Employment Application Privacy Notice

Effective date: August 25, 2026  |  Version: 1.0

OncoFirm Diagnostics Corporation (“OncoFirm”, “we”, “us”, “our”) respects the privacy of everyone who applies to work with us. This Applicant Privacy Notice explains what personal data we collect when you apply for a position, an internship, a postdoctoral appointment, or a consulting engagement with OncoFirm; why we collect it; how long we keep it; who we share it with; and the rights and choices you have. It applies whether you apply through the form on this website, by email, through a job board or recruiter, or through a referral.

Please read this notice before you submit an application. Submitting an application is voluntary, but we cannot consider you for a position without the information described below. If anything in this notice is unclear, contact us at [email protected] before you apply.

1. Who is responsible for your data

The data controller (the organization that decides how and why your personal data is processed) is:

OncoFirm Diagnostics Corporation
Port Washington, New York 11050
United States of America
Telephone: +1 516-900-2606
Privacy inquiries: [email protected]
Application and accommodation inquiries: [email protected]

OncoFirm is a New York corporation. We have not appointed a data protection officer because the law does not require one for an organization of our size and activities; the privacy mailbox above reaches the person responsible for data protection. [If OncoFirm has appointed a representative in the European Union or the United Kingdom under Article 27 of the GDPR or UK GDPR, insert the representative’s name and contact details here. A representative is generally not required where processing of EU or UK residents’ data is occasional and low-risk, which is typically the case for a small number of job applications.]

2. Who this notice covers

This notice covers job applicants and candidates at every stage of recruitment, from initial application through interviews, offers, and pre-employment checks. It also covers the people you name as references and anyone else whose details you include in your application, such as a former supervisor or a co-author. If you include another person’s details, please make sure they are aware that you have done so and that they may be contacted by us.

If you become an employee, consultant, or intern, a separate employee privacy notice will apply to the information we hold about you from that point on.

3. The personal data we collect

We collect the following categories of personal data. Most of it comes directly from you through the application form or your resume and documents.

Identity and contact details

Your name, email address, telephone number, city, state or region, and country, and the links you choose to share to professional profiles such as LinkedIn, ORCID, Google Scholar, ResearchGate, GitHub, or a personal website.

Application details

The position you are applying for, the job reference, the type of employment you are seeking, how you heard about the opportunity, and the name of anyone who referred you.

Qualifications and professional background

Your education (degrees, fields of study, institutions, and additional training), years of experience, areas of scientific and technical expertise, laboratory techniques and software skills, publications, patents and presentations, professional licenses and certifications, grant and research-funding experience, and regulatory, quality, and clinical experience. This also includes everything contained in your resume or CV, cover letter, and any supporting document you upload.

Availability and preferences

Your earliest start date, notice period, work-arrangement preferences, willingness to relocate or travel, and any compensation expectations you choose to share. We do not ask about your current or previous salary.

Work authorization

Whether you are legally authorized to work in the United States and whether you will require visa sponsorship. We do not ask about your citizenship, immigration status, or national origin, and we do not request identity documents until after an offer has been accepted.

References

The names, titles, organizations, and contact details of any references you provide, and later the information those references give us about you. We contact references only with your permission and only if you are being considered for an offer.

Interview and assessment information

If you progress to interviews, we create records of the process: interview notes, evaluations of your presentation or technical discussion, and internal correspondence about your candidacy.

Pre-employment verification

If we make you a conditional offer, we may verify your education, credentials, licenses, employment history, and eligibility to work. Where permitted by law, and only with your separate written authorization, a background check may be carried out by a specialist provider. That provider will give you its own disclosures and notices before any check is run.

Accommodation requests

If you request an accommodation for the application or interview process, we will process the information you give us about your needs, which may include information about your health or a disability. We use it only to arrange the accommodation and keep it separate from the evaluation of your application.

Technical and submission data

When you submit the online form we record the date and time of submission, the internet protocol (IP) address and browser details of the device you used, the page from which you submitted, and the name you type as your electronic signature. This information forms part of the record of your application and helps us detect fraudulent or automated submissions.

Information we do not want you to send

We do not ask for, and ask you not to include, your date of birth, photograph, government identification numbers such as a Social Security number, financial account details, salary history, criminal history, or information about your health or disability (other than an accommodation request), race or ethnicity, religion or beliefs, sexual orientation, trade-union membership, genetic or biometric data, or political opinions. If you include any of this information anyway, we will treat it as provided voluntarily, we will not use it in evaluating your application, and we may delete it from your record.

4. Where we get your data

We receive personal data about you from the following sources:

• You, through the application form, your resume and documents, emails, telephone calls, and interviews.
• The public professional profiles and publications you point us to, such as LinkedIn, ORCID, Google Scholar, GitHub, journal articles, and patent databases, which we may consult to understand your work.
• Job boards, recruiters, and staffing agencies, if you applied through one of them.
• OncoFirm employees, advisors, and collaborators who refer you to us.
• Your references, with your permission.
• Background-check providers, after a conditional offer and only with your separate written authorization.
• Our own records, if you have applied to OncoFirm before or asked to be kept in our talent pool.

5. Why we use your data and the legal basis for doing so

We use your personal data for the purposes listed in the table below. Where data-protection law such as the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection requires us to have a legal basis for each purpose, that basis is shown in the right-hand column.

Purpose	What we do	Legal basis
Processing your application	Receiving your application, assessing your qualifications and experience against the role, shortlisting, arranging and conducting interviews, and deciding whether to make you an offer.	Taking steps at your request before entering into a contract (GDPR Article 6(1)(b)); our legitimate interest in recruiting qualified staff (Article 6(1)(f)).
Communicating with you	Acknowledging your application, answering your questions, scheduling interviews, and informing you of the outcome.	Steps before entering into a contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)).
Verifying information	Checking qualifications, licenses, publications, and employment history, and contacting the references you provide.	Legitimate interest in making sound hiring decisions (Article 6(1)(f)); your consent for contacting references (Article 6(1)(a)); background checks only with your separate written authorization.
Complying with the law	Confirming eligibility to work in the United States, keeping records required by employment and equal-opportunity laws, responding to lawful requests from authorities, and meeting our obligations under grant and contract terms.	Compliance with legal obligations (Article 6(1)(c)).
Providing accommodations	Arranging reasonable accommodations for the application or interview process when you request them.	Our obligations under employment law (Article 9(2)(b)) and, where applicable, your explicit consent (Article 9(2)(a)).
Keeping you in our talent pool	Retaining your application after a recruitment process ends and contacting you about future openings, if you tick the optional box on the application form.	Your consent (Article 6(1)(a)), which you can withdraw at any time.
Protecting OncoFirm and others	Preventing fraud and misuse of our website and forms, keeping our systems secure, and establishing, exercising, or defending legal claims.	Legitimate interests (Article 6(1)(f)); compliance with legal obligations (Article 6(1)(c)).
Starting employment	If you are hired, using your application to create your personnel record and complete onboarding.	Performance of your employment contract (Article 6(1)(b)).

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your interests, rights, and freedoms, and concluded that they are not, given that you have applied to us and can reasonably expect us to assess your application in the ways described. You have the right to object to processing based on legitimate interests; see section 11.

We will not use your personal data for a purpose unrelated to recruitment without telling you first and, where required, obtaining your consent.

6. Automated decision-making and artificial intelligence

We do not make hiring decisions solely by automated means, and we do not use automated employment decision tools of the kind regulated by New York City Local Law 144 to screen, rank, or score candidates. A member of the OncoFirm team reads every application. Everyday software we use, such as email, document, and spreadsheet applications, may include general-purpose artificial-intelligence features; we do not use such features to decide whether an applicant advances. [Confirm this statement reflects OncoFirm’s actual practice and update it if any screening or interview tool is adopted in future.]

7. Who we share your data with

We share your personal data only as described here. We do not sell it, rent it, or share it for advertising or marketing purposes.

