Privacy Policy

Effective: March 10, 2026

Mesa Alta Research, LLC (“Mesa Alta,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, share, and safeguard information when you visit mesa-alta.com (the “Site”). Please read this policy carefully. By using the Site, you agree to the practices described herein.

1. Scope and Applicability

This Privacy Policy applies solely to visitors of mesa-alta.com. It does not apply to individuals participating in clinical trials, research studies, or any other programs governed by separate Institutional Review Board (IRB) protocols, HIPAA Business Associate Agreements, or other regulatory frameworks. If you are a research participant or patient, please refer to the consent documents and privacy notices provided to you through those programs.

2. Information We Collect

2a. Information You Voluntarily Provide

The Site does not currently include a web form that collects personal data. If you choose to contact us by clicking our email address (info@mesa-alta.com), any information you include in that email — such as your name, email address, company, and the content of your message — will be received by us. You provide this information voluntarily.

2b. Automatically Collected Information

When you visit the Site, our hosting infrastructure automatically collects certain technical information, including:

• Your IP address
• Browser type and version
• Operating system
• Pages visited and time spent on each page
• Referring URL (the page that linked you to our Site)
• Date and time of your visit

This information is collected in server logs maintained by Vercel, Inc. (our hosting provider) and is used solely for security monitoring and diagnosing technical issues.

2c. Analytics Data (Consent-Dependent)

If you accept cookies via the consent banner, we use Google Analytics 4 (operated by Google LLC) to collect aggregated, anonymized information about how visitors use the Site. This may include pages viewed, time on site, geographic region (country/city level), device type, and traffic source. Google Analytics uses cookies to distinguish unique visitors. If you decline, no analytics data is collected. See our Cookie Policy for details.

3. How We Use Your Information

We use the information we collect to:

• Respond to partnership, collaboration, and technical inquiries submitted via email
• Maintain the security and integrity of the Site
• Diagnose technical problems and improve Site performance
• Analyze Site usage (if you have consented) to understand how the Site is used and improve its content
• Comply with applicable legal obligations

4. How We Share Your Information

We do not sell, rent, or lease your personal information to any third party. We may share information in the following limited circumstances:

• Service Providers (Sub-processors): We share data with companies that help us operate the Site:
  • Vercel, Inc. — web hosting and infrastructure
  • Google LLC — analytics (Google Analytics 4), only if you have consented to cookies
  These parties are contractually obligated to use your information only as directed by us and in accordance with applicable privacy law.
• Legal Requirements: We may disclose information if required to do so by law or in the good-faith belief that such disclosure is necessary to comply with legal process, protect our rights, or respond to a government request.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction. We will notify you via a prominent notice on the Site before your information becomes subject to a different privacy policy.

5. Your Rights Under GDPR (EU / EEA Visitors)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, subject to certain exceptions.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Data Portability: Receive your personal data in a structured, machine-readable format.
• Right to Object: Object to the processing of your personal data for our legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent (e.g., analytics cookies), you may withdraw that consent at any time by declining via the cookie banner.

Legal bases for processing: We process personal data on the basis of (i) legitimate interests — responding to genuine B2B inquiries and maintaining Site security — and (ii) compliance with legal obligations.Analytics processing is based solely on consent.

To exercise any of these rights, contact us at info@mesa-alta.com with the subject line “GDPR Data Rights Request.” We will respond within 30 days.

6. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) / CPRA grants you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom it is shared.
• Right to Delete: Request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. No opt-out is required.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Shine the Light: We do not share personal information with third parties for direct marketing purposes.

To submit a verifiable consumer request, contact us at info@mesa-alta.com with the subject line “CCPA Data Rights Request.”

7. Data Retention

• Email correspondence: Retained for the duration necessary to respond to the inquiry and for subsequent reasonable business record-keeping, after which it is deleted.
• Server logs (Vercel): Retained per Vercel’s data retention policy (typically 30–90 days).
• Google Analytics data: Retained for 14 months (Google Analytics 4 default retention period), after which it is automatically deleted from Google’s servers.
• Consent preference (localStorage): Stored locally in your browser until you clear it or reset your preference.

8. Data Security

We implement industry-standard security measures appropriate for a research company website, including HTTPS encryption for all data in transit and reliance on Vercel’s SOC 2-certified infrastructure. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security. If you believe your information has been compromised, please contact us immediately at info@mesa-alta.com.

9. Medical and Scientific Disclaimer

10. Children’s Privacy

The Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently received personal information from a person under 18, we will delete that information promptly.

11. International Data Transfers

Mesa Alta Research is based in the United States. If you are accessing the Site from outside the U.S., please be aware that your information may be transferred to, stored, and processed in the U.S., where data protection laws may differ from those in your country. By using the Site, you consent to this transfer.

12. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When we do, we will revise the “Effective” date at the top of this page. We encourage you to review this page periodically for the latest information on our privacy practices. Your continued use of the Site after any changes constitutes your acceptance of the revised policy.

13. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: