Privacy Policy

Last Revised: August 25, 2026

Introduction

Galt Pharmaceuticals, LLC (referred to as “Company,” “Galt,” “we,” “us,” or “our”) respects your privacy and is committed to protecting it through our compliance with this policy. This privacy policy (“Privacy Policy”) describes the types of information we may collect from you, or that you may provide, when you visit the website galtrx.com (our “Site”), and our practices for collecting, using, maintaining, protecting, and disclosing that information. This Site is intended for visitors in the United States.

This Privacy Policy applies to information we collect on this Site, in email and other electronic messages between you and this Site, and through our contact and inquiry forms and our job listings, which are hosted on our behalf by third-party services, whether you reach them through this Site or directly. It does not apply to information collected offline or through any other means, including on any other website operated by Company or any third party (including our affiliates and subsidiaries), information you provide through voluntary responses to emails, or information collected by any third party whose website, application, or content may link to or be accessible from this Site.

Please read this Privacy Policy carefully. By accessing or using this Site, you agree to it. If you do not agree with our policies and practices, your choice is not to use our Site. This policy may change from time to time; your continued use of this Site after we post changes is deemed acceptance of those changes, so please check this page periodically for updates.

Children Under the Age of 16

Our Site is not intended for children under 16 years of age, and no one under 16 may provide any personal information on the Site. We do not knowingly collect personal information from children under 16, and we do not sell or share the personal information of consumers under 16 years of age. If you are under 16, do not use or provide any information on this Site. If we learn we have collected or received personal information from a child under 16 without verification of parental consent, we will use commercially reasonable means to delete that information. If you believe we might have any information from or about a child under 16, please contact us by emailing info@galtrx.com or by calling (855) 965-2783.

Information We Collect and How We Collect It

This Site collects a limited amount of information. What we do collect falls into two groups: information you give us, and information that is recorded automatically as you browse.

Information You Provide to Us

• Information you enter in a form on our Site. Our Contact Us page offers forms for general inquiries, medical affairs inquiries, business development opportunities, and franchise opportunities. Depending on the form, we ask for your name, telephone number, and email address; your message or question and the date of your request; the product your inquiry concerns; your professional role, credentials, and specialty, and the name and address of your practice, hospital, or institution; the name and email address of your Galt contact or sales representative; how you heard about us, what interests you in the franchise opportunity, whether you have pharmaceutical industry, business ownership, or sales experience, the level of involvement you are seeking, and the state and ZIP code you are interested in; and how, when, and by which method you prefer to be contacted. The Medical Affairs form is intended for licensed healthcare professionals.
• Information you provide when you apply for a position. Our Contact Us page lists our open positions through our applicant tracking provider. Selecting a position takes you to that provider’s own site, where any application you submit — including your contact details, your resume, and anything else the application asks for — is collected by the provider on our behalf and made available to us.
• Records and copies of your correspondence, including your email address, if you choose to contact us by email or telephone.

Our Medical Affairs pages ask you to confirm that you are a licensed United States healthcare professional before their content is shown. That confirmation is held in your browser’s session storage for the length of your browsing session and disappears when you close the tab. It is not a cookie, it is not readable by our servers, and it is not transmitted to us or to anyone else.

Galt does not knowingly collect, request, or obtain any personally identifiable information related to your own medical history, health, or finances through this Site, and nothing on this Site is intended to solicit it. If you are a healthcare professional submitting a medical information request or reporting an adverse event, the information you provide may describe a patient’s health. Please give us only what we need in order to respond and to meet our reporting obligations, and do not include information that identifies the patient. We treat any such information as confidential and use it only as described in this Privacy Policy.

Information We Collect Automatically

As you navigate through and interact with our Site, our servers record standard web server and error log data, including your IP address, the approximate general location it suggests, your operating system and browser type, the resources you access and use on the Site, and the dates and times of your visits. Some of this information, such as your IP address, is treated as personal information under applicable privacy laws.

This information helps us improve our Site, diagnose and repair errors, protect the Site against attacks and abuse, and deliver a better service, including by enabling us to estimate our audience size and usage patterns. We do not use it to build advertising or marketing profiles.

