Privacy Policy

Effective Date: September 15th, 2026

This Privacy Policy explains how Model N, Inc. and its subsidiaries and affiliates, including, without limitation, Kalderos, Inc. (collectively, “Model N,” “we,” “us,” or “our”), collect, use, disclose, store, and otherwise process Personal Information when individuals interact with our websites, products, applications, services, events, marketing activities, and other business operations.

This Privacy Policy is intended to provide a clear explanation of our privacy practices and the choices and rights available to individuals under applicable privacy laws.

Privacy Policy Table of Contents

Core Privacy Policy

INTRODUCTION
WHO THIS PRIVACY POLICY APPLIES TO
PERSONAL INFORMATION WE COLLECT
HOW WE USE PERSONAL INFORMATION
ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING
HOW WE SHARE PERSONAL INFORMATION
COOKIES AND SIMILAR TECHNOLOGIES
YOUR PRIVACY RIGHTS AND CHOICES
RETENTION OF PERSONAL INFORMATION
INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION
CHILDREN’S PRIVACY
CHANGES TO THIS PRIVACY POLICY
CONTACT US

Supplemental Privacy Notices

Appendix A – Categories of Personal Information
Appendix B – Cookie Notice
Appendix C – Artificial Intelligence & Generative AI Privacy Notice
Appendix D – CCPA Privacy Notice
Appendix E – European Economic Area, United Kingdom & Switzerland Privacy Notice

1. INTRODUCTION

Model N provides enterprise software, data-enabled solutions, analytics, professional services, implementation services, support services, managed services, and related commercial services that help life sciences organizations manage pricing, revenue, reimbursement, contracting, compliance, pharmaceutical rebate administration, duplicate discount management, claims validation, and other commercial operations.

This Privacy Policy describes how Model N collects, uses, discloses, stores, and otherwise processes Personal Information when individuals interact with our Services or otherwise engage with us in the course of our business.

This Privacy Policy also applies when individuals interact with AI-enabled functionality, virtual assistants, chatbots, or other conversational interfaces made available through our websites or Services.

This Privacy Policy is designed to help you understand:

what Personal Information we collect;
how and why we use Personal Information;
when we disclose Personal Information to others;
the privacy choices and rights available to you under applicable law; and
how to contact us with questions or requests regarding this Privacy Policy.

Model N processes Personal Information in different capacities depending on the circumstances. When Model N determines the purposes and means of processing Personal Information for its own business operations, it acts as a controller, business, or equivalent organization under applicable privacy laws. When Model N processes Customer Data solely on behalf of a customer pursuant to a contract that we have in place with such customer, Model N acts as a processor, service provider, contractor, or comparable role under applicable law. This Privacy Policy does not apply to Customer Data processed by Model N.

Certain products, services, jurisdictions, or processing activities may be subject to Supplemental Privacy Notices contained in the appendices to this Privacy Policy. Those Supplemental Notices form part of this Privacy Policy and should be read together with the Core Privacy Policy where applicable.

The “Effective Date” above indicates when this version of the Privacy Policy became effective.

1.1 Key Terms

For purposes of this Privacy Policy:

“Customer Data” means information, including Personal Information, submitted, transmitted, accessed, synchronized, received through integrations, or otherwise processed by Model N solely on behalf of or at the direction of a customer in connection with providing the Services pursuant to an applicable customer agreement.

“Model N”, “we,” “us,” or “our” means Model N, Inc. and its subsidiaries and affiliates, including, without limitation, Kalderos, Inc., unless otherwise indicated.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual. Where required by applicable law, the term “Personal Data” has the corresponding meaning under the applicable privacy law.

“Services” means Model N’s and its subsidiaries’ and affiliates’ websites, software, applications, platforms, cloud services, data-enabled solutions, products, professional services, implementation, support, consulting, managed services, artificial intelligence-enabled functionality, analytics, integrations, and other commercial offerings that reference or are governed by this Privacy Policy.

2. WHO THIS PRIVACY POLICY APPLIES TO

This Privacy Policy applies to Personal Information that Model N processes in connection with its business operations and the Services.

Depending on how you interact with Model N, this Privacy Policy may apply to Personal Information collected from:

visitors to our websites;
individuals who contact us or request information about our products or Services;
current and prospective customers and their representatives;
authorized users of our Services, where Model N determines the purposes of processing;
business partners, vendors, consultants, and service providers;
individuals who attend Model N events, webinars, or other programs; and
other individuals who otherwise interact with Model N in a business context.

The Personal Information we collect and process depends on the nature of your relationship with Model N and how you interact with our Services.

Customer Data

When Model N processes Customer Data on behalf of a customer, we generally act as a processor, service provider, contractor, or similar role under applicable privacy laws. In those circumstances, the applicable customer determines the purposes for which Customer Data is collected and processed, and our processing is governed by our agreements with that customer.

If your Personal Information is included in Customer Data, requests relating to that Personal Information should generally be directed to the applicable customer.

Information Not Covered by this Privacy Policy

Unless otherwise stated, this Privacy Policy does not apply to:

Customer Data processed solely on behalf of customers;
employment-related information concerning current, former and prospective employees, applicants, independent contractors, interns, consultants, temporary workers, other members of Model N’s workforce, or other personnel, which is governed by separate privacy notices;
information processed by third parties that maintain their own privacy policies or notices; or
information that has been de-identified or anonymized in accordance with applicable law.

Supplemental Privacy Notices

Additional jurisdiction-specific or processing-specific privacy notices are contained in the Supplemental Privacy Notices.

