Privacy Policy 

Transform-CX Incorporated – HX OS

Last Updated: April 30th 2026

1. Introduction

Transform-CX Incorporated (“Transform-CX,” “we,” “us,” or “our”) operates HX OS (the “Service”), a secure web-based platform designed to help client organizations collect, organize, analyze, and report user-submitted information through an easy-to-use digital interface.

This Privacy Policy explains how we collect, use, disclose, store, and safeguard personal information when authorized users access or use HX OS. It also explains certain rights and choices that may be available to users under applicable privacy laws.

We are committed to protecting user privacy while also protecting the integrity, security, intellectual property, trade secrets, proprietary systems, and lawful business interests of Transform-CX.

Where HX OS is made available through an employer, business, nonprofit, institution, or other client organization, we may process certain information on behalf of that client organization under a separate written agreement.

Please read this Privacy Policy carefully before using HX OS.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected through HX OS and related services, communications, reports, forms, surveys, dashboards, and support activities.

This Privacy Policy does not apply to:

• Third-party websites, platforms, or services not controlled by Transform-CX;

• Independent privacy practices of client organizations;

• Employment, HR, disciplinary, operational, or management decisions made by client organizations;

• Data handling practices covered by a separate written agreement, Data Processing Addendum, Master Services Agreement, or other binding contract, except where this Privacy Policy is incorporated by reference.

If you access HX OS through your employer or another organization, that organization may have its own privacy notices, employee policies, consent forms, or data handling practices. You should review those materials separately.

3. Our Role

Depending on the context, Transform-CX may act as a service provider, processor, contractor, platform operator, or independent business with respect to certain personal information.

When HX OS is provided to a client organization, the client organization may determine:

• Which users are authorized to access HX OS;

• What information is requested from users;

• The purpose of collecting information;

• Which reports, dashboards, or outputs are generated;

• Who within the client organization may access certain outputs;

• How the client organization uses the information, subject to applicable law and contract.

Transform-CX is responsible for operating, securing, maintaining, and improving HX OS, but Transform-CX is not responsible for the independent employment, HR, disciplinary, management, or operational decisions of client organizations, except to the extent required by applicable law or written agreement.

4. Notice at Collection for California Residents

This section is intended to serve as a notice at collection for California residents where applicable.

We may collect the categories of personal information described in this Privacy Policy for the following purposes:

• Providing and maintaining HX OS;

• Authenticating users;

• Processing user submissions;

• Generating reports, dashboards, summaries, analytics, and insights;

• Supporting client organizations;

• Improving functionality, reliability, usability, and security;

• Preventing fraud, misuse, unauthorized access, or security incidents;

• Complying with legal, regulatory, contractual, and audit obligations;

• Protecting the rights, property, trade secrets, confidential information, and lawful interests of Transform-CX.

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising as those terms are defined under applicable California privacy law, unless we update this Privacy Policy and provide any legally required rights or notices.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law, contract, security needs, audit requirements, dispute resolution, enforcement of rights, or client instructions.

5. Information We Collect

We may collect the following categories of information when you use HX OS.

A. Account and Authentication Information

When you sign in using your Google account or another approved authentication method, we may receive or collect:

• Name;

• Email address;

• Google account ID or similar account identifier;

• Profile photo, if made available through your Google account;

• Organization, client, or account affiliation;

• User role, permission level, or access status.

This information is used to authenticate users, control access, secure the Service, and associate submissions with authorized accounts where applicable.

B. Information You Provide Through HX OS

We may collect information that you voluntarily submit through the Service, including:

• Survey responses;

• Form entries;

• Feedback;

• Comments;

• Ratings;

• Reflections;

• Written responses;

• User-generated inputs;

• Uploaded content, if file upload features are enabled;

• Other information submitted through HX OS forms, workflows, modules, or interfaces.

The type of information collected may vary depending on how a client organization configures and uses HX OS.

C. Workplace or Organizational Information

Where HX OS is used by a client organization, we may receive or process organizational information, such as:

• Department;

• Team;

• Role or job category;

• Work location or region;

• Program, project, cohort, or training group;

• Participation status;

• Completion status;

• Client-designated identifiers or classifications.

This information may be provided by the client organization or submitted by users.

D. Automatically Collected Technical Information

When you use HX OS, we may automatically collect certain technical and usage information, including:

• Date and time of access or submission;

• Browser type;

• Operating system;

• Device information;

• IP address, if collected;

• Login and access logs;

• Error logs;

• Security logs;

• Usage activity within the Service;

• System performance information.