Cookies and Other Technologies

We use a small number of cookies and similar technologies, organized into four categories. You control three of them. When you first visit the Site, a banner lets you accept or reject all non-essential categories in a single click in either direction, or open a preferences panel to choose category by category. You can reopen that panel at any time afterwards by selecting “Your Privacy Choices” in the footer of any page.

• Essential. One cookie, set by us, which records the privacy choices you make so that we can honor them on later visits. It cannot be disabled, because it is what makes your opt-out persist. This category also covers the strictly functional cookies set by the services that host our General Inquiries and Business Development forms and our job listings. Those embeds load with the page because they contact no one outside their own provider, and their cookies do nothing but keep a form session working, route your request to the right server, and protect the listings from abuse. They are not used for analytics or advertising.
• Analytics. Google Analytics, which we use to understand how visitors move through the Site so that we can improve it.
• Embedded Media. YouTube video players, described under “Embedded Video” below.
• Embedded Forms and Job Listings. The services that host our Medical Affairs inquiry form and our franchise enquiry form, the Google reCAPTCHA service that protects them, and the error-monitoring service one of those providers runs inside its own form, described under “Embedded Forms, Job Listings, and Your IP Address” below. These are the two embeds that reach beyond their own provider, which is why they are the ones you control.

The Embedded Media and Embedded Forms categories are enforced before any request is made. If either category is turned off, the corresponding providers are not contacted at all as our pages load, and therefore have no opportunity to set a cookie or to receive your IP address. Turning a category off does not remove the content: videos open on YouTube in a new tab, and the Medical Affairs and franchise forms are each offered as a link that opens the identical form on the provider’s own site.

Cookies Used on This Site

We do not use tag managers, advertising or conversion pixels, web beacons, social media widgets, or device fingerprinting on this Site, and we do not operate any session-replay or heatmap tool of our own. Our fonts, images, video posters, and scripts are served from our own domain rather than requested from separate third-party domains, with the exceptions described in this section. Two exceptions should be stated plainly: inside its embedded form, Less Annoying CRM runs its own error-monitoring and session-replay service and loads fonts from Google, and inside the embedded Medical Affairs form, MachForm loads the Google reCAPTCHA service and fonts from Google. Each of those happens within that provider’s own frame rather than on our pages, we do not control it, and we do not receive the data. Both are described under “Embedded Forms, Job Listings, and Your IP Address” below.

Cookies are not the only mechanism involved. The embedded forms and the reCAPTCHA service also store a small number of entries in your browser’s local storage and session storage as soon as they load — reCAPTCHA values and an error-monitoring session identifier. Unlike the reCAPTCHA cookie described in the table above, these are written without any action on your part. They are stored inside the providers’ frames, serve the abuse-prevention and error-diagnosis purposes described below, and are removed when you clear your browsing data.

You can also set your browser to refuse all or some cookies, or to alert you when cookies are being sent. If you disable cookies through your browser, parts of the Site may not function as intended, and we will not be able to remember your privacy choices between visits.

Analytics

We use Google Analytics to measure how the Site is used. Google Signals and Google advertising features are not enabled for our Google Analytics property. That means the information Google Analytics collects for us is not linked to Google advertising identities, is not used to build advertising profiles, and is not made available to advertisers. In this configuration Google acts as our service provider rather than as an independent recipient of your data, and the arrangement is not a “sale” or “share” of personal information under the CCPA.

Analytics cookies load unless you opt out. If you reject the Analytics category, we set Google Analytics’ own disable flag before its script is given a chance to run, and we delete any Google Analytics cookies already present on your device.

Site Security and Delivery

Traffic to this Site passes through Sucuri, a third-party web application firewall and content delivery service that sits between your browser and our servers in order to filter malicious traffic and keep the Site available. That service processes technical information about your request, such as your IP address and browser type, in order to secure and deliver the Site. It does not set cookies on your device in the course of serving this Site, and it is not used for advertising or analytics.