3. PERSONAL INFORMATION WE COLLECT

The Personal Information we collect depends on how you interact with Model N, the Services you use, and our relationship with you.

We collect Personal Information directly from you, automatically when you use our Services, from our customers where appropriate, and from other third parties as described below. A detailed description of the categories of Personal Information we process is provided in Appendix A – Categories of Personal Information.

3.1 Information You Provide to Us

We collect Personal Information that you voluntarily provide when you interact with Model N, including when you:

create or administer an account;
request information, demonstrations, or support;
communicate with us by email, telephone, customer support sessions, chat, AI-enabled chatbot, virtual assistant, or other communication channels;
register for or participate in events, webinars, surveys, or similar activities;
subscribe to newsletters or other communications;
enter into a contract or other business relationship with Model N; or
otherwise provide information to us in connection with our business operations.

Depending on the circumstances, this information may include contact information, business information, account credentials, communications, prompts submitted through AI-enabled functionality, uploaded content, payment or billing information where applicable, and other information necessary to provide our Services, conduct our business, or respond to your requests.

3.2 Information We Collect Automatically

When you access or use our websites or other online Services, we and our service providers may automatically collect certain technical and usage information.

This may include information such as:

device and browser information;
IP address and approximate location derived from your IP address;
operating system and device identifiers;
website usage and navigation information;
log and diagnostic information;
chatbot session information, AI interaction metadata, technical diagnostics, and related usage information associated with AI-enabled conversational functionality;
interactions with our websites, applications, emails, and other communications; and
information collected through cookies and similar technologies.

Additional information about our use of cookies and similar technologies is available in Section 7 and Appendix B – Cookie Notice.

3.3 AI Chatbots and Conversational Interfaces

Model N may make AI-enabled chatbots, virtual assistants, and other conversational interfaces available through its websites or Services. When you interact with these tools, we may collect and process your prompts, questions, uploaded content, responses, conversation history, technical information, and related usage data to:

respond to your requests;
provide customer support;
improve user experience;
maintain security;
troubleshoot technical issues;
comply with legal and contractual obligations; and
operate and improve our Services.

3.4 Information We Receive from Other Sources

We may receive Personal Information from third parties, including:

our customers and their authorized representatives;
business partners;
service providers acting on our behalf;
publicly available sources;
event organizers;
marketing and lead-generation providers;
authentication or identity providers;
social media platforms where you interact with our content; and
other third parties where permitted by applicable law.

We may combine information received from these sources with other Personal Information that we maintain to support our business operations and provide our Services.

3.5 De-identified and Aggregated Information

Model N may create, use, and disclose information that has been de-identified, anonymized, or aggregated so that it can no longer reasonably be associated with an identified or identifiable individual, as permitted by applicable law.

Where required by law, Model N will maintain and use de-identified information in accordance with applicable legal requirements.

4. HOW WE USE PERSONAL INFORMATION

Model N uses Personal Information to operate our business, provide and improve our Services, communicate with individuals, protect our systems, comply with legal obligations, and pursue other legitimate business purposes consistent with applicable law.

The ways we use Personal Information depend on the nature of our relationship with you and the Services you use.

4.1 Provide and Support Our Services

We use Personal Information to:

provide, maintain, and support our Services;
establish and manage customer and user accounts;
authenticate users and administer access to the Services;
process transactions and fulfill contractual obligations;
respond to inquiries and provide customer, technical, product, and AI-assisted support, including through chatbot functionality where available;
communicate with you regarding your account, the Services, or requested information; and
administer events, webinars, surveys, and other business activities.

4.2 Operate and Improve Our Business

We use Personal Information to:

operate, maintain, and improve our products and Services;
improve conversational experiences and AI-enabled functionality;
develop new products, features, and functionality;
understand how our websites and Services are used;
perform analytics, reporting, testing, and quality assurance;
evaluate customer satisfaction and business performance;
conduct research and product development; and
administer our day-to-day business operations.

4.3 Communicate With You

We use Personal Information to:

respond to your requests;
provide information you have requested;
send administrative communications regarding the Services;
notify you of important product, security, or policy updates; and
send marketing or promotional communications where permitted by applicable law.

You may opt out of marketing communications at any time using the instructions included in those communications or as otherwise described in this Privacy Policy.

4.4 Protect Model N, Our Customers, and Others

We use Personal Information to:

protect the security, availability, and integrity of our Services;
detect, investigate, and respond to fraud, security incidents, or other unlawful activity;
detect misuse or abuse of chatbot or AI-enabled functionality;
authenticate identities and prevent unauthorized access;
protect the rights, property, and safety of Model N, our customers, and others;
enforce our agreements, policies, and terms; and
maintain appropriate business continuity, audit, and compliance processes.

4.5 Comply with Legal and Regulatory Obligations

We use Personal Information where necessary to:

comply with applicable laws, regulations, court orders, and governmental requests;
satisfy accounting, tax, reporting, and recordkeeping obligations;
establish, exercise, or defend legal claims;
respond to regulatory inquiries or investigations; and
fulfill other legal or contractual obligations.

4.6 Artificial Intelligence and Automated Processing

Model N may use Personal Information in connection with AI-enabled functionality, machine learning, automation, and similar technologies to support and improve the Services. Additional information regarding Model N’s AI practices is provided in Section 5 and Appendix C.

4.7 Other Lawful Business Purposes

We may also use Personal Information:

with your consent, where consent is required by applicable law;
as otherwise described at the time information is collected;
for purposes compatible with the reason the information was originally collected, where permitted by applicable law; or
as otherwise permitted or required by law.

5. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

Model N may incorporate artificial intelligence (“AI”), machine learning, generative AI, automation, and similar technologies into certain products, services, and internal business processes to improve the functionality, efficiency, security, and usability of our Services.

Where AI-enabled features are available, they are designed to support users in performing business tasks and to assist with analysis, summarization, search, recommendations, workflow automation, and other product capabilities.

5.1 How We Use AI

Model N may use AI technologies to:

improve user experiences, including AI-enabled chatbots, virtual assistants, intelligent search, recommendations, and conversational interfaces;
enhance search, navigation, and information retrieval;
assist with summarization, drafting, customer support, and analysis;
automate routine business processes;
improve product performance and reliability;
support fraud detection, cybersecurity, and system monitoring; and
develop and improve AI-enabled features and functionality.

AI-enabled functionality may include conversational interfaces available through Model N websites or Services. Where appropriate, and where required by applicable law, Model N will provide notice when individuals are interacting directly with AI-enabled conversational systems.

5.2 Human Oversight

AI-generated outputs are intended to assist users in performing business tasks and are not intended to replace appropriate human review, professional judgment, or independent decision-making.

Users remain responsible for reviewing AI-generated outputs before relying on them in business or operational decisions.

5.3 AI Service Providers

Model N may use third-party service providers to support certain AI-enabled capabilities.

5.4 Customer Data and AI

Where Model N processes Customer Data on behalf of customers, the use of AI in connection with that Customer Data is governed by the applicable customer agreement.

Model N does not use Customer Data processed on behalf of customers to train shared or publicly available foundation models unless expressly authorized by the applicable customer through contract or documented instruction.

Additional information regarding Model N’s commitments relating to Customer Data and AI is provided in Appendix G – Customer Data & Artificial Intelligence Commitments.

5.5 Automated Processing

Model N may use automated tools to support operational, security, administrative, product-related, fraud detection, cybersecurity, customer support, and workflow automation functions.

Except where otherwise disclosed or required by applicable law, Model N does not make decisions that produce legal or similarly significant effects about individuals based solely on automated processing.

Where applicable law provides individuals with rights relating to automated decision-making or profiling, those rights are described in the applicable supplemental privacy notice.

5.6 Additional Information

Additional information regarding Model N’s AI-related privacy practices, including generative AI features, AI service providers, user responsibilities, and applicable safeguards, is provided in Appendix C – Artificial Intelligence & Generative AI Privacy Notice.

6. HOW WE SHARE PERSONAL INFORMATION

Model N shares Personal Information only as necessary to operate our business, provide and improve our Services, comply with legal obligations, protect our rights, or as otherwise described in this Privacy Policy.

6.1 Within the Model N Organization

We may share Personal Information among Model N, its subsidiaries, affiliates, and business units, including Kalderos, and Personal Information may be accessed or processed by Model N employees, contractors, consultants, and other authorized personnel, including personnel located in jurisdictions where Model N operates, where necessary to:

provide and support the Services;
manage customer relationships;
administer business operations;
improve products and services;
maintain security;
comply with legal obligations; and
support other legitimate business activities consistent with this Privacy Policy.

6.2 Service Providers

We engage third-party service providers to perform services on our behalf to provide implementation, support, operational, administrative, technical, and other business services in jurisdictions where Model N operates.

These providers may process Personal Information to assist with activities such as:

cloud hosting and infrastructure;
customer support;
identity and access management;
payment processing;
data analytics;
communications;
marketing;
event management;
security monitoring;
AI and machine learning services;
information technology support; and
other business operations.

Service providers are authorized to process Personal Information only in accordance with applicable contractual obligations.

6.3 Customers and Authorized Users

Where you access the Services as an employee, contractor, consultant, temporary worker, or other authorized personnel or representative of a Model N customer, information associated with your account or your use of the Services may be accessible to that customer in accordance with its administrative controls and contractual relationship with Model N.

The customer’s own privacy policies and practices govern its use of such Personal Information.

6.4 Business Partners

We may share Personal Information with business partners where necessary to provide jointly offered products or services, conduct business activities, or support our commercial relationships.

Our business partners’ own privacy policies and practices govern their use of such Personal Information.

6.5 Corporate Transactions

Personal Information may be disclosed in connection with an actual or proposed merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or other corporate transaction.

6.6 Legal and Regulatory Disclosures

We may disclose Personal Information where we believe disclosure is necessary or appropriate to:

comply with applicable law, regulation, legal process, or governmental request;
respond to lawful requests from courts, regulators, or law enforcement;
establish, exercise, or defend legal claims;
enforce our agreements, policies, or terms;
protect the rights, property, safety, or security of Model N, our customers, users, or others; or
investigate, prevent, or respond to fraud, security incidents, or other unlawful activity.

6.7 With Your Direction or Consent

We may disclose Personal Information:

with your consent;
at your direction;
when requested by you; or
as otherwise described at the time information is collected.

6.8 De-identified and Aggregated Information

Model N may disclose de-identified, anonymized, or aggregated information that cannot reasonably be used to identify an individual, as permitted by applicable law.

7. COOKIES AND SIMILAR TECHNOLOGIES

Model N uses cookies and similar technologies to operate, secure, improve, and personalize our websites and online Services.

Cookies are small text files and similar technologies that may be stored on your browser or device when you visit our websites or use certain online Services. Depending on the technology used, these tools may collect information about your device, browser, interactions with our websites, and other technical or usage information.