• The OncoFirm hiring team. The founders, managers, and scientists involved in filling the position, each of whom is bound by confidentiality obligations.
• Advisors and collaborators who take part in interviews. For some scientific roles we may ask a scientific advisor or collaborating investigator to join an interview or review a research presentation. They receive only what they need for that purpose and are bound by confidentiality.
• Service providers that process data on our behalf. These include the company that hosts our website and the form you submit; our email provider, through which application notifications and attachments are delivered; cloud storage and productivity services where applications are filed; and video-conferencing services used for remote interviews. [List the actual providers, for example: web hosting – (name); email – Google Workspace or Microsoft 365; storage – (name); video interviews – Zoom, Google Meet or Microsoft Teams.] Each provider is contractually restricted to using your data only to provide its service to us.
• Background-check providers. Only after a conditional offer and with your separate written authorization.
• Professional advisers. Our lawyers, accountants, insurers, and similar advisers, where necessary to obtain advice or protect our rights.
• Public authorities and courts. Where we are required to do so by law, regulation, subpoena, or court order, or to protect the rights, safety, or property of OncoFirm, our staff, or others.
• A successor organization. If OncoFirm is involved in a merger, acquisition, financing, reorganization, or sale of assets, applicant records may be transferred to the successor, which will be bound by this notice.

8. International transfers

OncoFirm operates in the United States, and all applicant data is stored and processed there, including by our United States-based service providers. If you apply from outside the United States, your data will be transferred to the United States when you submit your application.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the laws of your country may regard the United States as not providing an equivalent level of data protection. We rely on the following grounds for the transfer: the transfer is necessary to take steps at your request before entering into a contract with you (GDPR Article 49(1)(b) and the corresponding provisions of the UK GDPR and Swiss law), and you give your explicit consent to the transfer when you submit the application form after being informed, in this notice, of the possible risks (Article 49(1)(a)). You can withdraw that consent at any time, although we will then be unable to continue considering your application. Where our service providers process data on our behalf, we rely on their contractual commitments, including standard contractual clauses where they apply. [OncoFirm is not certified under the EU-U.S. Data Privacy Framework; delete this sentence or update it if that changes.]

9. How long we keep your data

Situation	Retention period
You applied for a specific opening and were not hired	12 months after the recruitment decision for that opening, unless a longer period is required by law, needed to respond to a claim or a government inquiry, or you have consented to the talent pool.
You asked to be kept in our talent pool	Up to 24 months from the date of your consent. We may ask you to renew your consent before it expires. You can withdraw at any time, after which the 12-month period above applies to any specific application you made.
You withdrew your application	12 months from the date of withdrawal, unless a longer period is required by law.
You were hired	Your application becomes part of your personnel record and is retained in accordance with our employee privacy notice and applicable employment-record laws.
Accommodation requests	Kept separately from your application and retained only as long as needed to provide the accommodation and to meet legal record-keeping requirements.
Technical records of form submissions	Web-server and security logs are kept for a short period, normally no more than [90] days, for security and troubleshooting.

When a retention period ends we delete or anonymize your data. Copies may persist for a limited further period in our email provider’s backups [confirm the provider’s backup retention, typically 30 days] before they are overwritten; those copies are not used for any purpose other than disaster recovery.

10. How we protect your data

We take reasonable administrative, technical, and physical measures to protect applicant data against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. Applications are transmitted over encrypted connections, the mailbox that receives them is restricted to the people involved in hiring and protected by multi-factor authentication, our service providers encrypt data at rest, and everyone who handles applicant data is bound by confidentiality obligations. We follow the retention schedule in section 9 so that data is not kept longer than needed. These safeguards are designed to meet the requirements of New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act and similar laws. No method of transmission or storage is completely secure, and we cannot guarantee absolute security; if a breach affecting your data occurs, we will notify you and the relevant authorities as the law requires.

To protect your own data, please send documents only through the application form or to the email addresses published on this website, and do not include the sensitive information described in section 3.