Embedded Forms, Job Listings, and Your IP Address

Three third-party services supply content that is embedded directly in the pages of this Site, and they are not all treated the same way:

• MachForm, the online form service that hosts our General Inquiries, Medical Affairs, and Business Development forms on the domain galt.forms-db.com. The General Inquiries and Business Development forms load with the page: they contact no one but MachForm and set only strictly functional cookies. The Medical Affairs form is different, and is covered by the Embedded Forms category, because it is also protected by Google reCAPTCHA, an abuse-prevention service, and loads its fonts from Google.
• Less Annoying CRM, the customer relationship system we use to receive and respond to franchise inquiries, which hosts our Franchise Opportunity form on the domains embed.lessannoyingcrm.com and forms.lessannoyingcrm.com. That form is also protected by Google reCAPTCHA, an abuse-prevention service that Less Annoying CRM applies to the hosted form. Within that same hosted form, Less Annoying CRM also runs Sentry, an error-monitoring and session-replay service, to diagnose problems with its form. We do not choose, configure, or receive data from Sentry; it is part of the provider’s service.
• BambooHR, the applicant tracking system that holds our open positions and receives job applications, on the domain galtrx.bamboohr.com. The job listings load with the page. The listing itself contains no scripts, images, or frames, and BambooHR sets a single session cookie used to protect the listings from abuse. It does load one font from Google.

Nothing is requested from MachForm for the Medical Affairs form, from Less Annoying CRM, or from Google unless the Embedded Forms category is allowed. If you have turned that category off, or your browser sends a privacy signal we honor, our pages do not load those frames or scripts at all. Neither provider, nor Google, is contacted for them, none receives your IP address, and none can set a cookie or store anything on your device. In that case we show a link that opens the identical form on the provider’s own site in a new tab, and anything you submit reaches us in exactly the same way. Once you follow that link, the providers’ own cookie and privacy practices apply, including the session cookie described in the table above.

If the category is allowed, the content is embedded directly in the page and your browser connects to the provider as soon as the page opens. The Franchise Opportunity form is the one exception: it is held back until you open its tab, so Less Annoying CRM and Sentry are not contacted unless you go there. Google is contacted as soon as the Contact Us page opens regardless, because the Medical Affairs form loads reCAPTCHA. At the moment a connection is made — before you type anything, and whether or not you go on to complete the form — the following happens:

• MachForm receives and processes your IP address along with your browser and device information, and sets its own cookies on your device, including a session cookie and cookies its hosting provider uses to route your request. Most of these are set for cross-site use, so your browser stores them while the form is embedded in our pages; two of the load-balancing cookies are limited to first-party use and are stored only if you open the form directly on galt.forms-db.com.
• Less Annoying CRM receives and processes your IP address and browser and device information. It also sends its own session cookie, Session_LACRM. Because the provider limits that cookie to first-party use, your browser blocks it while the form is embedded in our pages, so in practice it is not stored on your device unless you open the form directly on forms.lessannoyingcrm.com. Our pages also pass the provider the address of the page the form is displayed on, your browser’s window width, and your user-agent string, which the provider uses to size and render the form correctly.
• Google receives and processes your IP address and browser and device information for the purpose of reCAPTCHA risk analysis on the Medical Affairs and Franchise Opportunity forms, and serves the fonts used inside those two forms. As those forms load, Google writes several reCAPTCHA values to your browser’s local and session storage, but it does not set a cookie at that point. Google sets its reCAPTCHA cookie, _GRECAPTCHA, on www.google.com only once you interact with one of those forms — ticking the Medical Affairs checkbox, or submitting the franchise form. Google describes that cookie as necessary to provide its risk analysis, and it lasts approximately six months. We do not control what Google sets, we cannot read it, and we cannot delete it, because a website cannot delete cookies belonging to another domain.
• Sentry receives technical information about your browser and a record of your interaction with the embedded Franchise Opportunity form, so that Less Annoying CRM can detect and diagnose errors in it. As configured by the provider, it records a replay of a sample of form sessions and of sessions in which an error occurs, using the service’s default privacy settings, which mask text and the content you type. Sentry does not set a cookie, but it does store a session identifier in your browser’s session storage. This runs inside the provider’s frame; we do not control it and do not receive the data.
• BambooHR receives and processes your IP address and browser and device information in order to return the list of our open positions, and sets its own cookies on your device, including a security cookie set by its content delivery provider.

