1. Who we are and what this notice covers
PhaseFolio, Inc., a Delaware corporation ("PhaseFolio," "we," "us," or "our"), provides software for biotech research, comparator evidence, diligence, and analysis. This notice describes how we handle personal information in connection with our websites, documentation, accounts, product interfaces, support, and supported API/MCP services.
Our product family includes Atlas for source-linked comparator research, and Workspace for diligence records, assumptions, scenarios, and outputs. Sentinel is in development. Describing Sentinel on a marketing page does not mean that a monitoring service is operating or collecting information on your behalf.
This notice covers information about identifiable people, including account holders, organization members, business contacts, and people identified in submitted material. An asset-level record may still contain personal information, such as an author's name, work email, or notes about a person.
For questions or privacy requests, contact contact@phasefolio.com. A separate written data-processing agreement or other agreement with your organization may specify additional obligations for customer content.
2. Our role and your organization's role
PhaseFolio determines how information is used to administer its business relationships, secure its services, manage accounts, and respond to direct inquiries. An organization using Workspace may determine the purposes for which personal information in its own diligence records is processed. The applicable agreement and law determine our respective roles for that information.
If your account is provided through an organization, its administrators may manage membership, permissions, and access to the organization's records. Direct requests about organization-controlled content to that organization where appropriate. We can help identify the relevant request route without disclosing another organization's information.
3. Information we collect
We collect information you provide, information generated through use of the service, and relevant information from authorized business contacts or public sources.
| Category | Examples | Why it is used |
|---|---|---|
| Account and identity | Name, email address, authentication identifiers, account settings | Sign-in, account administration, security, and support |
| Organization and access | Organization names, invitations, membership, roles, product access | Enforce the correct organization's permissions and administer access |
| Customer content | Asset context, diligence notes, source links, uploaded material, assumptions, scenarios | Perform the product actions requested by you or your organization |
| Research context | Comparison questions, search expressions, selected records, evidence context, run history | Retrieve and prepare evidence, run selected analysis, and reconstruct saved work |
| Communications | Inquiries, feedback, support messages, relevant attachments | Respond to requests and understand product problems |
| Business administration | Contract contacts, order details, invoicing and accounting records | Manage business relationships and legal obligations |
| Technical and usage information | IP address, browser information, request times, diagnostic events, access logs | Deliver pages, protect the service, investigate failures, and assess reliability |
| Public-source information | Source records, citations, author or investigator names, business information | Provide the research and evidence functions associated with the requested workflow |
Some information is necessary to provide an account or complete a requested workflow. If you choose not to provide it, the related feature may not work. Optional content should be limited to what is relevant to the task.
4. Sensitive information and customer content
PhaseFolio is not designed to receive Protected Health Information (PHI), patient-level records, medical charts, or regulated clinical datasets. Do not submit that material, including in uploads, prompts, free-text notes, or support requests. Do not upload credentials, payment-card details, or information you lack authority to disclose.
Workspace may contain confidential commercial and diligence information. Access is governed by the applicable organization and product permissions. Customer content is used for the requested service, security, administration, and support, subject to the applicable agreement; it is not automatically made public because the product also contains public-source research.
Atlas search questions and public-source evidence are different from confidential Workspace records. Follow the input restrictions displayed for the feature. A public-source workflow is not an invitation to include confidential company or patient information in a search expression.
5. How we use information
We use information to provide requested functionality, authenticate users, enforce access permissions, maintain saved work, prepare outputs, manage customer relationships, answer support requests, investigate problems, prevent misuse, and meet applicable legal obligations.
Product improvement can include examining service reliability and usage patterns. Such work does not, by itself, authorize publication of a customer's confidential material or use inconsistent with an applicable agreement. This notice does not grant a general license to train AI models on customer content.
Where EU or UK data-protection law applies, a processing activity must have an appropriate lawful basis. Depending on the activity and our role, these may include performing a contract with an individual, legitimate interests in operating and protecting a business service subject to the required balancing of rights, compliance with a legal obligation, or consent where required. Consent can be withdrawn where processing relies on it, without affecting processing already lawfully undertaken. For information we process on an organization's instructions, that organization is responsible for identifying its applicable basis.
6. AI-assisted features and source retrieval
An AI-assisted feature may transmit the input and context needed for the requested action to the model service supporting that feature. This can include submitted text, file content, selected evidence, and relevant asset context. Review the material you select before invoking an AI feature. Generated output can contain errors and should be inspected with its supporting evidence.
Model-service processing, safety review, retention, and other handling depend on the applicable provider configuration and contractual terms. This notice does not promise zero retention by every model provider. Ask us for the processing details relevant to your product or enterprise arrangement before submitting material with special confidentiality requirements.
Retrieving public evidence can require transmitting a search expression or request to the relevant source. Public source providers and websites may also receive technical information when you visit a citation directly. Accessing a public source does not make all content you submit public, and a citation does not transfer a third party's intellectual-property rights to you.
7. When information is disclosed
Information may be disclosed to:
- Authorized organization members, according to their permissions and the collaboration or sharing actions you request.
