NotchBio Privacy Policy

1. Who We Are

NotchBio provides a cloud-based bioinformatics platform for research workflows, including RNA-seq upload/import, quality control, preprocessing, quantification, differential expression, and pathway analysis. The Lab App is used by researchers and labs to analyze data. The Core Facility App is used by organizations (sequencing cores, bioinformatics facilities) to process and deliver projects to researchers and labs. NotchBio provides software infrastructure and does not independently decide the scientific purpose of customer data.

2. Scope of This Policy

This policy covers data collected through the public website, the Lab App, the Core Facility App, APIs, integrations (including Illumina BaseSpace and Box), and support channels.

3. Lab Users, Core Facilities, and Organizations

Lab Users use the Lab App to create projects, upload/import data, run analysis, and view results. Core Facilities are organizations that use the Core Facility App to process and deliver sequencing data to Lab Recipients. When a Core Facility delivers a project, NotchBio shares project data with designated Lab Recipients as instructed by the Facility.

4. Contact

For privacy questions or data requests, use the in-app contact option or email contact@updates.notchbio.app .

5. Information We Collect

5.1 Account and organization information

We may collect name, email, authentication identifiers, and organization details. For Core Facility organizations, this includes organization name, facility admin details, team member names and emails, roles (admin, uploader, analyst, viewer), workspace/organization membership, and access logs. Authentication is handled through third-party identity infrastructure.

5.2 Usage and technical information

We may collect IP address, browser/device metadata, timestamps, access logs, project/job activity metadata, and operational diagnostics.

When you use the public GEO FASTQ Downloader, we process the accession you enter and public archive metadata needed to resolve it. The public resolver does not store the accession, resolved metadata, download selection, or an authentication handoff in the NotchBio application database.

5.3 Billing and usage information

If paid services apply, billing may be processed by third-party providers. We may receive billing contact details, plan status, and transaction metadata. We do not store full payment card numbers. For Core Facilities, we may also collect active sample counts, analysis run usage, included-run consumption, pending usage data, weekly invoice lines, charge attempts, and Paddle billing metadata.

5.4 Research data and user content

You may upload or import scientific datasets and metadata (for example, NCBI accessions and sequencing files), along with generated outputs. We process this content only to provide requested functionality. This includes FASTQ/source files, imported sequencing files, generated outputs (DESeq2 results, plots, CSVs, tables, pathway results), and QC/preprocessing/intermediate files.

FASTQ files downloaded locally through the public GEO FASTQ Downloader transfer from the selected public archive mirror to your device; NotchBio does not proxy or store those local-download files. If you instead choose analysis, the selected public runs are imported into your authenticated NotchBio workspace under the storage and plan terms described in this policy.

5.5 Core Facility project information

For Core Facility projects, we may collect project names, sample names, sample metadata, grouping/comparison metadata, recipient names and emails, delivery status, acceptance status, run history, and audit/activity logs.

5.6 Integration information

When integrations are connected, we may collect and store BaseSpace tokens, Box tokens, refresh tokens, file IDs, file paths, import logs, connection metadata, and authorization metadata. We use these only to provide requested import and connectivity features.

6. How We Collect Information

• Directly from you (account setup, uploads, forms, support requests).
• From Core Facility admins and uploaders/analysts managing projects.
• From Lab Recipients accepting delivered projects.
• Automatically during product use (logs and usage data).
• From integrated third-party providers (authentication, billing, public repositories).
• From organization-wide integrations like Illumina BaseSpace and Box.
• From compute/storage systems during pipeline execution.
• From billing systems during weekly usage/invoicing.

7. How We Use Information

• Provide authentication and access control.
• Run requested analysis workflows.
• Manage projects, files, and collaboration features.
• Create and manage Core Facility organizations.
• Enable role-based access within organizations.
• Import files from connected third-party accounts (BaseSpace, Box).
• Store Facility source files in the Facility Volume.
• Deliver projects to designated Lab Recipients.
• Allow Lab Recipients to accept delivered projects.
• Track included analysis runs.
• Track metered usage and generate weekly invoices.
• Operate billing/subscription flows.
• Secure the platform and prevent abuse.
• Troubleshoot reliability and improve performance.
• Diagnose failed imports or pipeline jobs.
• Maintain audit logs.
• Prevent unauthorized recipient delivery.
• Provide support and service communications.
• Comply with legal obligations.

8. Legal Bases (Where Applicable)

Depending on jurisdiction, we process personal data under contract performance, legitimate interests, legal obligation, or consent (where required).

Controller/processor distinction:

• For account data, billing data, website analytics, security, and service operations, NotchBio may act as an independent controller.
• For research data, biological files, sample metadata, and delivered projects, NotchBio generally acts as a processor/service provider.
• A Core Facility may act as controller or processor for data it uploads and delivers, depending on its relationship with its customers.
• A Lab Recipient or their institution may also be a controller depending on their agreements.
• NotchBio does not decide whether a Facility has consent, IRB approval, or customer authorization.

9. Research Data, Facility Data, and Lab Recipient Data

• Facility source files are stored in the Facility Volume.
• Delivered Lab projects may reference Facility source files for raw inputs.
• Lab-generated outputs are stored in the Customer/Lab Volume.
• Raw data ownership may belong to the Facility, Lab Recipient, customer, or institution depending on their agreements.
• Generated outputs may belong to the Lab Recipient or customer depending on their agreements.
• NotchBio does not claim ownership of research data or generated outputs.
• NotchBio does not sell biological or research data.
• NotchBio does not use biological data for advertising purposes.
• NotchBio does not train general-purpose AI models on biological data unless separately agreed in writing.
• Users and Facilities are responsible for required rights, approvals, and legal basis for uploaded/imported data.
• Facilities are responsible for recipient authorization.

10. Storage Separation and Delivered Projects

• Facility source files are stored in the Facility Volume.
• Lab-generated outputs are stored in the Customer/Lab Volume.
• Delivered Lab projects may point back to Facility source files for raw inputs.
• Deleting Facility source files may affect the ability to rerun analysis in delivered Lab projects.
• Generated outputs may remain available even if source files are removed.

11. Third-Party Integrations and Tokens

We rely on third-party providers for authentication and identity (Clerk), infrastructure hosting (Railway), temporary upload staging (Cloudflare R2), compute and durable file storage (Modal), databases, billing/subscription handling (Paddle), public repository integrations (NCBI GEO/SRA and INSDC mirrors including ENA and DDBJ), Illumina BaseSpace, Box, product analytics (PostHog), and website analytics (Google Analytics).

For direct uploads through the Core Facility App, file parts are sent from your browser to a private Cloudflare R2 bucket using time-limited upload URLs. This temporary staging allows interrupted multipart uploads to resume without retransmitting parts that R2 has already received. Railway handles authentication and upload-control metadata but does not proxy the file contents. After the upload is complete, Modal reads and validates the staged object into the Facility Volume. We then request deletion of the R2 staging copy after Modal confirms the durable transfer.

For integrations such as BaseSpace and Box, we store connection tokens and use them only to provide requested import and connectivity features. Facility admins can connect and revoke organization-wide integrations. NotchBio does not use integration tokens for purposes other than operating the requested features.

12. Product Analytics, Cookies, and Session Replay

We use cookies and similar technologies for session management, security, and functionality.

Public site (notchbio.app): We ask for consent before enabling non-essential analytics cookies. If you opt in, we use PostHog and Google Analytics to measure visits, CTA clicks, docs/blog attribution, and related marketing analytics.

The public GEO FASTQ downloader also uses a signed browser cookie to enforce its daily anonymous request limit. The cookie contains a random device identifier, UTC date, and request count; it does not contain accession codes, filenames, sample titles, source URLs, or biological metadata.

Lab App (lab.notchbio.app): We may use product analytics and masked session replay to understand workflow usage, reliability issues, and support requests. Session replay is configured to mask text input fields by default.

Core Facility App (core.notchbio.app): We use consent-gated PostHog analytics. Product analytics are only enabled after you provide consent. Session replay, when enabled, masks inputs and sensitive content.

Across all apps: Analytics capture product metadata such as IDs, counts, statuses, roles, and billing readiness. We do not intentionally send FASTQ file contents, sample-level sensitive fields, full research outputs, filenames, sample names, recipient emails, free-text notes, raw biological data, tokens, or credentials to analytics services.

You can manage public-site analytics consent using the cookie settings control on the site.

13. Storage, Processing, and Retention

Data may be processed on cloud infrastructure across multiple regions. Temporary and intermediate files may be created during workflows.

• Cloudflare R2 parts and completed objects used for direct Core Facility uploads are temporary. We normally request deletion promptly after Modal confirms a valid durable copy. A one-day R2 lifecycle rule is used as a cleanup backstop for staging objects and abandoned multipart uploads if normal cleanup is delayed.
• Facility source files are retained in the Facility Volume while the integration/account remains active.
• Lab outputs are retained in the Customer/Lab Volume according to the Lab user's plan or retention settings.
• Deleting Facility source files may affect delivered Lab project reruns.
• Generated outputs may remain available even if source files are removed.
• Backups and logs may retain limited data for security, recovery, billing, and legal reasons.
• Usage/invoice metadata may be retained longer for accounting and legal reasons.
• Integration tokens are retained while the integration remains connected, or as needed for security/audit logs.
• Retention varies by data type and operational need.

14. Data Sharing

We do not sell or rent personal data.

We may share data with:

• Service providers who help operate the platform (infrastructure, billing, analytics, auth, storage, and support providers).
• Collaborators you authorize within your workspace.
• As required by law, regulation, or legal process.
• During a corporate transaction, subject to applicable safeguards.

Core Facility delivery sharing:

• When a Facility delivers a project, NotchBio shares project data (including source file access and metadata) with designated Lab Recipient(s) as instructed by the Facility.
• NotchBio does not independently verify whether recipients are correct or authorized.
• The Facility is responsible for ensuring recipients are authorized to receive the data.
• Lab Recipients may share outputs with collaborators depending on their workspace permissions.

15. International Data Transfers

Because providers may operate globally, data may be processed outside your country of residence. We use reasonable safeguards appropriate to applicable law.

16. Security

We use technical and organizational controls including access control, secure transport, role-based organization permissions, and operational monitoring. No system can guarantee absolute security.

17. Your Rights

Depending on jurisdiction, you may request access, correction, deletion, portability, restriction, or objection, and may withdraw consent where consent is the legal basis.

If data was uploaded by a Core Facility on behalf of a customer, some privacy requests may need to go through the Facility, institution, or data controller. NotchBio may redirect or coordinate such requests with the relevant organization. Deleting source files may affect delivered projects.

Submit requests through in-app contact or contact@updates.notchbio.app .

18. Children's Privacy

The Service is not intended for children under 18, and we do not knowingly collect their personal data.

19. Changes to This Policy

We may update this policy from time to time. Updated versions include a revised "Last Updated" date and become effective when posted unless stated otherwise.

20. Contact

For privacy inquiries, use the in-app contact option or email contact@updates.notchbio.app .