Privacy Policy

1. Scope

This policy applies to Bayes Pharma websites and professional software, including BayesARC, BayesGenRx, BayesCare, BioAtlas and related workspaces, pilots, support channels and business-development interactions (together, the “Services”). It covers visitors, prospects, customer administrators, named users and other individuals whose personal information we process for our own business purposes.

It does not by itself govern all data a customer places in a licensed workspace. Where Bayes Pharma processes Customer Content on a customer’s behalf, the customer agreement and any applicable data processing addendum (“DPA”) control.

2. Our privacy role

Website, account and business-contact data: Bayes Pharma generally acts as the controller/data fiduciary or equivalent organization deciding why and how that personal information is processed.

Customer Content: when an organization instructs Bayes Pharma to process personal information inside a contracted workspace, Bayes Pharma generally acts as a processor/service provider on that organization’s behalf, subject to the contract and DPA.

3. Information we collect

We may also receive limited business-contact information from publicly available professional sources or lawful business referrals when permitted by applicable law.

4. How we use information

• Provide, secure, administer and troubleshoot the Services.
• Create and manage accounts, roles, permissions and customer organizations.
• Respond to enquiries, demos, pilots, support requests and partnership discussions.
• Operate product workflows requested by users and customer organizations.
• Detect abuse, fraud, security incidents and unauthorized access.
• Improve reliability, usability and product performance using appropriately governed telemetry and feedback.
• Send service, security and account communications and, where permitted, business communications that can be unsubscribed from.
• Comply with legal obligations, enforce agreements and protect legal rights.

5. Legal bases and permission to process

Where a law requires a lawful basis, we rely on one or more of the following as appropriate: performance of a contract or steps requested before a contract; legitimate interests in operating, securing and improving a business-to-business service; consent for optional analytics or marketing where required; compliance with legal obligations; and protection of legal rights or important interests.

In India, processing may also rely on consent or another basis permitted under the Digital Personal Data Protection Act, 2023 and applicable rules as their provisions take effect. See the India Privacy Notice.

6. Customer Content

Customers are responsible for having the rights and lawful basis needed to upload Customer Content and for configuring access appropriately. Bayes Pharma processes Customer Content according to customer instructions, the applicable agreement and documented product functions.

For enterprise processing terms, see Data Processing & International Transfers.

7. Cookies, local storage and analytics

We use essential browser storage for requested functions such as authentication, session continuity, security and interface preferences. Optional Google Analytics on the public Bayes Pharma homepage is not loaded until analytics permission is granted through our privacy controls.

See the Cookie Policy and Privacy Choices page to manage optional analytics.

8. How we share information

We may disclose personal information to service providers and subprocessors that support hosting, security, communications, analytics, customer support or other business operations; to professional advisers; to a customer organization where the information relates to its users or workspace; and to authorities or other parties when legally required or reasonably necessary to protect rights, safety or security.

We do not sell personal information for monetary consideration. We do not disclose personal information to third parties for their own independent direct marketing without a lawful basis. Where a US state law treats certain advertising or analytics disclosures as “sharing” or targeted advertising, applicable opt-out rights are described in the US State Privacy Notice.

9. International data transfers

Because Bayes Pharma serves customers across the United States, Europe and India, personal information may be processed in a country different from the country where it was collected. Where required, we use contractual and organizational safeguards appropriate to the transfer, which may include EU Standard Contractual Clauses, a UK transfer addendum or other approved mechanism, customer contractual controls, transfer assessments and supplementary safeguards.

India transfers are handled subject to applicable restrictions under Indian data-protection law as those provisions apply. More detail is available at Data Processing & International Transfers.

10. Data retention

We retain personal information only for as long as reasonably necessary for the purpose collected, including to provide the Services, maintain security and audit records, comply with legal or contractual obligations, resolve disputes and enforce agreements. Retention periods vary by data type, customer instructions and regulatory context. Customer Content is returned, deleted or retained according to the applicable customer agreement and legal requirements.

11. Security

We use administrative, technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse or alteration. No system is completely secure. Customers remain responsible for endpoint security, user administration, least-privilege access, appropriate data classification and local validation.

See Security & Data Handling for our public security boundary.

12. Your privacy rights

Depending on where you live and which law applies, you may have rights to receive information about processing; access personal information; correct inaccurate information; delete information; restrict or object to processing; obtain portable data; withdraw consent; opt out of certain sale, sharing, targeted advertising or profiling; and appeal or complain to a regulator.

We will not discriminate against you for exercising a legally protected privacy right. We may need to verify identity or authority before acting on a request, and lawful exceptions may apply.

Regional detail: United States · Europe · India.

13. Sensitive, health and regulated data

Some Bayes Pharma products may be used in scientific, clinical, quality or regulatory workflows. That does not mean every deployment is authorized for protected health information, clinical-trial subject data or other sensitive categories. Customers must follow their own applicable privacy, research, clinical, quality and security requirements and use only workspaces contractually approved for that data.

14. Children

The public Services are directed to organizations and adult professionals and are not intended for children. We do not knowingly solicit personal information from children through our public marketing sites. If a customer uses a contracted service in a context involving minors, responsibility and processing terms must be specifically addressed in the customer’s legal and governance framework.

15. Changes to this policy

We may update this policy to reflect changes in our Services, vendors, business operations or applicable law. Material changes will be identified by an updated date and, where legally required, by additional notice or renewed consent.

16. Contact us

For privacy questions or rights requests, email info@bayespharma.com. Include your region, relationship to Bayes Pharma and the request you want us to address. Do not send sensitive scientific or health data in an ordinary email request.