This information is used for security, troubleshooting, audit, service improvement, access control, and platform reliability.

E. Derived, Analytical, or Generated Information

HX OS may generate derived information from user submissions and platform activity, including:

• Reports;

• Dashboards;

• Summaries;

• Trends;

• Scores;

• Indicators;

• Classifications;

• Insights;

• Aggregated analyses;

• De-identified analyses;

• Recommendations or observations generated through configured workflows.

These outputs may be used to provide services to client organizations, improve HX OS, support reporting, maintain quality, protect security, and develop new or improved features.

6. Sensitive Personal Information

HX OS is not intended to collect highly sensitive personal information unless the Service is specifically configured to do so by a client organization and such collection is lawful and authorized.

Users should not submit the following types of information unless HX OS expressly requests it and the collection has been authorized:

• Government identification numbers;

• Financial account numbers;

• Passwords;

• Medical records;

• Genetic or biometric identifiers;

• Precise geolocation;

• Information about race, ethnicity, religion, sexual orientation, trade union membership, or health, unless specifically and lawfully requested;

• Any other information that is not reasonably necessary for the intended use of the Service.

Where we process sensitive personal information, we use it only for limited lawful purposes, such as providing the Service, maintaining security, preventing misuse, complying with legal obligations, supporting client-authorized business purposes, and protecting the rights and interests of Transform-CX.

7. How We Use Information

We may use the information we collect for the following purposes:

• To provide, operate, and maintain HX OS;

• To authenticate users and manage access;

• To store, organize, and process user submissions;

• To generate reports, dashboards, analytics, summaries, insights, and related outputs;

• To provide services to client organizations;

• To respond to support requests;

• To troubleshoot technical issues;

• To improve the performance, usability, reliability, and functionality of HX OS;

• To develop, test, and improve product features;

• To monitor and maintain security;

• To prevent fraud, misuse, unauthorized access, or unlawful activity;

• To enforce agreements, policies, and legal rights;

• To comply with legal, regulatory, contractual, and audit obligations;

• To protect Transform-CX, HX OS, users, client organizations, service providers, and the public.

We may also use information as otherwise described at the time of collection or as permitted by applicable law.

8. Reports, Dashboards, and Client Organization Access

Depending on how HX OS is configured, client organizations may receive access to reports, dashboards, summaries, analytics, or other outputs based on information submitted through the Service.

These outputs may be:

• Individual-level;

• Team-level;

• Department-level;

• Organization-level;

• Aggregated;

• De-identified;

• Pseudonymized;

• Configured based on client-authorized settings.

The level of identifiability may vary depending on the configuration selected by the client organization, the size of the reporting group, the type of information submitted, and applicable contractual or legal requirements.

Transform-CX encourages client organizations to use HX OS data fairly, responsibly, lawfully, and consistently with their own privacy, employment, and organizational policies.

Transform-CX does not control how a client organization independently uses information or reports after they are provided, except as set out in a written agreement or required by law.

9. Aggregated, De-Identified, and Anonymized Data

We may create and use aggregated, anonymized, or de-identified data derived from HX OS activity and submissions.

We may use this information for lawful business purposes, including:

• Product improvement;

• Analytics;

• Benchmarking;

• Research and development;

• Security monitoring;

• Quality assurance;

• Feature development;

• Internal reporting;

• Business planning;

• Demonstrations that do not identify individual users or client organizations;

• Development of proprietary methods, models, frameworks, workflows, and insights.

We will not attempt to re-identify de-identified data except as permitted by law, such as for security testing, validation of de-identification processes, legal compliance, or enforcement of rights.

Transform-CX may retain aggregated, anonymized, or de-identified data for as long as permitted by law and contract.

10. How We Share Information

We do not sell, rent, or trade personal information.

We may share personal information only in the following limited circumstances:

A. With Client Organizations

Where HX OS is provided through a client organization, we may share information, reports, dashboards, summaries, or outputs with that client organization according to the Service configuration, applicable agreement, and lawful business purpose.

B. With Service Providers and Contractors

We may share information with trusted service providers, contractors, vendors, and subprocessors that help us operate HX OS, including providers of:

• Hosting;

• Authentication;

• Data storage;

• Security;

• Analytics;

• Technical support;

• Communication tools;

• Infrastructure services.

This may include Google Workspace, Google Apps Script, Google Sheets, Google authentication services, and related Google services, where applicable.

These parties are authorized to process information only as necessary to provide services to us or as otherwise permitted by law and contract.

C. For Legal, Compliance, and Safety Purposes

We may disclose information where we believe disclosure is reasonably necessary to:

• Comply with applicable law;

• Respond to lawful requests, subpoenas, court orders, or legal processes;

• Cooperate with regulators or law enforcement;

• Enforce our agreements;

• Protect the rights, property, safety, trade secrets, confidential information, or lawful interests of Transform-CX;

• Detect, prevent, or respond to fraud, security incidents, misuse, or unlawful activity;

• Preserve evidence or defend against legal claims.

D. In Connection With Business Transactions

We may disclose or transfer information in connection with a merger, acquisition, financing, restructuring, sale of assets, transfer of business, bankruptcy, or similar transaction involving Transform-CX, subject to applicable law and appropriate safeguards.

11. Data Storage and Security

HX OS is designed to use secure cloud-based infrastructure, which may include Google Workspace, Google Apps Script, Google Sheets, and related Google services.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including, where appropriate:

• Access controls;

• Role-based permissions;

• Authentication measures;

• Encryption in transit or at rest where supported and appropriate;

• Audit and access logs;

• Internal access restrictions;

• Security monitoring;

• Review of authorized users and permissions;

• Reasonable vendor and service provider controls.

Access to HX OS data is limited to authorized personnel, service providers, and client-designated administrators who have a legitimate need to access the information.

However, no method of transmission, storage, hosting, or electronic processing is completely secure. We cannot guarantee absolute security, and users should use the Service responsibly and avoid submitting unnecessary or unauthorized sensitive information.

12. Security Incidents

If we become aware of a security incident involving personal information, we will investigate and take appropriate steps consistent with applicable law, our contractual obligations, and the nature of the incident.

Where legally required, we may notify affected users, client organizations, regulators, law enforcement, or other appropriate parties.

Transform-CX reserves the right to take actions necessary to protect HX OS, its systems, users, client organizations, confidential information, trade secrets, and legal rights.

13. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including:

• Providing HX OS;

• Maintaining user accounts;

• Supporting client organization needs;

• Generating and preserving reports;

• Complying with client agreements;

• Maintaining security and audit logs;

• Resolving disputes;

• Enforcing agreements and rights;

• Complying with legal, tax, accounting, regulatory, or reporting obligations;

• Protecting Transform-CX’s legal and business interests.

Retention periods may vary depending on the type of information, client instructions, contractual requirements, legal obligations, operational needs, security requirements, and dispute-resolution needs.

Aggregated, anonymized, or de-identified data may be retained for a longer period, including indefinitely, where permitted by law and contract.

14. Your Rights and Choices

Depending on where you live and the nature of your relationship with Transform-CX or a client organization, you may have certain privacy rights under applicable law.

These may include the right to:

• Request access to personal information associated with you;

• Request a copy of certain personal information;

• Request correction of inaccurate personal information;

• Request deletion of personal information, subject to lawful exceptions;

• Request information about categories of personal information collected, used, disclosed, sold, or shared;

• Opt out of sale or sharing, where applicable;

• Limit certain uses or disclosures of sensitive personal information, where applicable;

• Withdraw Google account access through your Google Account settings;

• Use an authorized agent to submit requests, where permitted by law;

• Be free from unlawful discrimination for exercising privacy rights.

To exercise these rights, please contact us using the contact information listed below.

We may need to verify your identity before processing a request. Where information is processed on behalf of a client organization, we may refer your request to that client organization or coordinate with the client organization to respond, consistent with applicable law and our contractual obligations.

Certain requests may be denied or limited where permitted by law, including where retention is necessary for security, legal compliance, contract performance, audit, dispute resolution, internal operations, protection of rights, client instructions, or other lawful purposes.

15. California Privacy Rights

If you are a California resident, California law may provide you with specific rights regarding your personal information.

Subject to applicable limitations and exceptions, California residents may have the right to:

• Know what categories of personal information we collect;

• Know the categories of sources from which personal information is collected;

• Know the purposes for collecting, using, disclosing, selling, or sharing personal information;

• Know the categories of third parties to whom personal information is disclosed;

• Request access to specific pieces of personal information;

• Request deletion of personal information;

• Request correction of inaccurate personal information;

• Opt out of sale or sharing of personal information;

• Limit use or disclosure of sensitive personal information where applicable;

• Not be discriminated against for exercising privacy rights.

We do not sell personal information.

We do not share personal information for cross-context behavioral advertising unless we update this Privacy Policy and provide any legally required opt-out rights.

To submit a California privacy request, please contact us at:

Email: [Insert Privacy Email Address]
Website: [Insert Website or Privacy Request Link]

We may require reasonable verification of your identity before fulfilling a request.

If you use an authorized agent, we may require proof that the agent is authorized to act on your behalf and may also require you to verify your identity directly with us, unless prohibited by law.

16. Google Account Access

HX OS may use Google Sign-In or related Google services to authenticate users.

When you connect your Google account, we may receive basic account information such as your name, email address, profile photo, and Google account ID.

We do not collect your Google account password.

You may revoke HX OS access through your Google Account settings. Revoking access may limit or prevent your ability to use HX OS.

17. User Responsibilities

Users are responsible for using HX OS lawfully and appropriately.

Users should not:

• Submit information they are not authorized to provide;

• Submit unnecessary sensitive personal information;

• Attempt to access data, accounts, reports, or systems without authorization;

• Misuse, copy, scrape, reverse engineer, disrupt, or compromise HX OS;

• Upload malicious code or harmful content;

• Use HX OS in violation of applicable law, client policies, or Transform-CX agreements.

Transform-CX reserves the right to restrict, suspend, or terminate access where we reasonably believe the Service is being misused, accessed unlawfully, or used in a way that may harm users, client organizations, Transform-CX, HX OS, or our systems.

18. Protection of HX OS and Transform-CX Proprietary Rights

HX OS is the proprietary product of Transform-CX.

Nothing in this Privacy Policy grants any user, client organization, or third party any ownership interest, license, or right in or to HX OS or any Transform-CX intellectual property, confidential information, or trade secrets.

This includes, without limitation:

• Source code;

• Object code;

• Scripts;

• Workflows;

• System architecture;

• Databases;

• Data structures;

• Templates;

• Dashboards;

• Reports;

• Designs;

• User interfaces;

• Documentation;

• Training materials;

• Scoring methods;

• Analytical models;

• Algorithms;

• Prompts;

• Business logic;

• Processes;

• Frameworks;

• Methodologies;

• Know-how;

• Trade secrets;

• Product roadmap;

• Security architecture;

• Proprietary configurations.

Transform-CX may use aggregated, anonymized, or de-identified information to operate, protect, improve, and develop HX OS, provided that such use is consistent with applicable law and contract.

Users and client organizations may not copy, reproduce, reverse engineer, decompile, disassemble, scrape, misuse, or attempt to derive the underlying structure, ideas, methods, source code, models, or proprietary processes of HX OS except to the extent such restrictions are prohibited by applicable law.

19. Confidentiality and Platform Integrity

Users may receive access to information, reports, dashboards, or materials through HX OS that are confidential, proprietary, or intended only for authorized use.

Users must not disclose, distribute, export, copy, or misuse HX OS information, reports, or platform materials except as authorized by Transform-CX, the applicable client organization, or written agreement.

Transform-CX reserves all rights necessary to protect the confidentiality, integrity, availability, and lawful operation of HX OS.

20. International Processing

Personal information may be processed and stored in the United States or other locations where Transform-CX, client organizations, service providers, or subprocessors operate.

By using HX OS, you understand that your information may be processed in jurisdictions that may have privacy and data protection laws different from those in your location.

Where required by law, we will implement appropriate safeguards for cross-border processing.

21. Children’s Privacy

HX OS is intended for authorized users of client organizations and is not directed to children.

We do not knowingly collect personal information from individuals under the age of 16. If we learn that we have collected personal information from an individual under 16 without appropriate authorization, we will take reasonable steps to delete or restrict such information, unless retention is required or permitted by law.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we update the Privacy Policy, we will revise the “Last Updated” date above. Where required by law or where changes are material, we may provide additional notice through HX OS, email, client communication, or other appropriate means.

Your continued use of HX OS after an updated Privacy Policy becomes effective means that you acknowledge the updated Privacy Policy, subject to applicable law.

23. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or your privacy rights, please contact us:

Transform-CX Incorporated
Email: CXO@transform-cx.com
Website: https://www.transform-cx.com/

For users accessing HX OS through a client organization, you may also contact your organization’s administrator, HR representative, privacy contact, or other designated representative for questions about how your organization uses HX OS data.