Privacy policy

1. Who this policy applies to

This policy applies to visitors, people who contact us, and CellHood account holders. For account administration, billing, enquiries, and service-security data, CellHood determines how and why the information is used. For scientific records entered into a workspace, the workspace owner or contracting organization normally determines the purpose of that processing, and CellHood provides the service on its behalf.

If your request concerns content managed by your employer, university, or research group, your group administrator may be the best first contact. CellHood will assist the responsible organization where required.

2. Personal data we collect

• Account and identity data: name, username, work or academic email, profile image, workspace, role, preferences, and—when you choose social sign-in—the provider name and its stable account identifier. CellHood does not retain Google or GitHub access tokens after authentication.
• Security and activity data: password hashes, sign-in and session information, IP address, browser information, timestamps, and attributable audit events.
• Billing data: selected plan, subscription status, and references supplied by our payment provider. CellHood does not receive or store full card details.
• Enquiry and support data: contact details, organization, job title, team size, selected topic, and the content of messages sent to us.
• Workspace content: culture, lineage, protocol, media, image, note, sample, outcome, approval, and report records entered by authorized users. Scientific content is not always personal data, but we treat it as confidential workspace information.

3. Sensitive information

CellHood is designed for laboratory operations, not for storing directly identifiable patient or research-participant records. Users should not upload health data, genetic data linked to an identifiable person, or other special-category personal data unless their organization has established an appropriate lawful basis and its agreement with CellHood expressly covers that use.

4. Why we use personal data

We use personal data to create and administer accounts, provide requested workspace features, maintain traceable records, generate reports, deliver configured notifications, process subscriptions, respond to enquiries, prevent misuse, troubleshoot errors, and improve service reliability and usability.

Depending on the context, our lawful basis is performance of a contract, compliance with a legal obligation, our legitimate interests in operating and securing CellHood, or consent where a specific optional activity requires it. We do not sell personal data, use workspace content for third-party advertising, or make solely automated decisions that produce legal or similarly significant effects.

5. Who may receive personal data

Personal data may be available to authorized members and administrators of the relevant workspace. We also use suppliers for infrastructure and private storage, optional Google or GitHub authentication, email delivery, payment processing, security and support, and—only when a user invokes the feature—AI-assisted protocol document extraction. Suppliers may process only the information needed to provide their service and are subject to appropriate data-protection and confidentiality terms.

We may disclose information to professional advisers, regulators, courts, law-enforcement bodies, or another business involved in a genuine corporate transaction where disclosure is lawful and necessary. We do not disclose workspace content to unrelated organizations for their own marketing.

6. International transfers

Some suppliers may process personal data outside the United Kingdom. Where UK data-protection law requires additional safeguards, we use an applicable adequacy decision or an approved transfer mechanism and assess supplementary protections where appropriate. You may ask for further information about safeguards relevant to your data.

7. How long we keep information

Retention depends on the type of information, the workspace agreement and settings, legal or regulatory requirements, the need to resolve disputes, and the period required for security, backup, and recovery. Account and workspace data is generally retained while the service is active and for a limited period afterwards. Enquiries are retained while they are being handled and for reasonable follow-up. Backups are removed through scheduled rotation.

When information is no longer required, it is deleted or anonymized. Some audit records may need to remain intact to preserve an attributable history or meet a workspace’s legal or regulatory obligations; where a deletion request cannot be fulfilled, we will explain why.

8. Security

We use technical and organizational measures appropriate to the service, including password hashing, role-based access, workspace-scoped records, request protection, upload validation, audit logging, and access-controlled storage. Access by support or operations personnel is limited to what is necessary for an authorized task. No internet service can eliminate every risk, and this policy does not promise absolute security.

Report suspected unauthorized access promptly to your group administrator and [email protected].

9. Cookies and service statistics

CellHood uses essential cookies or similar storage for sign-in, session security, and necessary preferences. We do not currently use third-party advertising cookies. Limited technical statistics—such as error events, response times, browser type, and aggregate feature use—may be used to improve security, reliability, and usability; they are designed not to include private scientific content.

10. Your data-protection rights

Depending on the circumstances and lawful basis, you may have rights to access, correct, erase, restrict, or receive your personal data, and to object to certain processing. These rights are not absolute. We may need to verify your identity and may involve the relevant workspace organization where it controls the information.

Your right to object: you may object to processing based on legitimate interests. You may also object at any time to direct marketing; CellHood does not currently use personal data for direct-marketing campaigns.

Send a request to [email protected]. We will respond within the period required by applicable law or explain if additional time or information is needed.

11. Complaints

Please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office or, where applicable, another supervisory authority.

12. Changes to this policy

We may update this policy when the service, suppliers, or legal requirements change. The latest version will be published here with a revised date. Material changes will be communicated through the service or to the relevant workspace administrators where appropriate.