Privacy, Terms, and Security — in one place.

By accessing or using yanacareers.com or any product subdomain (collectively, the "Services"), creating an account, enrolling in a program, or otherwise interacting with our Services, you confirm that you have read, understood, and agreed to these Terms.

If you do not agree, do not use the Services.

You must be at least 18 years old and legally able to enter into a binding contract to use the Services. By using the Services, you represent that you meet these requirements.

If you create an account, you agree to:

• Provide accurate, current, and complete information.
• Maintain the security of your account credentials. You are responsible for all activity on your account.
• Notify us promptly at security@yanacareers.com of any unauthorized access.
• Use one account per person — accounts are not transferable.

YANA provides workforce infrastructure for clinical research — training, competency verification, placement, and related services. Specific features, deliverables, and outcomes are described on the product pages and in any applicable enrollment agreement, SOW, or program documentation.

We do not guarantee employment outcomes. While our placement engagements have a documented 89% hire rate within 90 days of program completion (as of the date of these Terms), individual results vary based on background, market conditions, and effort.

We may modify, suspend, or discontinue any aspect of the Services at any time with reasonable notice where the change is material.

Paid Services are billed through our payment processor (Stripe). By making a purchase, you authorize us to charge the payment method you provide.

• Subscriptions renew automatically until cancelled. You can cancel at any time through your account or by contacting billing@yanacareers.com.
• One-time fees (cohort enrollments, placement fees) are due as specified in the enrollment agreement or SOW.
• Refunds are governed by the specific program's enrollment agreement. Where no agreement specifies otherwise, all fees are non-refundable once services have begun.
• Taxes may apply based on your location. Where applicable, taxes are added to the listed price.
• Failed payments may result in suspension of access until the account is current.

All Content provided through the Services — including curriculum, simulations, methodologies, the Competency Passport framework, brand marks, and software — is owned by YANA or its licensors and is protected by intellectual property laws.

We grant you a limited, non-exclusive, non-transferable, revocable license to access and use the Services and Content for your personal or internal business use, in accordance with these Terms.

You may not:

• Copy, reproduce, distribute, or publicly display Content beyond the limits of fair use, without our written consent.
• Reverse engineer, decompile, or attempt to extract source code from our software.
• Use our brand marks, trade names, or logos without explicit written permission.
• Resell, sublicense, or commercially exploit any aspect of the Services.

You retain ownership of your User Content. By submitting User Content, you grant YANA a worldwide, royalty-free license to use, display, and process that content as necessary to operate the Services.

You agree not to use the Services to:

• Violate any applicable law or regulation.
• Misrepresent your identity, credentials, or affiliation.
• Falsify simulation results or attempt to obtain a Competency Passport credential through fraud.
• Harass, defame, or harm others.
• Upload malicious code, viruses, or harmful content.
• Attempt to gain unauthorized access to the Services, accounts, or systems.
• Scrape, harvest, or otherwise extract data from the Services without our written consent.
• Interfere with the operation of the Services or the experience of other users.

We may suspend or terminate access without notice for violations.

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND UNINTERRUPTED OR ERROR-FREE OPERATION.

While we work to provide accurate and current content, we do not warrant that the Services will meet your specific requirements, that placement outcomes will occur within a specific timeframe, or that any specific employer will hire you.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, YANA AND ITS OFFICERS, EMPLOYEES, AGENTS, AND AFFILIATES WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUES, DATA, OR GOODWILL, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF THE SERVICES.

OUR TOTAL CUMULATIVE LIABILITY FOR ANY CLAIM ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES WILL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID TO YANA IN THE 12 MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED US DOLLARS ($100).

Some jurisdictions do not allow the exclusion or limitation of certain damages — these limitations may not fully apply to you.

You agree to indemnify, defend, and hold harmless YANA from and against any claims, damages, losses, liabilities, and expenses (including reasonable attorneys' fees) arising out of or related to: (a) your use of the Services in violation of these Terms; (b) your User Content; or (c) your violation of any third-party right.

You may stop using the Services at any time. We may suspend or terminate your access to the Services at any time, with or without notice, for any reason, including violation of these Terms.

Upon termination, your right to use the Services ceases. Provisions that by their nature should survive (intellectual property, disclaimers, limitations of liability, indemnification, governing law) will survive termination.

If you have completed a YANA Verified program and earned a Competency Passport, your earned credentials remain valid post-termination unless revoked for fraud or other material cause.

These Terms are governed by the laws of the State of Maryland, USA, without regard to its conflict of laws principles.

Informal resolution first. Before filing any formal claim, you agree to contact us at legal@yanacareers.com and attempt to resolve the matter informally for at least 30 days.

Arbitration. Any dispute not resolved informally will be submitted to binding arbitration administered by JAMS in accordance with its Streamlined Arbitration Rules. Arbitration will take place in Maryland, USA. Each party will bear its own costs.

Class action waiver. You agree to bring claims only on an individual basis. You waive the right to participate in any class or collective action.

Exception. Either party may seek injunctive or equitable relief in a court of competent jurisdiction for matters involving intellectual property, confidentiality, or unauthorized access.

If you would like to engage YANA under enterprise terms, contact partnerships@yanacareers.com.

We may revise these Terms from time to time. For material changes affecting your rights or obligations, we will provide at least 30 days' notice by email or in-product notification before the changes take effect.

Your continued use of the Services after the effective date constitutes acceptance of the revised Terms. If you do not agree to a material change, you may terminate your use of the Services.

• Entire agreement. These Terms (together with any enterprise agreement and our Privacy Policy) constitute the entire agreement between you and YANA regarding the Services.
• Severability. If any provision is held unenforceable, the remaining provisions will continue in full effect.
• No waiver. Our failure to enforce any provision does not waive our right to do so later.
• Assignment. You may not assign these Terms without our consent. We may assign these Terms in connection with a merger, acquisition, or sale of assets.
• Notices. Notices to YANA should be sent to legal@yanacareers.com. Notices to you may be sent to the email associated with your account.

Security at YANA is built around three principles:

• Defense in depth. Multiple overlapping controls so no single failure exposes data.
• Least privilege. Every system, every person, every integration gets only the access strictly required.
• Transparent posture. We document what we do, where we use subprocessors, and where we're going next. Procurement teams should not have to guess.

In transit. All traffic to and from YANA properties uses TLS 1.2 or higher with modern cipher suites. HTTP Strict Transport Security (HSTS) is enforced. Certificates are managed through Cloudflare.

At rest. Data stored in our primary database (Supabase) is encrypted at rest using AES-256. File storage uses the same encryption standard. Backup volumes are encrypted with separate keys.

Secrets management. Application secrets, API keys, and credentials are stored in encrypted secret stores. No production secrets are committed to source code or transmitted in client-side application bundles.

Authentication. Multi-factor authentication (MFA) is available for all user accounts and required for all internal team accounts. Single Sign-On (SSO via SAML or OIDC) is on the roadmap for enterprise customers.

Authorization. Database-level Row-Level Security (RLS) is enforced on all tables containing personal data, so users can only access records they are authorized to see — even if the application layer is bypassed.

Internal access. Team access to production systems follows the principle of least privilege. Access is reviewed quarterly. Access to customer personal data outside of break/fix scenarios is logged.

Offboarding. When a team member departs, access is revoked across all systems within 24 hours. Shared credentials (where unavoidable) are rotated within 48 hours.

YANA's production infrastructure is built on enterprise-grade providers with established compliance postures:

Production isolation. Production environments are isolated from development and staging. Customer data is never used in non-production environments.

Network controls. Inbound network access to production systems is restricted to known ingress points. Outbound traffic is monitored.

• Code review. All code changes are reviewed before being merged to production branches.
• Dependency scanning. Automated dependency vulnerability scanning runs on every build. Known critical and high-severity vulnerabilities are remediated within 14 days.
• Static analysis. Code is linted and scanned for common security patterns before release.
• No client-side secrets. API keys, database credentials, and authentication tokens are never embedded in client-side application code.
• Content Security Policy. CSP headers are configured to prevent injection of unauthorized scripts.
• Penetration testing. Annual third-party penetration testing is planned beginning Q4 2026.

YANA uses AI to support competency simulation scoring, content generation, and career intelligence. Specific architectural commitments:

• AI inference happens exclusively through approved, contracted providers (currently Anthropic) — not on consumer chat interfaces.
• Customer personal data sent to AI providers is governed by the provider's enterprise terms, including data retention and training exclusion clauses.
• AI-generated content is reviewed by human operators before being treated as authoritative output (for example, Competency Passport scoring).
• Customers under enterprise DPAs may opt out of any AI processing of their personnel data.

• Backups. Daily automated backups of production database with point-in-time recovery available for the past 7 days.
• Disaster recovery. Documented runbooks for recovery scenarios. Target RPO: 24 hours. Target RTO: 8 business hours for critical services.
• Logging. Application, authentication, and infrastructure logs are centralized and retained for 90 days minimum.
• Monitoring. Uptime monitoring and performance metrics tracked continuously. Anomaly alerts route to on-call team.
• Change management. Production changes go through code review, automated testing, and staged rollout.
• Vendor management. Subprocessors are reviewed for compliance posture before onboarding and re-reviewed annually.

YANA maintains a documented incident response process covering detection, containment, eradication, recovery, and post-incident review.

• Detection. Monitoring, logging, and user reports feed our detection process.
• Triage. Incidents are classified by severity. Critical incidents trigger immediate response.
• Containment. Affected systems are isolated to prevent further impact.
• Notification. For incidents involving unauthorized access to personal data, we notify affected users and regulators as required — within 72 hours for incidents meeting GDPR notification thresholds.
• Post-incident review. Every significant incident gets a written review with documented remediation actions.

We document current state and planned milestones transparently:

We welcome reports from security researchers. If you believe you've found a vulnerability in YANA's services:

• Email security@yanacareers.com with a description, reproduction steps, and any supporting evidence.
• Give us reasonable time (typically 90 days) to investigate and remediate before publicly disclosing.
• Do not access, modify, or delete data belonging to others. Do not disrupt our services.
• Stay within the bounds of authorized testing — no social engineering, physical access attempts, or denial-of-service.

We will acknowledge your report within 5 business days and provide status updates as our investigation progresses. We do not currently operate a paid bug bounty but we recognize responsible reporters publicly (with permission).

• Security vulnerabilities: security@yanacareers.com
• Security questionnaires & reviews: security@yanacareers.com
• Privacy questions: privacy@yanacareers.com
• Enterprise & DPA: partnerships@yanacareers.com