Privacy Policy

1. Who we are and what this notice covers

PhaseFolio, Inc., a Delaware corporation ("PhaseFolio," "we," "us," or "our"), provides software for biotech research, comparator evidence, diligence, and analysis. This notice describes how we handle personal information in connection with our websites, documentation, accounts, product interfaces, support, and supported API/MCP services.

Our product family includes Atlas for source-linked comparator research, and Workspace for diligence records, assumptions, scenarios, and outputs. Sentinel is in development. Describing Sentinel on a marketing page does not mean that a monitoring service is operating or collecting information on your behalf.

This notice covers information about identifiable people, including account holders, organization members, business contacts, and people identified in submitted material. An asset-level record may still contain personal information, such as an author's name, work email, or notes about a person.

For questions or privacy requests, contact contact@phasefolio.com. A separate written data-processing agreement or other agreement with your organization may specify additional obligations for customer content.

2. Our role and your organization's role

PhaseFolio determines how information is used to administer its business relationships, secure its services, manage accounts, and respond to direct inquiries. An organization using Workspace may determine the purposes for which personal information in its own diligence records is processed. The applicable agreement and law determine our respective roles for that information.

If your account is provided through an organization, its administrators may manage membership, permissions, and access to the organization's records. Direct requests about organization-controlled content to that organization where appropriate. We can help identify the relevant request route without disclosing another organization's information.

3. Information we collect

We collect information you provide, information generated through use of the service, and relevant information from authorized business contacts or public sources.

Some information is necessary to provide an account or complete a requested workflow. If you choose not to provide it, the related feature may not work. Optional content should be limited to what is relevant to the task.

4. Sensitive information and customer content

PhaseFolio is not designed to receive Protected Health Information (PHI), patient-level records, medical charts, or regulated clinical datasets. Do not submit that material, including in uploads, prompts, free-text notes, or support requests. Do not upload credentials, payment-card details, or information you lack authority to disclose.

Workspace may contain confidential commercial and diligence information. Access is governed by the applicable organization and product permissions. Customer content is used for the requested service, security, administration, and support, subject to the applicable agreement; it is not automatically made public because the product also contains public-source research.

Atlas search questions and public-source evidence are different from confidential Workspace records. Follow the input restrictions displayed for the feature. A public-source workflow is not an invitation to include confidential company or patient information in a search expression.

5. How we use information

We use information to provide requested functionality, authenticate users, enforce access permissions, maintain saved work, prepare outputs, manage customer relationships, answer support requests, investigate problems, prevent misuse, and meet applicable legal obligations.

Product improvement can include examining service reliability and usage patterns. Such work does not, by itself, authorize publication of a customer's confidential material or use inconsistent with an applicable agreement. This notice does not grant a general license to train AI models on customer content.

Where EU or UK data-protection law applies, a processing activity must have an appropriate lawful basis. Depending on the activity and our role, these may include performing a contract with an individual, legitimate interests in operating and protecting a business service subject to the required balancing of rights, compliance with a legal obligation, or consent where required. Consent can be withdrawn where processing relies on it, without affecting processing already lawfully undertaken. For information we process on an organization's instructions, that organization is responsible for identifying its applicable basis.

6. AI-assisted features and source retrieval

An AI-assisted feature may transmit the input and context needed for the requested action to the model service supporting that feature. This can include submitted text, file content, selected evidence, and relevant asset context. Review the material you select before invoking an AI feature. Generated output can contain errors and should be inspected with its supporting evidence.

Model-service processing, safety review, retention, and other handling depend on the applicable provider configuration and contractual terms. This notice does not promise zero retention by every model provider. Ask us for the processing details relevant to your product or enterprise arrangement before submitting material with special confidentiality requirements.

Retrieving public evidence can require transmitting a search expression or request to the relevant source. Public source providers and websites may also receive technical information when you visit a citation directly. Accessing a public source does not make all content you submit public, and a citation does not transfer a third party's intellectual-property rights to you.

