Privacy Policy
Effective date: August 6, 2026
1. Introduction & Scope
This Privacy Policy (“Policy”) describes how SherpaRX, Inc. /dba/ Emyra (“we,” “our,” or “us”), the operator of the website located at https://www.emyra.com/ (the “Site”), collects, uses, shares, and protects personal information obtained through the Site. Emyra offers an AI-powered medication intelligence platform that integrates real-time pharmacogenomic insights into electronic health record workflows to support personalized prescribing decisions.
This Policy applies solely to personal information collected through the Site. It does not govern data collected through any other platform, product, service, or offline interaction.
The Site is intended for audiences located in the United States. Emyra does not actively market to or solicit individuals outside the United States.
By using the Site, you acknowledge that you have read and understood this Policy.
2. Information We Collect
We collect personal information in two ways: (a) information you provide directly, and (b) information collected automatically when you visit the Site.
2.1 Information You Provide
When you use our contact or “Connect” form, we collect the information you provide voluntarily through the Site.
2.2 Information Collected Automatically
When you visit the Site, we and our third-party service providers automatically collect certain usage data, including:
- IP address
- Browser type and version
- Device type and operating system
- Referring URLs
- Pages visited on our Site
- Date and time of each visit
- Similar technical and usage data
This information is collected through cookies, server logs, and similar tracking technologies as described in Section 5 (Cookies and Tracking Technologies) of this Privacy Policy.
2.3 Data We Do Not Collect
The data practices described in this Privacy Policy apply solely to information collected through the Site and do not extend to any clinical or healthcare-related data processing that may occur through separate Emyra products or services, which are governed by separate agreements and policies.
3. How We Use Your Information
We use the personal information we collect for the following purposes:
- Responding to Inquiries: To respond to your questions, comments, or requests submitted through our contact or Connect forms.
- Communications: To communicate with you about our products, services, and updates. Any commercial email communications we send will comply with the CAN-SPAM Act, including providing a clear opt-out mechanism in each message. You may opt out of receiving promotional emails at any time by following the unsubscribe instructions in the email.
- Website Improvement: To maintain, operate, and improve the functionality, content, and user experience of our website.
- Usage Analysis: To analyze usage patterns, monitor site traffic, and understand how visitors interact with our website, including through the use of cookies and similar tracking technologies as described in Section 5 of this Privacy Policy.
- Security and Fraud Prevention: To detect, prevent, and address technical issues, security incidents, or potentially fraudulent or illegal activity.
- Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
- Legitimate Business Operations: To support our internal business operations, including record-keeping, auditing, and administrative functions.
4. How We Share Your Information
Emyra does not sell, rent, or trade your personal information to third parties. We do not share your personal information except in the following limited circumstances:
- Service Providers: We may disclose your personal information to third-party service. Providers that perform functions on our behalf, such as website hosting, analytics, email delivery, and customer support. These service providers are contractually obligated to use your information only for the purposes of providing services to Emyra and to maintain appropriate confidentiality and security measures.
- Legal Obligations: We may disclose your personal information when required to do so by law, regulation, or legal process, or in response to a lawful request from a government authority, including to meet national security or law enforcement requirements.
- Business Transfers: In the event of a merger, acquisition, reorganization, bankruptcy, or other similar transaction involving all or a portion of Emyra’s assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information by posting a notice on our website.
- Protection of Rights: We may disclose your personal information where we believe disclosure is necessary to protect our rights, your safety, or the safety of others, to investigate fraud, or to respond to a government request.
When we share personal information with service providers, we require them to process such information in accordance with our instructions and applicable law.
5. Cookies & Tracking Technologies
Emyra uses cookies and similar tracking technologies (such as web beacons and pixel tags) to collect information about how you interact with our website. Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies:
5.1 Consent Management
Cookie preferences and consent are managed through Consent Pro, a third-party consent management platform integrated into our website. You may adjust your cookie preferences at any time using the Consent Pro tool.
5.2 Third-Party Analytics
Third-party analytics providers may collect usage data, including information about your online activities over time and across different websites, when you use the Site. These providers operate under their own privacy policies, and we encourage you to review them.
