Privacy Policy

Tissue Biosciences ("Tissue Biosciences," "we," "us") is a Boston-based digital pathology CRO and computational pathology company. This policy explains what personal data we collect through this website and through the services we provide to our customers, why we collect it, and the rights available to the people it concerns.

Through this website, we collect the information you provide when you submit our contact form: name, email address, organization, the service you're inquiring about, your message, and optionally how you heard about us. We do not currently use cookies, analytics, or any tracking technology on this site.

Through our services, we may receive business contact information for personnel at the organizations we work with (names, titles, emails, phone numbers) in the course of scoping, delivering, and invoicing a project. We do not process personal data for our own purposes beyond what's needed to provide the service; we don't use it for unrelated marketing, and we don't sell it.

We may also receive sample-type and study metadata associated with non-clinical, research-use biological samples, such as tissue or species type and study classification. We do not receive clinical patient records, and we do not treat the specimens we work with as linked to an identifiable patient.

We use the information above to respond to inquiries, scope and deliver engagements, administer contracts and invoicing, and meet our own legal and contractual obligations. Where GDPR applies, our legal bases are performance of a contract, our legitimate interest in running the business and responding to inquiries, and compliance with legal obligations, as applicable.

Privacy and data protection responsibility sits with our CEO, who oversees compliance with applicable data privacy laws and regulations, including GDPR where relevant. We limit the collection and use of personal data to what's necessary for the business relationship, restrict access to personnel who need it to do their jobs, use access-controlled and encrypted systems for storage and transmission, and require any subcontractors or agents who handle personal data on our behalf to meet the same confidentiality and data protection obligations we do. We're prepared to formalize additional governance measures, such as a documented risk assessment process or a designated privacy point of contact, where a specific engagement requires it.

We don't sell personal data. We share it only with subcontractors, agents, and infrastructure providers who need it to help us deliver our services or operate this website, under contractual confidentiality and data protection obligations. Our infrastructure providers include Google Workspace and Netlify, both of which maintain independent security certifications (including ISO 27001 and SOC 2-aligned programs). A list of current subprocessors is available on request.

We apply access controls, encryption in transit and at rest, and role-based access limited to personnel with a legitimate need, consistent with the size and nature of our organization. Relevant personnel receive periodic training on their data privacy and information security obligations.

We retain personal data according to what you ask of us: tell us when to delete it or how long to keep it, and we'll follow that request. Absent a specific request, we retain personal data for as long as necessary to fulfill the purposes described in this policy, or as required by contractual or legal obligations. In no case do we hold personal data for longer than seven years.

Personal data we hold is maintained within the United States. We do not currently transfer personal data outside the United States. If a future engagement requires an international transfer, we will put appropriate safeguards in place, such as Standard Contractual Clauses and a Data Processing Agreement, before any transfer occurs.

Depending on where you're located, you may have the right to access, correct, delete, or restrict our use of your personal data, to object to certain processing, to receive a copy of your data in a portable format, and to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us using the details below.

We maintain an incident response process covering any incident involving personal data: identifying and internally reporting a suspected incident, containing it, assessing its scope and impact, notifying affected customers without undue delay, remediating the issue, and documenting the incident afterward. Subcontractors and agents with access to personal data on our behalf are contractually required to report suspected incidents to us immediately.

This website is not directed to children, and we do not knowingly collect personal data from anyone under 16.

We may update this policy from time to time. We'll post any changes here with a new effective date.

For questions about this policy or to exercise your rights, contact us at info@tissue-bio.com.