Privacy policy

Effective 2 October 2026; workspace section added 9 October 2026; payments added 2 November 2026.

This website

What we collect. When you use a form on this site we receive the fields you enter: name, work email, organisation, role, and the free-text description you provide. We ask you not to include patient identifiers or protected health information; if any is submitted we delete it on receipt.

Analytics. We use Cloudflare Web Analytics, which is cookieless and does not track individuals across sites. We do not use advertising trackers.

Why. To respond to your enquiry, to scope and deliver services you request, and to notify you about the offerings you asked to hear about. We do not sell personal data.

Retention. Enquiry records are kept for 24 months after the last contact unless a contract follows, in which case they are kept for the life of the engagement plus the period our records policy requires.

The workspace at app.biomedsai.com

Account and profile. To create an account we ask for your full name, work email address, password, job title or role, organisation or laboratory and its type, country, and a phone number with country code; optionally how you heard about us and whether you wish to receive occasional updates. We record the date you accepted the terms of use and this policy. The phone number is used to secure the account and to arrange scoping calls; it is never used for marketing.

Where it is stored. Your email address, password (as a salted hash we cannot read) and display name are held by Google Cloud's identity service. The remaining profile fields, your projects, access requests and the record of actions on your account are held in a database on Google Cloud in the United States, encrypted at rest and in transit. Sign-in sessions are held by Cloudflare for at most twelve hours. Files you upload are stored in a per-project location on Google Cloud in the United States, encrypted, with access limited to your account, the people you invite, and the BioMedsAI scientists assigned to your project. Every access by BioMedsAI staff is written to an append-only log.

Who sees it. BioMedsAI staff with a role on your account (to open the workspace, review a request for full access, assign a scientist, deliver results, or answer a support question), and members of your organisation to the extent you invite them. Profile details are not shared with other customers or with third parties, except the processors below, and are never sold.

Payments. If you buy a package, you pay in a form provided by Stripe, Inc., our payment processor, inside the workspace. Card and bank account details go directly to Stripe; BioMedsAI never receives or stores your full card or bank account number. Stripe gives us a customer reference, your billing name and email address, your billing address where it is needed for sales tax, the package and amounts, any promotion code used, and whether each payment succeeded. We keep a record of each promotion code you use (when, for which package and the discount) to apply its limits. Stripe also uses payment information to prevent fraud and to meet its own legal obligations, as described in its privacy policy at stripe.com/privacy. Payment and invoice records are kept for as long as tax and accounting law requires.

Research data and the AI scientist. Sample sheets, metadata and sequencing data you upload are used only to deliver the services you request. They are never used to train any model. When you consult Padma, the AI scientist, the parts of your sample sheet or delivered tables needed to answer your question are sent to a managed model service under terms that prohibit training on them, and the model's replies are stored in your project. Do not upload patient identifiers or protected health information; the workspace is not designed to hold it, and if we find any we will delete it and tell you.

Why we ask for country and organisation. To route your request to the right scientist, to meet export-control and sanctions obligations that apply to a United States company, and to set up the engagement agreement. Accounts from certain jurisdictions, and accounts registered with personal email addresses, are reviewed by a BioMedsAI staff member before the workspace opens.

Retention. Account and profile details are kept while the account exists and for 24 months after it is closed, unless a contract requires longer. Project files are kept for the life of the engagement and 90 days after a project is closed or a trial ends, then deleted; a deletion is logged. You may download your delivered results at any time; copies you have downloaded remain yours.

Your choices. You can update your profile from the Account page, withdraw consent to updates at any time, and ask us to export or delete everything we hold about you by emailing communications@biomedsai.com from the address on the account. We confirm within ten business days.

General

Your rights. You may ask what we hold about you, ask us to correct or delete it, or withdraw consent to notifications at any time at communications@biomedsai.com. If you are in the European Economic Area or the United Kingdom, these include the rights under the GDPR, and you may complain to your supervisory authority.

Processors. Cloudflare (hosting, sessions, analytics, form protection), Google Cloud (identity, storage, database, the model service for Padma), Google Workspace (email), Stripe (payments, sales-tax calculation and fraud prevention), and our email-delivery provider process data on our behalf under their standard terms. All processing takes place in the United States.

Controller. BioMedsAI, Inc., a Delaware public benefit corporation, registered to do business in New York. Contact: communications@biomedsai.com, or the form at biomedsai.com/contact.