7. When information is disclosed

Information may be disclosed to:

• Authorized organization members, according to their permissions and the collaboration or sharing actions you request.
• Service providers supporting identity, hosting, storage, delivery, diagnostics, page analytics (section 8), communications, business contact data (section 14), and requested AI processing, to the extent needed for those functions and subject to applicable arrangements.
• Recipients you choose, including people to whom you send an export or grant access through a supported sharing workflow.
• Professional advisers and authorities, when reasonably necessary for legal obligations, a valid legal process, accounting, security, or protection of rights.
• Parties to a corporate transaction, where information is reasonably required in connection with a proposed or completed financing, reorganization, acquisition, or transfer of business assets, subject to applicable confidentiality and legal requirements.

The service relies on third-party infrastructure and providers. The current list, with what each provider does, is in the service providers section of our security page. Not every provider processes every record: the public registry database holds public records only, and providers that process public source documents receive no customer content. Our data processing agreement, available on request, includes the subprocessor schedule.

Customer content is not offered for sale as part of the PhaseFolio service. Legal definitions of selling, sharing, and targeted advertising vary by jurisdiction; applicable privacy choices and obligations depend on the actual processing and law. A customer-directed export or a necessary provider disclosure should not be confused with making a customer's records publicly available.

8. Cookies, storage, and external services

We use only cookies and similar browser storage that are needed for a service you ask for:

• Sign-in and session cookies, set by our identity provider, Clerk, and by PhaseFolio, to keep you signed in and protect your account.
• A pending-action cookie, kept for up to one hour, that holds a shared dataset you chose to copy or export while you sign in or create an account.
• Browser storage for work in progress and display preferences, such as an unsaved selection, the workspace you were viewing, or a collapsed sidebar.

We do not use advertising or cross-site tracking cookies, and our page analytics uses no cookies. When a PhaseFolio link carries a campaign tag, the tag is recorded, with the time, when the link opens a shared dataset, and with your new account if you sign up; nothing is stored on your device for it. Hosting and delivery services may collect technical information when a page is requested. Blocking necessary storage may prevent sign-in or other functions from working.

Page analytics. We count visits to our public website, and to Atlas's shared-dataset and example pages, with Vercel Web Analytics, a service of our hosting provider. For each page view it records the time, the page address, the address of the page that linked to it as your browser reports it (usually only the website), your approximate location (country, region, and city), your browser and operating system with their versions, and your device type, brand, and model. Before a page view is sent, we replace a shared dataset's link code with a placeholder and remove every query detail except campaign tags. It sets no cookies and stores nothing on your device. Vercel tells visits apart using a value derived from the page request, which Vercel says it discards after 24 hours. We use these records to count visits and to see which websites and campaigns bring people to us; we do not use them to identify you or combine them with other information to do so. Vercel keeps them available to us for 12 months on our current plan and may keep them longer under its own policies. Atlas pages behind sign-in, such as your datasets, chat, and billing, are not counted. Where EU or UK data-protection law applies, we rely on our legitimate interests in learning how people find and use our public pages.

If we add an optional cookie or similar technology, we will ask for your consent before using it where the law requires. This notice does not treat visiting a page as consent to optional tracking.

Links to external websites, scheduling services, sources, or integrations lead to services with their own privacy practices. Review their notices before providing information. We do not control how an independent recipient handles a file after you choose to send it to them.

9. Retention and deletion

Retention depends on the purpose of the record, the applicable agreement, account or organization status, legal obligations, and the need to investigate security or service incidents. We seek to avoid keeping identifiable information longer than reasonably necessary for those purposes.

Deletion of active product content, removal from a user's view, expiry of a backup, and deletion by a service provider are distinct operations. A deletion request may require action across those systems. Legal holds, dispute preservation, accounting obligations, and prevention of abuse may require some records to be retained after ordinary use ends.

Issued exports may remain in the possession of recipients who obtained them through an authorized action. Verification metadata may need to be retained to reconstruct the identity and version of an earlier artifact. A verification record and the contents of the underlying export are different records and should be assessed separately.

Sections 8, 13, and 14 state how long page-view records, public clinical-trial registry records, and business outreach emails are kept. Contact us about a deletion request or the retention schedule applicable to your arrangement. Applicable legal deadlines and contractual commitments govern the handling of a valid request. We will explain a relevant exception where required by law.

