Ambio Life Sciences Inc. (“Ambio”, “we”, “us”, “our”) and its subsidiaries provide world-class psychedelic treatments using ibogaine and 5-MeO-DMT.
This Notice describes our practices regarding the collection, storage, usage, and disclosure of personal information (defined below) that relates to identified or identifiable individuals who:
Please read this Notice carefully and make sure that you fully understand and agree to it.
You are not legally required to provide us with any personal information (defined below) and may do so (or avoid doing so) at your own free will. If you do not wish to provide us with your information, or to have it processed by us or any of our services providers (outlined below), please simply do not interact with our Site, or use our Portal. You may, additionally, “opt out” of receiving our emails at any time via the unsubscribe link in the footer of each of our email messages.
If you have questions, inquiries, or complaints, regarding the processing of your personal data, please contact us at:
When we use the term “personal information” in this Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or deidentified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.
Global data protection laws, including the General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, together with its implementing regulations (“CCPA/CPRA”), distinguish between two primary roles in the processing of personal information.
A “data controller” (referred to as a “business” under the CCPA/CPRA) is the entity that determines the purposes and means of processing personal information. A “data processor” (referred to as a “service provider” under the CCPA/CPRA) processes personal information on behalf of, and in accordance with the instructions of, the data controller or business.
Ambio Life Sciences Inc., with its registered address at 700-275 Lansdowne St., Kamloops, BC, V2C 6H6, Canada, is the “data controller” of the personal information of our Site Visitors, Subscribers, Prospective Patients, and Medical Patients (as outlined in Section 2 below).
The categories of personal information we collect, the purposes for which we use it, and the applicable legal bases under the GDPR are set out below.
1. Site Visitors
Categories of Personal Information Collected:
• Internet or other electronic network activity information, including:
Purposes of Use:
Legal Bases:
2. Subscribers
Categories of Personal Information Collected:
• Identifiers and contact information, such as:
Purposes of Use:
Legal Bases:
3. Prospective Patients and Medical Patients
Categories of Personal Information Collected:
• Identifiers and contact information (e.g., name, email, phone number)
• Biographical and demographic information, including:
• Financial information (e.g., billing or payment details)
• Health and medical information
Sensitive Personal Information:
We collect certain categories of information that are considered Sensitive Personal
Information under the CCPA/CPRA, including:
Some of this information may also constitute special category data under the GDPR.
Purposes of Use:
Legal Bases:
Where we process health or other special category data, we do so in accordance with applicable law, including where such processing is necessary for the provision of health care or treatment, compliance with legal obligations, or the establishment, exercise, or defense of legal claims, and, where required, based on explicit consent.
Use of Sensitive Personal Information:
We use and disclose Sensitive Personal Information only as necessary to provide our services, comply with our legal obligations, and for other purposes permitted under applicable law.
We disclose personal information to third parties only where necessary to provide our services, comply with legal obligations, or protect our rights. We do not sell personal information and do not share personal information for cross-context behavioral advertising.
Service Providers and Contractors
We disclose personal information to third party service providers that perform services on our behalf, such as website hosting, data storage, analytics, payment processing, and communications support. These parties are contractually required to use personal information only as necessary to provide services to us and in accordance with applicable law.
Professional and Healthcare Partners
Where relevant, we may disclose personal information to professional advisors and, in the case of medical services, to healthcare providers, laboratories, or other partners involved in delivering care or supporting treatment. Such disclosures are limited to what is necessary for the provision of services and the continuity of our medical care.
Legal and Regulatory Authorities
We may disclose personal information to courts, regulators, law enforcement agencies, or other third parties where required or permitted by law, including to comply with legal obligations, respond to lawful requests, or establish, exercise, or defend legal claims.
Business Transfers
Personal information may be disclosed in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, provided that the recipient agrees to handle such information in a manner consistent with this Notice.
Protection of Rights and Safety
We may disclose personal information where we believe it is necessary to protect the rights, property, or safety of our organization, our Medical Patients, or others, including to prevent fraud or misuse.
International Disclosures
Personal information is stored on secure servers located in Canada and may be transferred to, and processed in, Canada and other jurisdictions where our service providers operate.
Where personal information is transferred across borders, we take appropriate steps to ensure that such transfers comply with applicable data protection laws and that your information remains protected in accordance with this Notice.
For transfers of personal information from the European Union and the European Economic Area, we ensure that an appropriate transfer mechanism is in place in accordance with the GDPR. Depending on the circumstances, this may include reliance on an adequacy decision issued by the European Commission or the implementation of appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
You may request additional information about the specific safeguards applicable to any transfer of your personal information by contacting us using the details set out in the Contact Information section of this Notice.
Sensitive Personal Information
We disclose Sensitive Personal Information only where necessary for the purposes described in this Notice, including to provide services, comply with legal obligations, and to protect vital interests. We do not disclose Sensitive Personal Information for purposes that would require offering a right to limit its use under the CCPA/CPRA.
