answers you provide about your product, its intended use, development stage, and related characteristics, along with the readiness score, suggested pathway, and gap output generated for you. If you provide contact details to receive or save your results, we associate the responses with those details.

2.3 Information collected automatically

When you visit the Site, we and our service providers may automatically collect:

• IP address and approximate location (typically city or region level)
• Browser type, device type, and operating system
• Pages viewed, referring URL, time on page, and interaction events
• Date and time of access
• Cookie and similar identifiers

2.4 Information from third parties

We may receive information from analytics providers, hosting providers, email and CRM platforms, and, where applicable, business contact data or enrichment providers, subject to their terms and applicable law.

We do not knowingly collect information from anyone under 18.

We use personal information to:

• Provide the Site and Assessment — Generate and display your readiness output
• Respond to you — Reply to consultation requests and messages
• Business development — Follow up on inquiries, discuss scope and proposals
• Improve our services — Analyze aggregate usage, refine Assessment logic and content
• Marketing (where permitted) — Send relevant updates you may unsubscribe from at any time
• Security and integrity — Detect abuse, fraud, and technical issues
• Legal and compliance — Meet legal obligations, enforce our Terms, establish or defend legal claims

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

The Assessment uses automated logic, which may include AI or machine learning components, to generate readiness scores, directional pathway suggestions, and gap identification from your responses.

• Output is directional and informational only, and is not a regulatory determination. See our Terms of Service.
• This automated processing does not produce legal or similarly significant effects concerning you as an individual; it generates informational output about a product concept.
• We may use aggregated and de-identified Assessment data, data that cannot reasonably be linked back to you or your company, to improve our methodology and content.

Where the GDPR or UK GDPR applies, we process personal data on these bases:

• Legitimate interests: operating and improving the Site, responding to business inquiries, B2B marketing, and security. We balance these against your rights and interests.
• Consent: non-essential cookies and marketing emails where consent is required. You may withdraw consent at any time.
• Contract: steps taken at your request prior to entering an agreement, and performance of an agreement.
• Legal obligation: compliance with applicable law.

We use cookies and similar technologies for:

• Strictly necessary: core Site functionality and security.
• Analytics: understanding how the Site is used so we can improve it.
• Preferences: remembering settings such as Assessment progress.

You can control cookies through your browser settings, and where required by law, through our cookie banner. Blocking some cookies may affect Site functionality.

We do not currently respond to Global Privacy Control or "Do Not Track" signals unless required by applicable law.

We share personal information only as described below:

• Service providers: hosting and deployment (e.g., Vercel), analytics, email delivery, CRM, scheduling, and database providers, acting on our instructions under contract.
• Professional partners:where relevant to your inquiry, and with appropriate confidentiality protections, we may share information with independent regulatory, quality, and submission consultants, including Brooke & Associates, in order to respond to you or deliver services.
• Professional advisors: lawyers, accountants, auditors, and insurers.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• Legal: Where required by law, regulation, legal process, or governmental request, or to protect our rights, safety, and property.

We do not sell or rent personal information.

We are based in United States and our service providers may process data in the United States and other countries whose data protection laws may differ from yours. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may request more information using the contact details below.

We retain personal information only as long as necessary for the purposes described in this Policy:

• Contact and consultation inquiries: up to [24 months] after our last meaningful communication, or longer if we enter a client relationship.
• Assessment responses linked to a person: up to [24 months].
• Aggregated and de-identified data: retained indefinitely.
• Analytics data:per our provider's configured retention period, typically [14–26 months].
• Records required for legal, tax, or accounting purposes: for the applicable statutory period.

We use reasonable administrative, technical, and organizational safeguards appropriate to the marketing nature of this Site, including encryption in transit (HTTPS), access controls, and vetted service providers.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, which is one reason we ask that you not submit PHI, patient data, or confidential product information through the Site.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information
• Port your data to another provider
• Object to or restrict certain processing, including direct marketing
• Withdraw consent where processing is based on consent
• Opt out of the sale or sharing of personal information (we do neither)
• Non-discrimination for exercising your rights

To exercise any of these rights, email office@createdevs.com. We will verify your request and respond within the timeframe required by applicable law (generally 30 days under GDPR/UK GDPR, 45 days under U.S. state privacy laws, extendable where permitted). An authorized agent may submit a request on your behalf with proof of authorization.

Marketing emails:click "unsubscribe" in any marketing message, or email us. We may still send transactional or relationship messages.

EEA/UK visitors: you may lodge a complaint with your local supervisory authority, or with the [ICO / relevant DPA]. We would appreciate the chance to address your concern first.

The Site may link to third-party websites and services. We are not responsible for their privacy practices. Review their policies before providing information.

We may update this Policy from time to time. We will post the revised version on this page and update the "Last updated" date. If changes are material, we will provide additional notice where required by law. Continued use of the Site after changes take effect constitutes acceptance.

Questions, requests, or complaints about this Policy or our data practices:

OMO Medical | CreateDevs LLC | 1078 Summit Ave, Jersey City, NJ 07307 Email: office@createdevs.com