7.1 How We Use Cookies

Model N uses cookies and similar technologies for purposes such as:

operating and maintaining our websites and online Services;
remembering user preferences and settings;
authenticating users and maintaining secure sessions;
understanding how visitors use our websites and Services;
measuring the effectiveness of our communications and marketing activities;
improving the performance and functionality of our websites and Services; and
supporting advertising and analytics activities where permitted by applicable law.

The specific cookies and technologies used may change over time as our websites and Services evolve.

7.2 Managing Cookie Preferences

You may control or limit certain cookies through your browser settings, device settings, or the cookie preference tools available on our websites, where applicable.

Depending on your location and applicable law, you may also have the ability to consent to or reject certain categories of cookies.

Please note that disabling certain cookies may affect the functionality or availability of portions of the Services.

7.3 Additional Information

Detailed information regarding the cookies and similar technologies used by Model N, including the categories of cookies, their purposes, available user choices, and applicable legal disclosures, is provided in Appendix B – Cookie Notice.

8. YOUR PRIVACY RIGHTS AND CHOICES

Depending on where you live and the circumstances in which Model N processes your Personal Information, you may have certain privacy rights under applicable law.

Those rights vary by jurisdiction and may be subject to exceptions, limitations, or verification requirements.

Model N is committed to responding to privacy requests in accordance with applicable law and our contractual obligations.

8.1 Your Privacy Choices

You may choose how certain Personal Information is collected, used, or communicated.

Depending on your relationship with Model N and the Services you use, you may be able to:

update or correct certain account information;
manage communication preferences, including marketing communications;
manage cookie preferences through our cookie preference tools or browser settings, where available;
withdraw consent where processing is based on consent; and
exercise other choices available under applicable law.

Choosing not to provide certain Personal Information or exercising certain choices may affect our ability to provide particular products, Services, or functionality.

8.2 Privacy Rights

Subject to applicable law, you may have the right to request that Model N:

confirm whether we process your Personal Information;
provide access to your Personal Information;
correct inaccurate Personal Information;
delete Personal Information;
obtain a portable copy of certain Personal Information;
restrict or object to certain processing activities;
withdraw consent where processing is based on consent;
opt out of certain processing activities, including the sale of Personal Information or the sharing of Personal Information for cross-context behavioral advertising, where applicable;
seek redress of grievances relating to the processing of Personal Information;
appeal certain decisions relating to privacy requests; or
exercise other rights available under applicable law.

Not all rights apply in every jurisdiction or in every circumstance.

8.3 How to Exercise Your Rights

Privacy requests may be submitted using the methods identified in Section 13 – Contact Us.

Only you, or someone legally authorized to act on your behalf in certain jurisdictions, may make a request to exercise the rights listed above regarding your Personal Information. If your Personal Information is subject to a law that allows an authorized agent to act on your behalf in exercising your privacy rights and you wish to designate an authorized agent, please provide written authorization signed by you and your designated agent using the information found in Section 13 – Contact Us and ask us for additional instructions.

To help protect Personal Information, Model N may take reasonable steps to verify the identity of the individual submitting a request or confirm the authority of an authorized representative before responding.

Where Model N processes Personal Information solely on behalf of a customer, we may direct the request to the applicable customer or assist the customer in responding in accordance with our contractual obligations and applicable law.

8.4 Response to Requests

Model N will respond to privacy requests within the timeframes required by applicable law.

If we are unable to fulfill a request, we will explain the reason to the extent permitted by law.

Where available under applicable law, individuals may have the right to appeal certain decisions regarding privacy requests.

If your Personal Information is subject to the applicable data protection laws of the European Economic Area or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority if you believe that our processing of your Personal Information violates applicable law.

9. RETENTION OF PERSONAL INFORMATION

Model N retains Personal Information only for as long as necessary to fulfill the purposes for which it was collected, including to provide and support the Services, operate our business, comply with legal and regulatory obligations, resolve disputes, enforce our agreements, protect our legal rights, and satisfy other legitimate business needs.

The length of time we retain Personal Information depends on a variety of factors, including:

the nature and sensitivity of the Personal Information;
the purpose for which it was collected and is processed;
the duration of our relationship with the individual or customer;
applicable contractual commitments;
legal, regulatory, accounting, tax, audit, or reporting requirements;
applicable statutes of limitation; and
the need to establish, exercise, or defend legal claims.

When Personal Information is no longer required for these purposes, Model N will delete, anonymize, de-identify, or otherwise dispose of the information in accordance with applicable law and our records management practices.

Chatbot conversations, AI prompts, uploaded content, and related interaction history may be retained in accordance with Model N’s records management practices for purposes including customer support, quality assurance, security, legal compliance, and service improvement, consistent with applicable law.

Where Model N processes Customer Data on behalf of customers, retention and deletion of Customer Data are governed primarily by the applicable customer agreement.

10. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

Model N is headquartered in the United States and operates globally. As a result, Personal Information may be collected, accessed, processed, stored, or transferred in countries other than the country in which it was originally collected, including the United States and other jurisdictions where Model N, its affiliates, service providers, or business partners operate.

The data protection laws in those jurisdictions may differ from the laws of your country or region.

Where applicable law requires specific safeguards for international transfers of Personal Information, Model N implements appropriate measures designed to protect Personal Information and facilitate lawful transfers. Depending on the circumstances, these measures may include contractual commitments, legally recognized transfer mechanisms, organizational safeguards, or other measures permitted by applicable law.