If you do submit a form, the information you enter is transmitted to and stored by the provider that hosts that form before being made available to us. Google receives a reCAPTCHA assessment of a Medical Affairs or Franchise Opportunity form submission. If you apply for one of our open positions, your application is submitted on BambooHR’s site and is stored there for us.

If you would prefer not to interact with any of these providers at all, you can reach us directly at (855) 965-2783 or info@galtrx.com.

Embedded Video

Some pages feature videos hosted on YouTube. Loading one of those pages sends nothing to Google. The preview image is served from our own servers, and the YouTube player is not loaded unless you press play.

If the Embedded Media category is allowed and you press play, we load the player in YouTube’s privacy-enhanced mode (youtube-nocookie.com), which does not set advertising cookies. At that point, however, your IP address and the video you are watching are shared with Google, and YouTube may store data on your device. Google’s use of that data is governed by the Google Privacy Policy.

If the Embedded Media category is turned off, no YouTube player will load on this Site at all. Pressing play opens the video on YouTube in a new tab instead, so nothing is requested from Google until you choose to go there, and YouTube’s own cookie and privacy practices apply once you do.

How We Use Your Information

We use the information we collect about you, or that you provide to us, including any personal information:

• To present our Site and its contents to you, and to provide the information or services you request.
• To respond to general, medical affairs, and business development inquiries, and to communicate with you about them, including by telephone and email.
• To respond to medical information requests from healthcare professionals, and to receive, assess, report, and document adverse events and other product safety information.
• To respond to franchise inquiries and to communicate with you about the franchise opportunity.
• To consider you for a position with us and to communicate with you about your application.
• To secure the Site, to detect and investigate fraud and abuse, and to diagnose and repair errors.
• To measure how the Site is used so that we can improve it.
• To comply with our legal and regulatory obligations, including the drug safety, adverse event reporting, and recordkeeping rules that apply to prescription pharmaceutical products.
• To fulfill any other purpose for which you provide the information, in any other way we describe when you provide it, or for any other purpose with your consent.

Notice at Collection — Categories of Personal Information

The table below summarizes, using the categories defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”), the personal information we have collected through this Site in the preceding twelve months, why we collect it, and who receives it. Retention for every category is described under “How Long We Keep Your Information” below.

We do not collect the other categories of personal information listed in the CCPA — protected classification characteristics, biometric information, sensory data such as audio or video recordings, education information, or inferences drawn to create a profile about you. The only sensitive personal information we may receive is health information that a healthcare professional chooses to include in an adverse event report. We use and disclose it solely to respond to that request and to meet our drug safety reporting and recordkeeping obligations, which are purposes the CCPA permits without giving rise to the right to limit its use and disclosure. We never use it to infer characteristics about anyone. We do not use or disclose any personal information for purposes other than those disclosed in this Privacy Policy.

Disclosure of Your Information

We may disclose aggregated or de-identified information that does not identify any individual, such as the number of visitors to this Site, without restriction.

We may disclose personal information that we collect, or that you provide, as described in this Privacy Policy:

• To our parent company, subsidiaries, and affiliates. This includes our affiliate Galt Phranchise Systems, LLC, which receives and responds to inquiries submitted through the Franchise Opportunity form.
• To contractors, service providers, and other third parties we use to support our business. We disclose personal information to them only for the limited purposes of the services they perform for us, and we direct them to keep it confidential and not to use it for any other purpose. This includes the services that host our forms and our job listings, our customer relationship system, the abuse-prevention service that protects our franchise form, our analytics provider, and our hosting, security, and IT providers.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or a similar proceeding, in which personal information we hold about our Site’s users is among the assets transferred.
• To fulfill the purpose for which you provide it, for any other purpose we disclose when you provide it, or with your consent.
• To comply with any court order, law, or legal process, including responding to any government or regulatory request; to enforce or apply our Terms of Use; or where we believe disclosure is reasonably necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others.