10. Security

The service is designed around access controls, organization-scoped permissions, encrypted transport, and controls provided by its infrastructure services. Security measures are proportionate to the services and information involved and are subject to ongoing review. No transmission or storage system can be guaranteed completely secure.

You can help by protecting account access, maintaining appropriate organization membership, reviewing sharing actions, and reporting suspected compromise promptly. Do not put passwords or keys in a support request. See the security and data-handling summary for additional context.

This notice does not assert a certification, independent audit result, or regulatory approval. Any specific enterprise security commitment must be documented in the applicable agreement.

11. International processing

PhaseFolio, Inc. is a United States company. Production data is stored in the United States: our account and product database, which holds customer content, is in the AWS us-east-1 region. Some providers, such as our web delivery network, identity provider, and payment processor, also process information in other countries. The security page lists where each kind of data is stored.

Where EU, UK, or Swiss data-protection law applies to a transfer of personal information to the United States or another country, we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the adjustments Swiss law requires. Our data processing agreement includes these clauses, and our providers' data processing terms use them or the EU-U.S. Data Privacy Framework. Contact us for a copy of the safeguards relevant to your organization.

12. Your rights and choices

Depending on your location, our role, and the applicable law, you may have rights to access or obtain a copy of personal information; correct inaccurate information; request deletion; restrict or object to particular processing; receive eligible information in a portable form; or withdraw consent. Additional rights may apply to certain forms of sale, sharing, targeted advertising, sensitive information, or automated decision-making where those activities and laws apply.

Submit a request to contact@phasefolio.com. Identify the nature of your request and the account or organization involved, but do not send a password or unnecessary sensitive information. We may need proportionate information to verify identity, confirm an authorized agent's authority, or determine which organization controls the record.

If you are named in a public clinical-trial registry record, section 13 explains how to object or make a request about it. If we emailed you about PhaseFolio, section 14 explains what we hold and how to stop further emails.

We respond in accordance with the deadlines, exceptions, and verification requirements of applicable law. An organization-controlled request may need to be referred to that organization. Where required, we will explain a refusal or restriction and any available appeal route. You may also have a right to complain to a relevant regulator or supervisory authority. Exercising a legal privacy right does not remove rights you otherwise have under applicable law.

13. Public clinical-trial registry records

Atlas is built from records that public clinical-trial registries publish: ClinicalTrials.gov, run by the US National Library of Medicine, and the EU Clinical Trials Information System (CTIS) and EU Clinical Trials Register, run by the European Medicines Agency. Registries publish these records by law. A record can name a person involved in a trial, such as a doctor who sponsors a trial in their own name, an investigator, or a sponsor's contact person. We collect the records from the registries' public websites, not from the people named in them, so this section tells those people what we do.

What we keep and show. Before we store a registry record, we remove the contact persons it lists with their telephone and fax numbers, and we remove e-mail addresses from its text. We keep the rest of the record as published, with a dated history of its changes. Atlas shows trial facts as each registry published them, including sponsor and collaborator names and trial titles. Where a person sponsors a trial in their own name, or a title or description includes a name, that name appears in Atlas, in customer exports and shared datasets, and on public example pages built from these records. We also keep copies of documents the EU registries publish, such as protocols and results reports, for internal record-keeping. They can contain names, job titles, signatures, and professional contact details. We never show or export these documents or use them as input to AI features.

Why, and on what basis. We use registry records to provide source-cited research about clinical trials, and to keep an accurate, dated history of what each registry published, so that every fact we show can be checked against its source. Where EU or UK data-protection law applies, we rely on our legitimate interests in providing that research, which also serves the public interest in trial transparency that the registries exist to serve. We do not use registry information to contact or market to the people named in it, to profile, rank, or score them, or to sell lists of them.

Who receives it. Atlas customers, the people they share a dataset or export with, and visitors to public example pages see the trial facts described above, each with a link to the registry record. Our hosting, storage, and database providers, and AI services that help us link and organize trial records, process them for us (see sections 7 and 11). Atlas chat never sends trial records to the AI model service that supports it. That service receives the customer's request and the earlier messages of the same conversation, the dataset's current settings, and the list of values Atlas can filter on. A name reaches it only as part of those, for example a sponsor name the customer typed as a search term.

How long we keep it. We keep a registry record and its history while the registry publishes the record, and delete them 12 months after the registry no longer publishes it. We delete a stored registry document 12 months after the registry stops publishing it, keeping only a fingerprint of the file, its description, and a link to the registry. Atlas data releases, and files that list many trials together, are not edited after they are made. We keep each Atlas data release as the dated record of what Atlas showed, and review that each year. We delete the other files 12 months after we stop using them.

Your right to object. You can object at any time to our use of registry information about you. Write to contact@phasefolio.com with the subject "Registry data request", and give the registry, the trial number, and the information concerned. We will stop using that information unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or need it for legal claims. We will tell you what we did, and why if we keep anything.

Other requests. You can also use that address to ask for a copy of registry information we hold about you, or for it to be corrected, restricted, or deleted. We may ask for proportionate information to confirm that you are the person named. We respond within one month, or tell you within that month if we need up to two more months. A correction to a trial record itself must be made through the registry; we reflect it when we next refresh the record. Exports a customer issued before your request remain with the people who received them. Section 12 describes your other rights, including the right to complain to a supervisory authority.

Content from CTIS and the EU Clinical Trials Register is reproduced with acknowledgement to the European Medicines Agency, which does not endorse PhaseFolio.

14. Business outreach emails

We email a small number of people who work in business development, corporate strategy, or competitive intelligence at biotech and pharmaceutical companies, to show them a PhaseFolio trial landscape that covers their company's work. We write only to work email addresses. This section tells the people we email what we do.

What we use and where it comes from. Your name, job title, employer, work email address, the city and country you work in, and the link to your public professional profile. We find these through Clay, a business contact data provider, which also checks that the email address works. Clay keeps its own database as an independent business and has its own privacy notice. What the email says about your company's trials comes from public trial registries and company announcements. We do not look into you beyond these details, and we never use the registry records described in section 13 to find or contact the people named in them.

Why, and on what basis. We email you because your company's trials appear in a landscape we built, and your role suggests it may be useful to you. Where EU or UK data-protection law applies, we rely on our legitimate interests in telling professionals about a business service relevant to their work. We send at most two emails: the first, and one follow-up about a week later. After that we write again only if you reply. We do not profile, rank, or score you, and our emails carry no tracking images.

Who receives it. Clay looks up and checks your work email address for us. Google hosts our email. Anthropic's AI assistant helps us run the search, choose whom to email, and draft the emails, and receives the details above to do so. Apart from the cases in section 7, we do not share your details with anyone else, and we never sell them.

The link in our email. The link carries a short tag that tells us which week's emails it came from, not who received it. When you open it, we record the tag, the time, and which landscape was opened in our own database. If you then create an account, the tag is recorded with it, as section 8 describes. The tag stores nothing on your device.

How long we keep it. If you do not reply, we delete our emails to you, and our note that we emailed you, 12 months after our last email. Clay keeps the result of the lookup it ran for us in our Clay account; if you ask, we will have Clay delete it. If you reply, we keep the conversation as ordinary business correspondence (section 9). If you ask us to stop, we keep your request and the emails it answers, marked do-not-contact, so that we never email you again.

Your right to object. You can tell us to stop at any time. Reply "no" to any of our emails, or write to contact@phasefolio.com with the subject "Outreach request". We will stop emailing you, with no exceptions, as soon as we read your message and within 10 business days at the latest.

Other requests. You can also use that address to ask what we hold about you and where it came from, or to have it corrected or deleted. Section 12 describes your other rights, including the right to complain to a supervisory authority.

15. Children

The services are intended for professional and business use, not use by children. Do not create an account or submit information on behalf of a child. If you believe a child has provided personal information to PhaseFolio, contact us so the matter can be assessed and addressed.

16. Changes and contact

A published revision will identify its effective date. We will provide additional notice of material changes where required by law or contract. Earlier versions remain relevant to the information handling and periods they governed.

For privacy questions, rights requests, or an organization-specific data-processing inquiry, contact PhaseFolio, Inc. at contact@phasefolio.com or by post at 4709 Harford Rd STE 44307, Baltimore, MD 21214, United States.