Additional information regarding international transfers and jurisdiction-specific safeguards is provided in Appendix E – European Economic Area, United Kingdom & Switzerland Privacy Notice.

11. CHILDREN’S PRIVACY

Model N’s Services are designed for business use and are not directed to children.

We do not knowingly collect Personal Information directly from children under 18 through the Services unless such collection is expressly authorized by applicable law or occurs in a context governed by a separate privacy notice.

If Model N becomes aware that Personal Information has been collected from a child in a manner inconsistent with applicable law, we will take appropriate steps to investigate the matter and, where appropriate, delete the information or otherwise address it in accordance with applicable legal requirements.

Parents, guardians, or other individuals who believe that a child has provided Personal Information to Model N in violation of applicable law may contact us using the information provided in Section 13 – Contact Us.

Additional jurisdiction-specific information regarding children’s privacy, including age thresholds or parental consent requirements that may apply in certain jurisdictions, is provided in the applicable supplemental privacy notices where required by law.

12. CHANGES TO THIS PRIVACY POLICY

Model N may update this Privacy Policy, including its appendices, from time to time to reflect changes to our business, Services, technologies, legal or regulatory requirements, or privacy practices.

When we make changes, we will update the Effective Date at the beginning of this Privacy Policy.

If changes materially affect how we process Personal Information, we will provide additional notice where required by applicable law. Depending on the circumstances, such notice may be provided through our websites, the Services, email communications, or other appropriate means.

We encourage individuals to review this Privacy Policy periodically to remain informed about our privacy practices.

13. CONTACT US

If you have questions about this Privacy Policy, wish to exercise your privacy rights, would like to submit a grievance relating to the processing of Personal Information, or would like to contact Model N regarding our privacy practices, please contact us using one of the methods below.

Model N, Inc.
Attn: Privacy / Data Protection Officer
500 Allerton Street, Suite 105
Redwood City, California 94063
United States

Legal Inquiries
Email: legal@modeln.com

Privacy Inquiries
Email: privacy@modeln.com

Data Protection Officer
Email: dpo@modeln.com

When contacting us, please provide sufficient information to help us understand your request and verify your identity where appropriate. Additional information may be requested where necessary to protect Personal Information, verify your identity or to comply with applicable law.

Where applicable, Model N will address grievances in accordance with the requirements of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable law.

Where Model N processes Personal Information solely on behalf of a customer, requests relating to Customer Data may need to be directed to the applicable customer. Where appropriate, Model N will assist customers in responding to such requests in accordance with applicable law and our contractual obligations.

Supplemental Privacy Notices

The following Supplemental Privacy Notices form part of the Model N Privacy Policy.

The Core Privacy Policy applies generally to all individuals whose Personal Information is processed by Model N.

The Supplemental Privacy Notices provide additional information that applies only in specific circumstances, such as where required by applicable law or where particular technologies or processing activities are involved.

Unless otherwise indicated, the Core Privacy Policy and the applicable Supplemental Privacy Notice should be read together.

Appendix	Applies To
Appendix A	Categories of Personal Information processed by Model N.
Appendix B	Cookies and similar technologies used on Model N websites and online Services.
Appendix C	Personal Information processed in connection with AI-enabled functionality and Generative AI features.
Appendix D	Individuals whose Personal Information is subject to the CCPA.
Appendix E	Individuals whose Personal Information is subject to the GDPR, UK GDPR, Swiss FADP, or similar European privacy laws.

Nothing in these Supplemental Privacy Notices limits or replaces the Core Privacy Policy. Where both apply, they should be interpreted together.

Where a Supplemental Privacy Notice conflicts with the Core Privacy Policy solely because of a legal requirement applicable to a particular jurisdiction, the Supplemental Privacy Notice governs with respect to that jurisdiction.

Appendix A – Categories of Personal Information

This Appendix supplements the Core Privacy Policy and provides a summary of the categories of Personal Information that Model N may collect, use, disclose, and otherwise process in connection with its business operations and the Services.

Not every category of Personal Information is collected from every individual. The categories processed depend on your relationship with Model N, the Services you use, and the nature of your interactions with us.

The examples below are illustrative and are not intended to represent every data element that Model N may process.

Retention of the categories described below is governed by the principles set forth in Section 9 – Retention of Personal Information.

Category of Personal Information	Examples	Typical Sources
Contact & Business Information	Name, business email, telephone number, employer, job title, business address	Directly from you, Customers, business partners, event registrations, publicly available business sources
Account & Authentication Information	Username, account ID, password hash, SSO identifier, MFA information, permissions	Directly from you or your organization
Commercial & Relationship Information	Products or Services purchased, contracts, subscriptions, billing contacts, customer support history	Customers, business partners, directly from you
Communications	Emails, support tickets, chatbot conversations, AI prompts, uploaded content, chat messages, webinar registrations, recorded meetings, recorded demonstrations, recorded customer support sessions, recorded sales calls (where permitted by law), survey responses, meeting notes, and similar communications	Directly from you
Technical & Device Information	IP address, browser type, operating system, device identifiers, log data, approximate location derived from IP address, AI interaction metadata	Automatically through websites and Services
Website & Service Usage Information	Pages visited, features used, searches, clickstream data, session activity	Automatically through websites and Services
Financial & Transaction Information	Billing information, invoices, payment status, transaction history	Directly from Customers or authorized representatives or authorized personnel
Professional Information	Employer, department, professional role, certifications	Directly from you, Customers, business partners
Sensitive Personal Information	Account credentials, government identifiers (where required), financial account information, limited health-related or reimbursement-related information where necessary to provide the Services	Directly from you, Customers, authorized representatives
Information from Third Parties	Information received from Customers, business partners, identity providers, event organizers, marketing providers, publicly available business sources, and other authorized third parties	Customers, business partners, identity providers, publicly available sources, event organizers, marketing providers, and other authorized third parties

Relationship to the Core Privacy Policy

This Appendix provides the detailed inventory of Personal Information referenced throughout the Core Privacy Policy.

Additional information regarding:

how Model N uses Personal Information is provided in Section 4;
how Model N shares Personal Information is provided in Section 6;
cookies and similar technologies is provided in Section 7 and Appendix B;
retention is provided in Section 9; and
jurisdiction-specific privacy rights are provided in Appendices D and E.

Appendix B – Cookie Notice

This Cookie Notice supplements the Core Privacy Policy and explains how Model N uses cookies and similar technologies on our websites and online Services.

This Cookie Notice should be read together with Section 7 – Cookies and Similar Technologies of the Privacy Policy.

B.1 What Are Cookies?

Cookies are small text files and similar technologies that are placed on your browser or device when you visit a website or use certain online Services.

Depending on the technology used, cookies and similar technologies may recognize your browser or device, remember information about your preferences, improve website functionality, help us understand how our websites and Services are used, and support security, analytics, and other business operations.

For purposes of this Cookie Notice, references to “cookies” include similar technologies such as pixels, web beacons, local storage, software development kits (SDKs), and comparable technologies where applicable.

B.2 Why Model N Uses Cookies

Model N uses cookies and similar technologies to:

operate and maintain our websites and online Services;
authenticate users and maintain secure sessions;
remember user preferences and settings;
improve website functionality and performance;
understand how visitors interact with our websites and Services;
identify and resolve technical issues;
measure the effectiveness of communications and marketing activities; and
support analytics and, where permitted by applicable law, advertising activities.

Not every cookie is used on every website or Service.

B.3 Categories of Cookies

Depending on the website or Service you use, Model N may use the following categories of cookies.

Category	Purpose	Can You Disable?
Strictly Necessary Cookies	Enable core website functionality, security, authentication, and network management.	No. These cookies are necessary for the website or Service to function properly.
Functional Cookies	Remember preferences and improve user experience.	Yes, through cookie preference tools where available.
Performance & Analytics Cookies	Help us understand how our websites and Services are used and improve their performance.	Yes, through cookie preference tools where available.
Advertising & Marketing Cookies	Measure the effectiveness of marketing activities and, where permitted by law, support personalized advertising.	Yes, through cookie preference tools where available.

The specific cookies used may change over time as our websites, Services, and technology providers evolve.

B.4 Analytics Technologies

Model N may use analytics technologies to better understand how our websites and Services are used, improve functionality, measure performance, and identify opportunities to improve user experience.

These technologies may collect information regarding website usage, device information, browser characteristics, and interactions with our websites and online Services.

B.5 Advertising Technologies

Where permitted by applicable law, Model N may use advertising and marketing technologies to:

understand the effectiveness of marketing campaigns;
measure engagement with our websites;
support business development activities; and
deliver or measure business-to-business advertising.

Model N does not use advertising technologies in all products or Services.

B.6 Managing Cookie Preferences

Depending on your location and applicable law, you may be able to manage your cookie preferences by:

using the cookie preference center available on our websites;
adjusting your browser settings;
managing device settings; or
using other privacy controls made available by your browser or device.

Please note that disabling certain cookies may affect the functionality or availability of portions of the websites or Services.

B.7 Browser Privacy Signals

Where required by applicable law, Model N recognizes and processes browser-based privacy preference signals, such as the Global Privacy Control (“GPC”), in accordance with applicable legal requirements.

Additional information regarding applicable privacy rights is provided in Appendix D – CCPA Privacy Notice.

B.8 Third-Party Technologies

Certain cookies or similar technologies may be provided by third-party service providers acting on Model N’s behalf, including providers that support hosting, security, analytics, communications, customer support, or marketing activities.

The identity of these providers and the technologies they use may change over time.

Current information regarding the cookies and similar technologies used on our websites, including categories, purposes, and providers, is available through our cookie preference center where available.

Appendix C – Artificial Intelligence & Generative AI Privacy Notice

This Appendix supplements the Core Privacy Policy and describes how Model N may process Personal Information in connection with artificial intelligence (“AI”), generative AI, machine learning, automation, and similar technologies used within the Services.

This Appendix should be read together with Section 5 – Artificial Intelligence and Automated Processing.

C.1 Scope

Certain Model N products and Services may include AI-enabled functionality.

This Appendix applies only to those products, Services, or features that incorporate AI technologies.

Not all Model N products or Services include AI-enabled capabilities.

C.2 How Model N Uses AI

Model N may use AI technologies, including conversational interfaces, AI-enabled chatbots, virtual assistants, intelligent search, summarization, drafting assistance, workflow automation, analytics, and security capabilities, to support and enhance the Services, including to:

improve search and information retrieval;
summarize or organize information;
assist users with drafting or analysis;
automate routine business processes;
improve product usability and efficiency;
identify potential errors or anomalies;
enhance cybersecurity and fraud detection; and
improve AI-enabled functionality over time.

The specific AI capabilities available depend on the product or Service being used.