In the preceding twelve months, we disclosed the categories of personal information listed in the table above to our service providers and affiliates for the business purposes described in this Privacy Policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We have not done so in the twelve months preceding the revision date at the top of this page. We also do not disclose personal information collected through this Site to third parties for those third parties’ own direct marketing purposes.

Any non-personal communication or material you transmit to the Site by electronic mail or otherwise — including data, questions, comments, or suggestions — is, and will be treated as, non-confidential and non-proprietary, and may be used by the Company for any purpose. This does not apply to personal information, which we handle only as described in this Privacy Policy. Any personal information you provide is provided voluntarily and is not required to access or use this Site.

How Long We Keep Your Information

We keep personal information only for as long as reasonably necessary for the purpose it was collected for, and then delete it or de-identify it. Because this Site collects a limited amount of information, we do not apply a single fixed retention period to everything. In deciding how long to keep information, we consider how long we need it in order to respond to you or to complete what you asked us for, including the length of an inquiry, a franchise development conversation, or a recruiting process; any period we are required to keep records for by law or regulation, including the drug safety, adverse event reporting, and recordkeeping rules that apply to prescription pharmaceutical products and the recordkeeping rules that apply to franchise sales and offerings; and whether we still need it to resolve a dispute or enforce our agreements. Web server and error logs are kept only for as long as they are needed for security monitoring and troubleshooting. Where a legal hold or a regulatory obligation requires us to keep information longer, we will do so, and will delete it when that obligation ends.

Your Choices About Cookies, Tracking, and Communications

Cookie Preferences

You can accept or reject the Analytics, Embedded Media, and Embedded Forms categories at any time, including after you have already made a choice, by selecting “Your Privacy Choices” in the footer of any page. Rejecting every non-essential category takes a single click, and is presented no less prominently than accepting them. Essential cookies cannot be disabled, as they are required for the Site to function and are what store your privacy preference.

Browser Privacy Signals

We honor opt-out preference signals sent by your browser, and we treat them as binding. If your browser or a browser extension sends a Global Privacy Control (GPC) or Do Not Track (DNT) signal, then without any action from you: analytics is disabled and any analytics cookies already on your device are deleted; no YouTube player is loaded; and neither the Medical Affairs form nor the franchise form is loaded, so neither of those providers, nor Google, is contacted. While the signal is being sent, none of these can be switched back on from this Site — the preferences panel shows them locked off and explains why. If you want them enabled, you would need to turn the signal off in your browser or extension. You can learn more about GPC at globalprivacycontrol.org.

Consistent with California regulations on frictionless opt-out preference signals, we do not display a consent banner or pop-up in response to a privacy signal. The explanation appears in the preferences panel, which you can open deliberately from the footer.

Promotional Communications

You have the right at any time to prevent us from contacting you for marketing purposes. If we send you a promotional communication, you can opt out of further promotional communications by following the unsubscribe instructions provided in that message. You can also tell us that you do not wish to receive marketing communications from us by emailing info@galtrx.com.

Your Privacy Rights

Depending on where you live, privacy laws — including the CCPA — may give you rights over the personal information we hold about you. We extend the following rights to all visitors to this Site, regardless of where you live:

• To know. You may ask us to tell you what personal information we have collected about you, the categories of sources it came from, the business purpose for collecting it, the categories of third parties to whom we disclosed it, and the specific pieces of personal information we hold.
• To delete. You may ask us to delete personal information we collected from you. We will do so, and direct our service providers to do so, unless we are required or permitted to keep it — for example, to comply with drug safety and adverse event recordkeeping obligations, to detect security incidents, or to establish or defend legal claims. If we deny a request in whole or in part, we will tell you why.
• To correct. You may ask us to correct inaccurate personal information we hold about you.
• To obtain a copy. Where you ask us what personal information we hold, you may receive it in a readily usable, portable format where technically feasible.
• To opt out of the sale or sharing of your personal information. As stated above, we do not sell or share personal information, so there is nothing to opt out of, and no third party collects information through this Site in order to serve you interest-based advertising. We nonetheless treat opt-out preference signals sent by your browser, such as Global Privacy Control, as valid requests to opt out of the sale and sharing of your personal information, and we honor them as described above. If we ever introduce advertising technologies to this Site, we will update this Privacy Policy first.
• To limit the use and disclosure of sensitive personal information. We do not collect sensitive personal information in order to infer characteristics about you. The only sensitive personal information we may receive is information a healthcare professional chooses to include in a medical information request or an adverse event report, and we use it solely to respond to that request and to meet our drug safety obligations — uses the CCPA permits without giving rise to this right.
• To be free from discrimination. We will not deny you goods or services, charge you a different price, or provide a different level or quality of service because you exercised any of these rights. We do not offer financial incentives in exchange for personal information.