We use cookies and other technologies for performance, tracking analytics, and personalization purposes. We may share non-identifiable or aggregated extracts of such information with our service providers for our legitimate business purposes.
Cookies are packets of information sent to your web browser and then sent back by the browser each time it accesses the server that sent the cookie. Some cookies are removed when you close your browser session. These are the “Session Cookies.” Some last for longer periods and are called “Persistent Cookies.” We use both types.
Our Site blocks cookie collection until consent is given.
When you visit our Website, we may collect usage statistics about your interaction with the Website, including IP address (processed by Google), device and browser type, operating system, pages visited, time spent on pages, referrer URL, session duration and approximate geographic region.
We use Google Analytics to help analyze how visitors use the Website and to compile statistical reports on website activity. Google Analytics uses cookies to collect standard internet log information and visitor behaviour information. Google Analytics collects the IP address assigned to you when you visit the site, and this information is transmitted to Google. It places a persistent cookie on your web browser to identify you as a unique user the next time you visit the site and recognizes you when you visit other sites that use Google Analytics. Google’s ability to use and share information collected by Google Analytics about your visits to the Website and other sites is governed by the Google Analytics Terms of Use. To see an overview of privacy at Google and how to opt out of certain Google practices, visit Google’s Privacy Policy.
Google Analytics is provided by Google LLC. Information collected through Google Analytics may be transferred to and processed in countries outside of the jurisdiction in which it was collected. For information about the safeguards in place for international transfers, see Section 4 of this Notice.
Ambio makes every reasonable effort to ensure that the personal information we collect, use and disclose is accurate and complete.
Where we become aware that personal information is inaccurate or incomplete, we will take reasonable steps to correct or complete it without delay.
You may request rectification of inaccurate or incomplete personal information at any time by contacting Ambio at
For more information on your rights and how to exercise them, see Sections 11 and 12 below.
Where consent is relied upon as the legal basis for processing your Personal Information, Ambio will obtain your consent before collecting, using or disclosing such information, as required by applicable data protection laws.
Under the General Data Protection Regulation, our legal basis for processing your Personal Information is your consent (Article 6(1)(a) GDPR; Article 9(2)(a) GDPR for Special-Category data such as health information).
For the provision of healthcare services, processing of your health information may also besupported by Article 9(2)(h) GDPR (where such processing is necessary for the provision of health care under the responsibility of a health professional bound by professional secrecy).
You may withdraw consent at any time by providing notice to Ambio at:
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Ambio retains personal information only for so long as is reasonably necessary to achieve the purpose for which it was collected or as required to comply with legal, regulatory, or contractual obligations. Different categories of personal information may be subject to different retention periods.
When the purpose has been fulfilled and the applicable retention period has expired, your personal information will be securely destroyed or anonymized in accordance with Ambio's information disposal procedures, unless continued retention is required by law. In limited circumstances, personal information may be retained beyond the applicable retention period where it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, subject to appropriate safeguards.
For information about the retention period that applies to your personal information, or the criteria used to determine it, you may contact us using the details in the Contact Information section of this Notice.
Ambio ensures that personal information in our custody and/or control is secured in a manner appropriate to the sensitivity of the information. Ambio ensures that records containing personal information are protected from unauthorized collection, access, use, disclosure, destruction, and disposal by putting in place reasonable administrative, physical and technical security measures. All Ambio employees ensure that personal information which they handle as part of their job is secure from unauthorized access, collection, use; that disclosure of personal information is minimized and that records are managed in accordance with an established records retention and disposal system.
Safeguards include:
Right to Object. Where Ambio processes your personal information on a basis other than your consent, you have the right to object to that processing at any time, on grounds relating to your particular situation. Upon receiving an objection, Ambio will cease the processing unless it demonstrates compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
Depending on your location and applicable law, you may have the following rights regarding your personal information.
If you are located in the European Union or the European Economic Area, you may have the following rights under the GDPR:
If you are a California resident, you may have the following rights under the CCPA and CPRA:
To exercise the rights described above, you need to submit your verifiable request to us by contacting us using the contact information provided below. For us to respond to your request, it’s necessary that we know who you are. Therefore, you can only exercise the above rights by making a verifiable request which must:
We will not be able to respond to any request if we are unable to verify your identity and therefore confirm the personal information in our possession relates to you.
Ambio will respond to your request within 30 days of receiving it. If your request is unusually complex, Ambio may extend the response period by a further 30 days, provided you are informed of the extension and the reasons for it within the initial 30-day period.
If you have any questions relating to our processing of your personal data and to exercise your rights in relation to our processing of your personal data, you may contact the Data Protection Officer at :
We may update this Notice from time to time to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons. Where we make material changes to this Notice, we will notify you by appropriate means (such as by posting a prominent notice on our Site or by email) before the changes take effect. We encourage you to review this Notice periodically for the latest information about our privacy practices.