C.3 Personal Information Used by AI Features

Depending on the functionality involved, AI-enabled features may process Personal Information that is provided by users, including prompts, uploaded content, conversation history, chatbot interactions, responses, and technical metadata, contained within Customer Data, generated during use of the Services, or otherwise processed in accordance with the Privacy Policy and applicable customer agreements.

Model N limits the Personal Information processed by AI-enabled features to that which is appropriate for the intended functionality and applicable legal and contractual requirements.

When interacting with AI-enabled chatbots or conversational interfaces through Model N websites or Services, individuals should avoid submitting confidential information, payment card information, passwords, or other sensitive information through chatbot functionality unless specifically requested by Model N as part of an authorized business process.

C.4 Human Oversight

AI-generated outputs are intended to assist users in performing business tasks but do not replace appropriate human review.

Users remain responsible for reviewing AI-generated outputs and determining whether they are appropriate for their intended use.

Model N does not represent that AI-generated outputs are complete, accurate, or appropriate for every circumstance.

C.5 Third-Party AI Providers

Certain AI-enabled functionality may be supported by third-party technology providers acting on Model N’s behalf.

Model N evaluates third-party AI providers using risk-based privacy, security, confidentiality, legal, and AI governance due diligence procedures appropriate to the services provided.

C.6 Customer Data

Where AI-enabled functionality processes Customer Data, Model N processes that information in accordance with applicable customer agreements, including any applicable Master Subscription Agreement, Data Processing Agreement, Business Associate Agreement, AI terms, or other contractual commitments.

Additional information regarding Customer Data and AI is provided in Appendix G – Customer Data & Artificial Intelligence Commitments.

C.7 Improving AI Functionality

Model N may use information generated through the operation of the Services, including telemetry, diagnostic, operational, or similar information, to improve the performance, security, reliability, and functionality of AI-enabled features, consistent with applicable law and contractual commitments.

Model N does not use Customer Data processed on behalf of customers through AI-enabled conversational functionality to train shared or publicly available foundation models unless expressly authorized by the applicable customer.

C.8 Changes to AI Features

Model N may introduce, modify, or discontinue AI-enabled functionality as our products and Services evolve.

Where changes materially affect the processing of Personal Information, Model N will provide additional notice where required by applicable law.

Appendix D – CCPA Privacy Notice

This Appendix supplements the Core Privacy Policy and applies only to individuals who reside in California.

This Appendix should be read together with the Core Privacy Policy.

D.1 California Residents

This section applies only where the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”), applies.

Notice at Collection

At or before the time of collection, California residents have a right to receive notice of our privacy practices. California residents can find this information below.

Personal Information Collected. See the section of this CCPA Privacy Notice titled “Overview of Personal Information Collected, Disclosed, Sold, and/or Shared” for a list of Personal Information that may be collected. If we have previously collected Personal Information in the past 12 months, we may collect that Personal Information from you.
Uses of Personal Information. See Section 4 – How We Use Personal Information of the Core Privacy Policy for a list of the purposes for which we use Personal Information.
Is Personal Information “Sold” or “Shared” for “Cross-Context Behavioral Advertising”? Yes. See the section of this CCPA Privacy Notice titled “Overview of Personal Information Collected, Disclosed, Sold, and/or Shared” for more details. If we have previously “sold” Personal Information or “shared” Personal Information for “cross-context behavioral advertising” in the past 12 months, we may “sell” or “share” that Personal Information if collected from you. See the section of this CCPA Privacy Notice titled “Right to Opt Out of ‘Sales’ of Personal Information and/or ‘Sharing’ for ‘Cross-Context Behavioral Advertising’” for instructions on how to opt out of these activities.
How Long Is Personal Information Retained? The length of time we retain Personal Information depends on a variety of factors, including the nature and sensitivity of the Personal Information; the purpose for which it was collected and is processed; the duration of our relationship with the individual or customer; applicable contractual commitments; legal, regulatory, accounting, tax, audit, or reporting requirements; applicable statutes of limitation; and the need to establish, exercise, or defend legal claims.
Additional Information. For more information on our privacy practices, please review this CCPA Privacy Notice and our Core Privacy Policy. Importantly, the section of our Core Privacy Policy titled “Your Privacy Rights and Choices” includes important details about how you can exercise some of the rights that you have under the CCPA.

Categories of Sources from Which Personal Information Is Collected

We collect Personal Information that you provide to us, Personal Information we collect automatically when you use the Services, Personal Information from AI chatbots and conversational interfaces, and Personal Information from third-party sources.

Overview of Personal Information Collected, Disclosed, Sold and/or Shared

The CCPA provides California residents with the right to know what categories of Personal Information Model N has collected about them, whether Model N disclosed that Personal Information to a service provider or a contractor for a business purpose, whether Model N “sold” that Personal Information, and whether Model N “shared” that Personal Information for “cross-context behavioral advertising” in the preceding 12 months. California residents can find this information below:

Category of Personal Information Collected by Model N	Disclosed to a Service Provider or Contractor for a Business Purpose?	Category of Third Parties Whom Personal Information Is Sold and/or Shared With
Identifiers	Yes	Service Providers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Yes	Service Providers
Protected classification characteristics under California or federal law	Yes	N/A
Commercial information	Yes	Service Providers
Internet or other electronic network activity	Yes	Service Providers
Geolocation data	Yes	N/A
Professional or employment-related information	Yes	N/A
Personal information that reveals the contents of a consumer’s mail, email, and text messages unless Model N is the intended recipient of the communication	Yes	N/A

Uses of Personal Information

We may use and disclose the Personal Information that we collect for the business and commercial purposes described in the section of our Core Privacy Policy titled “How We Use Personal Information.”