How to Submit a Request

To exercise any of these rights, email info@galtrx.com with “Privacy Rights Request” in the subject line, or call us toll-free at (855) 965-2783. Please tell us which right you wish to exercise and give us enough information to locate any records we may hold about you. If you need this Privacy Policy or a response to your request in an alternative, accessible format, tell us and we will provide one.

How We Verify and Respond

Before we act on a request, we must verify that it comes from you. Because this Site collects a limited amount of information, this is usually straightforward: we will ask you to confirm details that match information we already hold, such as the email address you corresponded with us from. We will not ask for more information than is necessary to verify you, and we will use anything you provide for verification only for that purpose. You may also use an authorized agent to submit a request, in which case we will ask the agent for written permission signed by you. We will confirm receipt of your request within 10 business days and respond within 45 days; if we need more time, we will tell you and may take up to an additional 45 days. If we decline to act on your request, we will explain why, and you may appeal by replying to our response.

Data Security

We use commercially reasonable means to protect any personal information you provide, including serving the entire Site over an encrypted connection and operating it behind a web application firewall. However, the transmission of information via the internet is not completely secure, and we cannot guarantee the security of personal information transmitted to our Site. Any submission of personal information is at your own risk, and we are not responsible for circumvention of any privacy settings or security measures contained on the Site.

Changes to Our Privacy Policy

It is our policy to post any changes we make to our Privacy Policy on this page and to update the “Last Revised” date at the top. If we make material changes to how we treat our users’ personal information, we will notify you through a notice on the Site’s home page. We review this Privacy Policy at least once every twelve months. You are responsible for periodically visiting our Site and this Privacy Policy to check for any changes.

Other Terms

Third party websites linked to from this Site may each have different terms of use, privacy policies, and practices. This includes external services we link to but do not embed, such as the Scientific Education Program and Medical Information request forms on our Medical Affairs pages, which open on our form provider’s own site, and our careers page on our applicant tracking provider’s site. You should review their terms carefully to determine how each site may use any personal information you provide. This Privacy Policy applies solely to information collected through the Site and not through any other website or source.

In addition to the rights and privileges described in this Privacy Policy or the Terms of Use (hereby incorporated herein), Company reserves the right to electronically monitor areas of the Site and may disclose any information, content, or records of any kind if required to do so by law, regulation, or government request, or if such disclosure is necessary or appropriate to operate the Site or to protect our rights or property, or the rights of users, partners, affiliates, licensors, or other third parties.

You expressly agree that the exclusive jurisdiction for any dispute with Company, or in any way relating to your use of the Site, shall be the courts in Cobb County in the State of Georgia, and you expressly consent to the exercise of personal jurisdiction there. This Privacy Policy shall be construed under and governed by the laws of the State of Georgia, without respect to its conflict of laws principles. Nothing in this paragraph limits any right you have under applicable privacy law, or your ability to submit a complaint to a regulator. If any provision of this Privacy Policy is found unenforceable by a court of competent jurisdiction, the invalidity of that provision shall not affect the validity of the remaining provisions, and no waiver of any term or condition shall be deemed a further or continuing waiver of that or any other term or condition. This Privacy Policy and the Terms of Use for this Site constitute the entire agreement between you and Company with respect to the use of the Site.

Contact Us

If you have any questions or comments regarding this Privacy Policy or our privacy practices, or to submit a privacy rights request, please contact Galt Pharmaceuticals, LLC by emailing info@galtrx.com, by calling (855) 965-2783, or by writing to us at 3350 Riverwood Parkway, Suite 1900, Atlanta, GA 30339.