6. Do Not Track Signals
Some web browsers transmit “Do Not Track” (DNT) signals to the websites you visit. There is currently no universally accepted standard for how websites should respond to DNT signals. Emyra does not currently respond to or alter its data collection practices upon receiving a DNT signal. You may, however, manage your cookie and tracking preferences through our Consent Pro cookie management tool.
As disclosed above, third-party analytics providers (such as Google Analytics) may collect information about your online activities over time and across different websites when you use the Emyra website. Emyra does not control the data collection or tracking practices of these third-party providers. We encourage you to review the privacy policies of any such third-party services for information about their data practices and available opt-out mechanisms.
7. Global Privacy Control
Global Privacy Control (GPC) is a browser-level or device-level signal that communicates your privacy preferences to the websites you visit. Emyra respects GPC signals. If your browser or device transmits a GPC signal when you visit the Site, we will treat that signal as a valid opt-out request for the sale or sharing of your personal information, to the extent applicable under state law.
Emyra does not sell your personal information. This GPC commitment is maintained as a forward-looking compliance measure to honor your expressed privacy preferences under the California Consumer Privacy Act (Cal. Civ. Code Section 1798.100 et seq.), the Connecticut Data Privacy Act (Conn. Gen. Stat. Section 42-515), the Texas Data Privacy and Security Act (Tex. Bus. and Com. Code Section 541.001), and other applicable state privacy laws that recognize or require compliance with universal opt-out mechanisms.
For more information about GPC, including how to enable it in your browser, visit https://globalprivacycontrol.org/. You may also manage your cookie and tracking preferences through the Consent Pro consent management tool available on our Site.
8. Data Security
Emyra implements reasonable administrative, technical, and organizational safeguards designed to protect the personal information we collect and maintain.
No method of electronic transmission or data storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach involving your personal information, we will notify you and any applicable regulatory authorities as required by applicable federal and state law.
9. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. The following retention periods apply to the categories of data we collect:
- Contact Form Submissions (name, email address, phone number): retained for up to 24 months after your last interaction with us, unless you request deletion sooner.
- Automatically Collected Data (IP address, browser type and version, device type, operating system, referring URLs, pages visited, date and time of visits, and similar usage data): retained for up to 12 months.
- Email Communications: retained for up to 36 months from the date of the communication.
When we no longer need your personal information for the purposes outlined in this Privacy Policy, or when the applicable retention period expires, we will securely delete or anonymize it. If you submit a verifiable deletion request, we will delete your personal information in accordance with the timelines set forth in Section 10 of this Privacy Policy, subject to any exceptions permitted by applicable law.
10. Your Privacy Rights
Depending on your state of residence, you may have specific rights regarding your personal information. This section describes those rights and how to exercise them. To submit a request, contact us at privacy@emyra.com.
10.1 California Residents.
While Emyra may not currently meet the CCPA/CPRA thresholds (Cal. Civ. Code Section 1798.100 et seq.), we provide the following rights as a matter of good practice and to the extent applicable: the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. We do not sell or share your personal information. The categories of personal information we collect, mapped to CCPA categories, are as follows:
Financial Incentive Disclosure: Emyra does not offer financial incentives, price differences, or service differences in exchange for the retention, sale, or sharing of your personal information.
10.2 Connecticut Residents
Under the Connecticut Data Privacy Act (Conn. Gen. Stat. Section 42-515), as amended by SB 1295 effective July 1, 2026, Connecticut residents may have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of the processing of personal data for targeted advertising or sales. The amended CTDPA applies to controllers that process sensitive data of Connecticut residents regardless of consumer count. Emyra does not collect sensitive data (including health data) through this website.
10.3 Nevada Residents
Under Nevada Revised Statutes Chapter 603A, Nevada consumers have the right to direct a website operator not to sell their covered information. Emyra does not sell your covered information as defined under NRS 603A. To submit an opt-out request, contact us at privacy@emyra.com.
10.4 Texas and Nebraska Residents
Under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Section 541.001) and the Nebraska Data Privacy Act (Neb. Rev. Stat. Section 87-1101), residents may have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising or data sales. Emyra’s obligations under these laws apply to the extent Emyra is not exempt as a small business as defined by the U.S. Small Business Administration.
