Privacy Policy

Effective Date: April 28, 2026

Last Updated: September 2, 2026

BioStack Platforms, Inc. ("BioStack," "we," "us," or "our") builds data infrastructure, datasets, evaluations, and training environments for medical and life-sciences artificial intelligence. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, communicate with us, apply for a position, attend an event, or otherwise interact with BioStack in a context where BioStack determines how and why personal information is processed (collectively, the "Services").

This Privacy Policy does not govern personal information that we process solely on behalf of a customer, healthcare provider, health system, research organization, data partner, or other organization under a services agreement, data processing agreement, business associate agreement ("BAA"), or similar contract. In those circumstances, that organization controls the information and its privacy notice and our agreement with it govern our processing. If your request relates to information supplied by one of those organizations, please contact that organization first.

This Privacy Policy is not a HIPAA Notice of Privacy Practices. BioStack may act as a "business associate" under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") for particular services. When we do, we use and disclose protected health information ("PHI") only as permitted by the applicable BAA and law.

1. Personal Information We Collect

The personal information we collect depends on how you interact with us.

Information You Provide Directly

We may collect:

  • Identifiers and contact information, such as your name, business email address, telephone number, company, title, and mailing address.

  • Communications and request details, including information you submit through contact forms, email, meetings, surveys, or support requests.

  • Account and authentication information, if we provide you with an account.

  • Transaction and commercial information, such as services considered or purchased, contracts, billing contacts, and payment-related records.

  • Job application information, such as your resume, employment and education history, professional qualifications, references, work authorization information, and interview notes.

  • Any other information you choose to provide.

Please do not submit patient records, PHI, genetic information, or other sensitive health information through a general website form or ordinary email unless BioStack has expressly instructed you to use an approved secure channel.

Information Collected Automatically

When you use our website, we and our service providers may automatically collect:

  • Device and network information, such as IP address, browser type, operating system, device identifiers, and general location inferred from IP address.

  • Usage information, such as pages viewed, links clicked, referring URLs, dates and times of access, and interactions with our website.

  • Cookie and similar technology information used to operate, secure, measure, and improve the website.

Information From Other Sources

We may receive professional contact information from your employer or colleagues, event organizers, business partners, public professional profiles, service providers, recruiters, and other lawful sources. We may combine this information with information collected through the Services.

2. Clinical, Research, and Other Health-Related Data

BioStack works with healthcare providers, health systems, laboratories, research organizations, data partners, and life-sciences and technology companies. Depending on the engagement, we may receive or process clinical records, medical images, pathology data, laboratory results, genomic or biomarker data, treatment information, outcomes, and related metadata.

We handle such information according to the role BioStack performs and the governing agreement and law. For example:

  • Service provider or business associate. When BioStack processes personal information or PHI on behalf of another organization, we follow that organization's documented instructions and the applicable contract or BAA.

  • De-identified data. We may create, receive, use, disclose, license, or commercialize data that has been de-identified in accordance with applicable law and contractual requirements. Where required, we maintain de-identification documentation and do not attempt to re-identify the data, except as permitted by law to test or validate the effectiveness of de-identification safeguards.

  • Other authorized data uses. We may use or disclose identifiable health-related information only when supported by an appropriate legal basis, permission, consent, authorization, or other documented right and subject to applicable contractual restrictions.

This Privacy Policy does not expand BioStack's rights to use clinical or health-related data beyond the rights granted by applicable law and the governing agreement, consent, or authorization.

3. How We Use Personal Information

We may use personal information to:

  • Provide, operate, maintain, secure, and improve the Services.

  • Respond to inquiries, schedule meetings, provide support, and communicate with you.

  • Develop and manage customer, supplier, healthcare, research, and other business relationships.

  • Administer contracts, billing, procurement, compliance reviews, and due diligence.

  • Personalize and understand use of our website and measure the effectiveness of our communications.

  • Send business and marketing communications, where permitted by law, and honor opt-out requests.

  • Evaluate candidates and administer recruiting and employment processes.

  • Detect, investigate, prevent, and address fraud, misuse, security incidents, and other harmful or unlawful activity.

  • Comply with legal, regulatory, contractual, audit, and reporting obligations.

  • Establish, exercise, or defend legal claims.

  • Carry out a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction.

We may use information that has been aggregated or de-identified so that it is not reasonably capable of being associated with you, subject to applicable law and contractual restrictions.

4. How We Disclose Personal Information

We may disclose personal information to:

  • Service providers and contractors that support hosting, cloud storage, cybersecurity, communications, analytics, customer relationship management, recruiting, professional services, payment processing, and other business operations.

  • Customers and business partners when needed to provide the Services, manage a relationship, respond to a joint request, or carry out an authorized project.

  • Professional advisers, such as lawyers, auditors, accountants, insurers, and financial advisers.

  • Government authorities and other parties when we believe disclosure is required by law or necessary to protect rights, safety, property, the integrity of the Services, or the public.

  • Transaction counterparties in connection with an actual or proposed financing, merger, acquisition, restructuring, bankruptcy, or sale of all or part of our business or assets.

  • Other parties at your direction or with your consent.

BioStack does not sell personal information collected from website visitors for money. BioStack also does not share such personal information for cross-context behavioral advertising.

We may license or otherwise provide properly de-identified datasets as described in Section 2; de-identified information is not treated as personal information where applicable law provides.

5. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, local storage, and similar technologies to keep the website functioning, protect it, remember preferences, understand traffic and performance, and improve the Services.

Your browser may allow you to block or delete cookies. Blocking certain cookies may affect website functionality. Where required by law, we will request consent before using non-essential cookies.

If our website provides a cookie preference tool, you can use it to change your choices. We honor legally required browser-based opt-out preference signals, such as Global Privacy Control, where applicable to our processing.

6. Marketing Communications

You may opt out of marketing emails by using the unsubscribe link in the message or contacting us at founders@getbiostack.com.

We may still send non-promotional communications, such as messages about an active business relationship, security, or legal matters.

7. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain business and transaction records, comply with legal and contractual requirements, resolve disputes, enforce agreements, and protect the Services.

Retention periods vary based on the nature and sensitivity of the information, the context in which it was collected, applicable contracts, and legal requirements.

When BioStack processes information on behalf of another organization, retention and deletion are governed by that organization's instructions and the applicable agreement.

We may retain aggregated or de-identified information where permitted by law and contract.

8. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure.

These safeguards are calibrated to the nature of the information and may include access controls, encryption, logging, monitoring, workforce training, vendor oversight, incident response procedures, and data minimization.

No system is completely secure, and we cannot guarantee absolute security.

9. Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to:

  • Request access to or a copy of personal information about you.

  • Request correction of inaccurate personal information.

  • Request deletion of personal information.

  • Obtain a portable copy of certain personal information.

  • Object to or restrict certain processing.

  • Opt out of certain sales, sharing, targeted advertising, or profiling.

  • Limit certain uses or disclosures of sensitive personal information.

  • Withdraw consent where processing is based on consent.

  • Appeal our decision on a privacy request.

To exercise a privacy right, email founders@getbiostack.com with the subject line "Privacy Request." Please describe your request and the relationship through which BioStack received your information.

We may need to verify your identity and authority before completing the request. You may use an authorized agent where permitted by law; we may request evidence of the agent's authority and verification of your identity.

We will not discriminate against you for exercising an applicable privacy right.

If we process your information solely on behalf of another organization, we may direct your request to that organization or assist it as required by our contract and law.

10. California Privacy Notice

This section supplements the rest of this Privacy Policy for California residents.

In the preceding 12 months, BioStack may have collected the following categories of personal information for the purposes described in Section 3 and disclosed them for business purposes to the recipients described in Section 4:

California CategoryExamples BioStack May CollectSourcesIdentifiersName, email address, telephone number, IP address, account identifierYou, your organization, website technology, business partners, public sourcesCustomer records informationContact, employment, and business relationship detailsYou, your organization, business partnersProtected classification informationAge or other information voluntarily included in recruiting materialsYou, recruitersCommercial informationProducts or services considered or purchased, transaction recordsYou, your organization, our systemsInternet or electronic activityWebsite interactions, browser and device information, referring pagesWebsite technology and service providersGeolocation dataApproximate location inferred from IP addressWebsite technology and service providersProfessional or employment informationEmployer, title, resume, qualifications, work historyYou, your organization, recruiters, public professional sourcesEducation informationEducation history and qualifications in applicationsYou, recruitersInferencesInferences about business interests or suitability for a roleInformation described aboveSensitive personal informationAccount credentials; information voluntarily supplied in recruiting or compliance processesYou, your organization, recruiters

Some medical information, PHI, and de-identified information may be exempt from or outside the scope of the California Consumer Privacy Act ("CCPA").

Where the CCPA applies, California residents may exercise the rights to know, access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing.

BioStack does not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined by the CCPA.

BioStack does not knowingly sell or share the personal information of consumers under 16 years of age. We use and disclose sensitive personal information only for purposes permitted without a right to limit, unless we provide a separate notice stating otherwise.

California's "Shine the Light" law may permit California residents to request information about certain disclosures of personal information to third parties for their own direct marketing purposes. You may submit such a request using the contact information in Section 15.

11. Information for Individuals in the EEA, United Kingdom, and Switzerland

Where European data protection law applies and BioStack acts as a controller, our legal bases for processing may include performance of a contract, steps requested before entering a contract, our legitimate interests (such as operating, securing, and improving our business and Services), compliance with legal obligations, and consent.

Where we rely on legitimate interests, we consider the impact on your rights and interests.

You may have rights to access, correct, erase, restrict, or object to processing; receive data portability; withdraw consent; and lodge a complaint with your local data protection authority.

International transfers may be supported by adequacy decisions, approved contractual safeguards, or another lawful transfer mechanism.

12. International Data Transfers

BioStack is based in the United States and may work with service providers and partners in other countries.

Your personal information may be processed in jurisdictions whose data protection laws differ from those where you live. Where required, we use appropriate safeguards for international transfers.

Clinical and health-related data may be subject to additional localization, contractual, consent, or regulatory restrictions, which we apply according to the relevant engagement.

13. Children's Privacy

The website and Services are intended for business and professional audiences and are not directed to children under 13.

We do not knowingly collect personal information directly from children through the website. If you believe a child has provided personal information to us through the website, contact us so we can take appropriate action.

This section does not apply to clinical information about minors that BioStack processes on behalf of a healthcare or research organization under an applicable agreement and legal authority.

14. Third-Party Links and Services

The website may link to third-party websites or services. Their privacy practices are governed by their own notices, and BioStack is not responsible for those practices.

15. Contact Us

For questions about this Privacy Policy or to submit a privacy request, contact:

BioStack Platforms, Inc.
251 Post Street, Suite 620
San Francisco, California 94108
United States

Email:founders@getbiostack.com

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, Services, or legal obligations.

We will post the updated version on this page and revise the "Last Updated" date. If required by law, we will provide additional notice or obtain consent for material changes.