Right to Opt Out of “Sales” of Personal Information and/or “Sharing” for “Cross-Context Behavioral Advertising”

Model N “sells” your Personal Information or “shares” your Personal Information for “cross-context behavioral advertising” to provide you with “cross-context behavioral advertising” about Model N’s products and Services.

California residents have the right to opt out of the “sale” of Personal Information and the “sharing” of Personal Information for “cross-context behavioral advertising.” California residents may exercise these rights by clicking here and following the instructions provided.

Disclosure Regarding Individuals Under the Age of 16

Model N does not have actual knowledge of any “sale” of Personal Information of minors under 16 years of age. Model N does not have actual knowledge of any “sharing” of Personal Information of minors under 16 years of age for “cross-context behavioral advertising.”

Sensitive Personal Information

Model N uses and discloses sensitive Personal Information only for the purposes described in this Privacy Policy or for the purposes set forth in Section 7027(m) of the CCPA regulations.

Global Privacy Control

Where required by applicable law, Model N recognizes and processes browser-based privacy preference signals, including the Global Privacy Control (“GPC”). California residents may opt out of “sales” of Personal Information and “sharing” of Personal Information for “cross-context behavioral advertising” that are carried out on https://www.modeln.com/ by broadcasting the opt-out preference signal known as the GPC (on the browsers and/or browser extensions that support such a signal). To download and use a browser supporting the GPC browser signal, visit the Global Privacy Control website. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use to visit https://www.modeln.com/.

No Retaliation for the Exercise of Rights under the CCPA

California residents have the right not to be retaliated against by us for the exercise of their rights conferred by the CCPA.

Appendix E – European Economic Area, United Kingdom & Switzerland Privacy Notice

This Appendix supplements the Core Privacy Policy and applies only where the General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“Swiss FADP”), or similar European privacy laws apply.

This Appendix should be read together with the Core Privacy Policy.

E.1 Scope

This Appendix provides additional information for individuals whose Personal Information is processed by Model N where European privacy laws apply.

Unless otherwise stated, the Core Privacy Policy applies to all processing activities described in this Appendix.

E.2 Controller

Unless otherwise specified or where Model N acts solely on behalf of a customer, the controller responsible for processing Personal Information covered by this Appendix is:

Controller
Model N, Inc.
500 Allerton Street, Suite 105
Redwood City, California 94063
United States

Legal Inquiries
Email: legal@modeln.com

Privacy Inquiries
Email: privacy@modeln.com

Data Protection Officer
Email: dpo@modeln.com

Where Model N processes Customer Data solely on behalf of a customer, the applicable customer generally acts as the controller and Model N acts as a processor in accordance with applicable customer agreements.

E.3 Legal Bases for Processing

Where required by applicable law, Model N processes Personal Information on one or more of the following legal bases:

Core Privacy Policy Section	Performance of a Contract (i.e., to Provide the Services to You)	Legitimate Interest	Consent	Compliance with Legal Obligations
Section 4.1: Provide and Support Our Services
Section 4.2: Operate and Improve Our Business
Section 4.3: Communicate With You
Section 4.4: Protect Model N, Our Customers, and Others
Section 4.5: Comply With Legal and Regulatory Obligations
Section 4.6: Artificial Intelligence and Automated Processing
Section 4.7: Other Lawful Business Purposes

E.4 Data Privacy Framework Certification

Model N complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), as set forth by the U.S. Department of Commerce.

Model N has certified to the U.S. Department of Commerce that it adheres to the Data Privacy Framework Principles with respect to the processing of Personal Information received from the European Union in reliance on the EU-U.S. DPF, from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF, and from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between this Privacy Policy and the applicable Data Privacy Framework Principles, the Data Privacy Framework Principles shall govern.

Additional information regarding the Data Privacy Framework program and Model N’s certification is available through the U.S. Department of Commerce’s Data Privacy Framework website.

E.5 Questions and Complaints

Individuals with questions or complaints regarding Model N’s compliance with the Data Privacy Framework Principles should first contact: legal@modeln.com

Model N will investigate and attempt to resolve complaints regarding its processing of Personal Information received in reliance on the applicable Data Privacy Framework.

E.6 Independent Recourse Mechanism

For Personal Information other than Human Resources Data, Model N commits to refer unresolved complaints concerning Personal Information received in reliance on the Data Privacy Framework to TRUSTe, an independent alternative dispute resolution provider located in the United States.

The services of TRUSTe are provided at no cost to the individual.

Additional information regarding TRUSTe’s dispute resolution process is available through TRUSTe’s published procedures.

E.7 U.S. Regulatory Oversight

Model N is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission with respect to its compliance with the applicable Data Privacy Framework Principles.

Model N may be required to disclose Personal Information in response to lawful requests by public authorities, including to satisfy national security or law enforcement requirements.

E.8 Onward Transfers

Where Model N transfers Personal Information received under the Data Privacy Framework to a third party acting as an agent on its behalf, Model N remains liable under the applicable Data Privacy Framework Principles if that third party processes Personal Information in a manner inconsistent with those Principles, unless Model N proves that it is not responsible for the event giving rise to the damage.

E.9 Binding Arbitration

Under certain conditions, individuals may invoke binding arbitration to address complaints regarding Model N’s compliance with the applicable Data Privacy Framework Principles after other available dispute resolution mechanisms have been exhausted, as provided in Annex I of the Data Privacy Framework Principles. More information is available at the Data Privacy Framework website.