10.5 Residents of Other States with Privacy Laws
If you reside in a state with an applicable comprehensive consumer privacy law (including but not limited to Virginia, Colorado, Iowa, Indiana, Kentucky, Oregon, Montana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Tennessee, or Utah), you may have additional rights such as the right to access, correct, or delete your personal data. Contact us at privacy@emyra.com to exercise any applicable rights.
10.6 Authorized Agent Requests
You may designate an authorized agent to submit a privacy request on your behalf. To do so, provide the agent with written, signed authorization, and have the agent submit the request to privacy@emyra.com along with proof of authorization. We may contact you directly to verify the request and your identity.
10.7 Identity Verification
When you submit a privacy request, we may need to verify your identity before processing it. We will ask you to provide information that matches the personal information we have on file, such as your name and email address. If we cannot verify your identity using this method, we may request additional information. We will not use information collected for verification purposes for any other purpose.
10.8 Appeal Process
If we decline to take action on your privacy request, you may appeal our decision by emailing privacy@emyra.com with the subject line “Privacy Request Appeal.” We will respond to your appeal within 45 days (or 60 days in certain jurisdictions, as required by applicable law). If your appeal is denied, we will provide you with information on how to contact your state’s Attorney General to submit a complaint.
11. Deidentified & Aggregated Data
Emyra may use deidentified or aggregated data that can no longer reasonably be used to identify you for any lawful purpose, including research, analytics, and service improvement. Deidentified data is information from which all personally identifiable elements have been removed or modified so that the data cannot reasonably be linked to a specific individual.
Emyra commits to maintaining deidentified data in deidentified form. We will not attempt to reidentify any data that has been deidentified, except as necessary to confirm that our deidentification processes are functioning effectively. We implement appropriate technical and organizational controls to prevent reidentification of such data.
Any third party that receives deidentified or aggregated data from Emyra is contractually prohibited from attempting to reidentify the data. This section does not restrict or limit Emyra’s ability to use or disclose information that has been properly deidentified or aggregated in accordance with applicable law.
12. Children's Privacy
The Emyra website is not directed to children under the age of 13. Emyra does not knowingly collect, use, or disclose personal information from children under 13, in compliance with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. Section 6501 et seq.
If you are a parent or guardian and believe that your child under the age of 13 has provided personal information to Emyra through the website, please contact us at privacy@emyra.com. Upon verification, we will promptly delete such information from our records.
If Emyra becomes aware that it has inadvertently collected personal information from a child under 13, we will take reasonable steps to delete that information as soon as practicable.
13. Third-Party Links & International Users
13.1 Third-Party Links
The Emyra website may contain links to websites, platforms, or services operated by third parties. These links are provided for your convenience only. Emyra does not control, endorse, or assume responsibility for the content, privacy policies, or practices of any third-party website. We encourage you to review the privacy policy of each website you visit before providing any personal information. Your interactions with third-party websites are governed solely by the terms and privacy policies of those third parties.
13.2 International Users
The Site is intended for users located in the United States. Emyra does not actively market to, solicit, or target individuals outside the United States. If you access the Site from outside the United States, you do so at your own initiative and are responsible for compliance with applicable local laws. By using the Site, you consent to the collection, processing, and storage of your personal information in the United States, subject to the terms of this Privacy Policy.
14. Changes to this Privacy Policy
We may update or revise this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or business operations. When we make changes, we will update the “Effective Date” at the top of this Privacy Policy and post the revised version on our website at https://www.emyra.com/.
If we make material changes to this Privacy Policy, we will provide notice through one or more of the following methods: (a) posting a prominent notice on the Site, or (b) sending an email notification to the address you provided to us, where feasible. Your continued use of the Site after the revised Privacy Policy has been posted constitutes your acknowledgment of the updated terms.
We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal information. The date at the top of this page indicates when this Privacy Policy was last revised.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or Emyra’s data practices, please contact us using the information below:
Email: privacy@emyra.com
Mailing Address: 1515 Russell Street, Nashville, Tennessee 37206
You may direct privacy-related inquiries, access or deletion requests, opt-out requests, appeals, authorized agent submissions, and complaints to the contact information listed above. We will make every reasonable effort to respond to your inquiry promptly and in accordance with applicable law.