- Service providers supporting identity, hosting, storage, delivery, diagnostics, communications, and requested AI processing, to the extent needed for those functions and subject to applicable arrangements.
- Recipients you choose, including people to whom you send an export or grant access through a supported sharing workflow.
- Professional advisers and authorities, when reasonably necessary for legal obligations, a valid legal process, accounting, security, or protection of rights.
- Parties to a corporate transaction, where information is reasonably required in connection with a proposed or completed financing, reorganization, acquisition, or transfer of business assets, subject to applicable confidentiality and legal requirements.
The service relies on third-party infrastructure and providers. The exact provider chain can vary by product and feature. Contact us for information about the providers relevant to your use or a contractual subprocessor schedule. A public webpage is not a representation that every named provider processes every customer record.
Customer content is not offered for sale as part of the PhaseFolio service. Legal definitions of selling, sharing, and targeted advertising vary by jurisdiction; applicable privacy choices and obligations depend on the actual processing and law. A customer-directed export or a necessary provider disclosure should not be confused with making a customer's records publicly available.
8. Cookies, storage, and external services
Cookies and similar storage can support authentication, security, preferences, and continuity of a product session. Hosting and delivery services may collect technical information when a page is requested, including a public documentation page. Blocking necessary storage may prevent sign-in or other functions from working.
If an optional feature requires consent or a separate choice under applicable law, that choice must be handled through the relevant notice or control. This notice does not treat visiting a page as universal consent to optional tracking.
Links to external websites, scheduling services, sources, or integrations lead to services with their own privacy practices. Review their notices before providing information. We do not control how an independent recipient handles a file after you choose to send it to them.
9. Retention and deletion
Retention depends on the purpose of the record, the applicable agreement, account or organization status, legal obligations, and the need to investigate security or service incidents. We seek to avoid keeping identifiable information longer than reasonably necessary for those purposes.
Deletion of active product content, removal from a user's view, expiry of a backup, and deletion by a service provider are distinct operations. A deletion request may require action across those systems. Legal holds, dispute preservation, accounting obligations, and prevention of abuse may require some records to be retained after ordinary use ends.
Issued exports may remain in the possession of recipients who obtained them through an authorized action. Verification metadata may need to be retained to reconstruct the identity and version of an earlier artifact. A verification record and the contents of the underlying export are different records and should be assessed separately.
Contact us about a deletion request or the retention schedule applicable to your arrangement. Applicable legal deadlines and contractual commitments govern the handling of a valid request. We will explain a relevant exception where required by law.
10. Security
The service is designed around access controls, organization-scoped permissions, encrypted transport, and controls provided by its infrastructure services. Security measures are proportionate to the services and information involved and are subject to ongoing review. No transmission or storage system can be guaranteed completely secure.
You can help by protecting account access, maintaining appropriate organization membership, reviewing sharing actions, and reporting suspected compromise promptly. Do not put passwords or keys in a support request. See the security and data-handling summary for additional context.
This notice does not assert a certification, independent audit result, or regulatory approval. Any specific enterprise security commitment must be documented in the applicable agreement.
11. International processing
PhaseFolio and its service providers may operate in more than one country. Information can therefore be processed outside the country where you are located, subject to the configuration and contractual arrangements for the relevant service.
Where an applicable law restricts an international transfer, the appropriate transfer mechanism and safeguards must be established for that transfer. Contact us for information relevant to your organization; this notice does not represent that a particular hosting region or transfer instrument applies uniformly to every workflow.
12. Your rights and choices
Depending on your location, our role, and the applicable law, you may have rights to access or obtain a copy of personal information; correct inaccurate information; request deletion; restrict or object to particular processing; receive eligible information in a portable form; or withdraw consent. Additional rights may apply to certain forms of sale, sharing, targeted advertising, sensitive information, or automated decision-making where those activities and laws apply.
Submit a request to contact@phasefolio.com. Identify the nature of your request and the account or organization involved, but do not send a password or unnecessary sensitive information. We may need proportionate information to verify identity, confirm an authorized agent's authority, or determine which organization controls the record.
We respond in accordance with the deadlines, exceptions, and verification requirements of applicable law. An organization-controlled request may need to be referred to that organization. Where required, we will explain a refusal or restriction and any available appeal route. You may also have a right to complain to a relevant regulator or supervisory authority. Exercising a legal privacy right does not remove rights you otherwise have under applicable law.
13. Children
The services are intended for professional and business use, not use by children. Do not create an account or submit information on behalf of a child. If you believe a child has provided personal information to PhaseFolio, contact us so the matter can be assessed and addressed.
14. Changes and contact
A published revision will identify its effective date. We will provide additional notice of material changes where required by law or contract. Earlier versions remain relevant to the information handling and periods they governed.
For privacy questions, rights requests, or an organization-specific data-processing inquiry, contact PhaseFolio, Inc. at contact@phasefolio.com.
Questions about this document
Contact contact@phasefolio.com with questions about this document.