11. Your rights and choices

Rights we extend to every applicant

Wherever you live, you may ask us to:

• Access the personal data we hold about you and receive a copy of it;
• Correct data that is inaccurate or incomplete;
• Delete your application and the data associated with it, subject to any record we are legally required to keep;
• Withdraw a consent you have given, including the talent-pool consent, without affecting processing that took place before withdrawal; and
• Stop contacting you about future opportunities.

Additional rights if you are in the European Economic Area, the United Kingdom, or Switzerland

In addition to the rights above, you have the right to restrict our processing of your data in certain circumstances; to receive the data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another organization where technically feasible (data portability); to object at any time to processing that is based on our legitimate interests, in which case we will stop unless we can show compelling legitimate grounds that override your interests, rights, and freedoms; and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.

You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the country where you live or work. In the European Union, the authorities are listed by the European Data Protection Board at edpb.europa.eu; in the United Kingdom, the authority is the Information Commissioner’s Office, ico.org.uk; in Switzerland, it is the Federal Data Protection and Information Commissioner, edoeb.admin.ch. We would welcome the chance to address your concern directly before you contact an authority.

If you are a California resident

The California Consumer Privacy Act (CCPA) gives California residents, including job applicants, specific rights against businesses that meet the law’s revenue or data-volume thresholds. OncoFirm does not currently meet those thresholds, so the CCPA does not currently apply to us; we nevertheless extend the rights listed under “Rights we extend to every applicant” to California residents, and this notice serves as our notice at collection of the categories of personal information we collect and the purposes for which we use them. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes other than those permitted by law. We will not discriminate against you for exercising any privacy right. If OncoFirm becomes subject to the CCPA, we will update this notice.

If you live in another U.S. state

Several states have comprehensive privacy laws; most of them exclude data processed in the context of a job application, and OncoFirm does not meet the applicability thresholds of those laws. Regardless of where you live, you can exercise the rights listed under “Rights we extend to every applicant.”

How to exercise your rights

Email [email protected] from the address you used to apply, or write to the postal address in section 1, stating which right you wish to exercise. We may ask you to confirm your identity, for example by responding from your application email address or by confirming details from your application, before we act on a request. If you use an authorized agent, we will ask for evidence of their authority. We respond within one month for requests under the GDPR or UK GDPR, within 45 days for requests under United States state laws, and otherwise as promptly as we reasonably can; if a request is complex we may extend that period as the law allows and will tell you why. There is no charge for making a request unless it is manifestly unfounded or excessive. If we decline all or part of a request, we will explain the reason and how you can appeal or complain.

12. Website data, cookies, and third-party sites

The application form is part of our website, which uses Google Tag Manager and related analytics tools to understand how visitors use the site. Those tools are governed by our [Website Privacy Policy – insert link; the website does not currently publish one] rather than by this notice. Beyond the technical and submission data described in section 3, we do not use cookies or analytics to profile applicants or to inform hiring decisions.

Our careers pages may link to third-party sites such as LinkedIn, job boards, or scientific profile services. Those sites have their own privacy policies, and we are not responsible for how they handle your data. If you apply through a job board or recruiter, that organization’s privacy notice also applies to the data you gave it.

13. Applicants under 18

Our positions, including internships, are intended for adults. We do not knowingly collect personal data from anyone under 16, and applicants for internships must be at least [18] years old. If you believe we have received an application from a minor, please contact us so that we can delete it.

14. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or in the law. The effective date and version number at the top of the page show the current version. If we make a material change that affects applications already in progress, we will inform the applicants concerned by email.

15. How to contact us

Questions, requests, and complaints about this notice or about how we handle your personal data can be sent to:

OncoFirm Diagnostics Corporation — Attention: Privacy
24 Dolphin Green #H2C, Port Washington, New York 11050, United States
Email: [email protected]
Telephone: +1 516-900-2606

To request an accommodation for the application or interview process, or to ask about an application you have submitted, email [email protected].

OncoFirm Diagnostics Corporation is an equal opportunity employer. This notice describes our privacy practices; it is not a contract and does not create any right to employment.