Privacy Policy

1. Introduction

HistoOmics-AI is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

2a. Account Information

When you register, we collect:

• Name
• Email address (institutional email required)
• Institution / affiliation
• Research interests (optional)
• Hashed password (bcrypt-hashed, never stored in plain text)

2b. Histopathology Images (WSI)

If you upload whole slide images:

• Images are stored on secure HPC infrastructure at Cedars-Sinai
• You must ensure images are de-identified (no patient identifiers)
• By default, images are kept for model improvement research; you can opt out on each submission
• If you opt out of retention for a submission: those images are deleted 7 days after processing

2c. Analysis Results

When you run inference, we collect:

• Gene expression predictions (~20,000 genes)
• Pathway enrichment scores (ssGSEA)
• AI-generated summary text
• Job metadata (cancer type, timestamps, status)

Results follow the same retention policy as images.

2d. Usage and Audit Logs

We automatically log:

• Login and logout times
• Jobs submitted and their status
• Results accessed and exported
• IP address and user agent (for security)
• Data deletion requests and timing

Audit logs are retained for 12 months for security and debugging purposes.

3. How We Use Your Information

Core Service:

• Process and analyze your uploaded histopathology images
• Generate gene expression predictions and pathway analysis
• Display results and enable export

Research (if you opt in):

• Improve the Path2Omics model using your anonymized data
• Assess model performance across cancer types
• Publish research findings (with aggregate statistics, no individual data)

Operations:

• Monitor system health and performance
• Prevent abuse and enforce usage limits
• Debug errors and improve the platform
• Send notifications (email verification, password reset)

4. Data Retention

If you CONSENT to data retention:

• Images and results kept indefinitely
• Used for model improvement research
• You can request deletion at any time

If you opt out of retention:

• Images automatically deleted 7 days after job completion
• Results automatically deleted 7 days after job completion
• Deletion is permanent and irreversible

Audit logs:

• Retained for 12 months for security purposes
• Older logs automatically purged

Account data:

• Retained as long as your account is active
• Deleted upon account closure request

5. Data Security

We implement technical and administrative safeguards:

• TLS encryption for all data in transit
• Encryption at rest on Cedars-Sinai HPC storage
• Access controls and role-based permissions
• Regular security audits and penetration testing
• No direct public internet exposure for sensitive data

However, no system is 100% secure. You use the Service at your own risk.

6. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your data at any time
• Export: Download your results in standard formats (CSV, JSON)
• Withdraw Consent: Change your data retention preference anytime

To exercise these rights, contact us at privacy@path2omics.org

7. Third-Party Services

HistoOmics-AI may use:

• Anthropic Claude API: For AI-generated summaries (governed by Anthropic's privacy policy)
• Cedars-Sinai HPC: For storage and computation (governed by Cedars-Sinai policies)

Your data is de-identified before use with third-party APIs.

8. Children's Privacy

HistoOmics-AI is intended for adult researchers only. We do not knowingly collect data from individuals under 18. If we learn we have done so, we will promptly delete such information.

9. HIPAA and GDPR Compliance

HIPAA: You are responsible for ensuring de-identification per HIPAA Safe Harbor or Expert Determination. We are not a HIPAA-covered entity or business associate.

GDPR: If you are a EU resident, you have additional rights under GDPR. We will comply with your requests for data access, rectification, and erasure.

Your IRB: You must obtain IRB approval before uploading any human subject data, even if de-identified.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be announced via email or prominent notice on the site. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

Questions about privacy? Contact our Data Protection Officer: