The short version
Each row answers one question in a sentence. The linked section has the detail, the legal basis and the exceptions.
| Question | Short answer | Detail |
|---|---|---|
| Who is responsible for my data? | Epitorix, [[GAP: legal entity, registered address]]. We are the controller for the website, the contact form and platform accounts. | Who we are |
| What do you collect on the website? | Only what you type into the contact form, plus cookieless aggregate analytics and the technical data any web host receives to deliver a page. | What we collect |
| What do you collect on the platform? | Account details [[GAP: fields]], how you use the platform, and the scientific inputs and outputs you create. | Scientific inputs and outputs |
| Do you use cookies? | The website sets none. The platform uses strictly necessary session cookies to keep you signed in [[GAP: platform session cookies]]. | Cookies |
| Do you sell my data or use it for advertising? | No. We do not sell or share personal information, and we run no advertising, profiling or cross-site tracking. | Who we share data with |
| Do you train models on my scientific data? | Not without your opt-in under a written agreement [[GAP: confirm]]. Your inputs and outputs are confidential to your account. | Scientific inputs and outputs |
| Who else sees my data? | Processors that run the service for us: Cloudflare, Formspark, Microsoft 365 and [[GAP: platform processors]]. Never buyers of data. | Who we share data with |
| Where is my data processed? | [[GAP: regions]]. Transfers out of the EEA, the UK or Switzerland rest on standard contractual clauses, an adequacy decision or a certified framework. | International transfers |
| How long do you keep it? | For as long as the purpose needs, then we delete or anonymize it. Each type of data has a period in the schedule. | How long we keep data |
| What are my rights? | Access, correction, deletion, restriction, portability, objection and complaint; for California residents, the rights to know, delete, correct and opt out. | Your rights |
| How do I reach you? | support@epitorix.com or the contact form. | How to contact us |
Who we are and our role
The controller responsible for personal data collected through epitorix.com and app.epitorix.com is [[GAP: legal entity name and form]], [[GAP: registered address]], [[GAP: company or registration number]] (“Epitorix”, “we”, “us”).
For the website, the contact form, business correspondence and platform accounts, we decide why and how personal data is used, so we are the controller. Where your organization uses the EPiQ platform under a written agreement and places personal data in its content, we process that data on its documented instructions as a processor, and the agreement (including its data-processing terms [[GAP: DPA template]]) governs.
What this policy covers
This policy applies to:
- the website at epitorix.com, including its contact form;
- the EPiQ platform at app.epitorix.com, including Xenoclea, its APIs and any documentation you sign in to;
- email, calls and meetings with us.
It does not cover third-party websites we link to, such as the RCSB Protein Data Bank; their own policies apply. Services delivered under a signed agreement (PharmPhax™ reports, PharmacoLaw, collaborations and platform agreements) are governed first by that agreement, and by this policy where the agreement is silent. Our terms of use cover ownership of generated molecules and the limits of AI predictions.
What we collect
When you use the contact form
First name, last name, email address, phone number (optional), your message, the page you sent it from, the topic you chose (if any) and the date and time. The form also contains a hidden field that only automated scripts fill in; if it is filled, the submission is discarded and nothing is sent.
The form is handled by Formspark, a form-processing service operated by Trampoline Software SRL (Belgium). When you press Send, your entries go straight from your browser to Formspark, together with the technical data every web request carries: your IP address, your browser’s identification, the referring page and its origin. Formspark uses them to filter automated submissions and to keep its service secure, and keeps the IP address and an approximate location derived from it for 12 months. Every submission is also screened for spam by Formspark’s automatic filter (OOPSpam), which scores it and discards its copy.
Formspark stores the submission in our form’s archive until we delete it (a deleted submission stays recoverable for 30 days) and emails it to our Microsoft 365 mailbox with your email address as the reply-to address. Nothing from your submission is stored on the website itself: there is no database and no log of its contents on our side. If the form cannot send, it offers to open a draft in your own mail program addressed to support@epitorix.com instead. Formspark’s own retention periods are in Who we share data with and How long we keep data.
When you visit the website
Cloudflare, which hosts the site, receives the technical data every web request carries: your IP address, browser and operating system, the page requested, the referring page, and the date and time. Cloudflare uses it to deliver the page and to protect the site from attacks. We do not receive or keep these server logs [[GAP: confirm that no Pages access logging is enabled]].
We measure how the website is used with cookieless analytics that cannot recognize you across visits (see Analytics).
When you hold an EPiQ account
Account details: [[GAP: fields — for example name, work email, organization, role, password or single sign-on identity, billing contact]]. Sign-in events and security logs [[GAP: retention and scope]]. How you use the platform — which modules you run, when, and how much compute they consume [[GAP: telemetry scope]]. Support requests you send us.
Scientific inputs and outputs
Targets, sequences, structures, constraints, uploaded files, your prompts to Xenoclea, and the designs, rankings, predictions and reports the platform returns. This content is usually not personal data. Do not upload patient-level or otherwise identifiable human data unless your agreement with us provides for it [[GAP: confirm platform rule]]. How we protect this content is set out in Scientific inputs and outputs.
When we correspond or do business with you
If you email us, meet us, or your organization signs an agreement with us, we keep the business contact details and correspondence the relationship needs: name, employer, title, email address, phone number and what we discussed.
What we do not collect
We do not collect special categories of personal data about you (such as health, genetic or biometric data), precise location, or data about children. We do not buy data about you, and we do not build advertising profiles.
Why we use it, and the legal bases
The GDPR and UK GDPR require a legal basis for every use of personal data. Ours are listed against each purpose. Where we rely on legitimate interests we have weighed them against your rights and expectations; you can ask for that assessment and you can object at any time (see Your rights).
| Purpose | Data | Legal basis |
|---|---|---|
| Answer your inquiry and follow it up | Contact-form fields, correspondence | Legitimate interests (art. 6(1)(f)): responding to people who write to us; steps you ask for before a contract (art. 6(1)(b)) |
| Provide the EPiQ platform and support you | Account details, usage, content, support requests | Contract (art. 6(1)(b)) with you or your organization; legitimate interests where your employer is the customer |
| Keep the website and platform secure and prevent abuse | Honeypot field; the IP address and browser identification Formspark screens submissions with; sign-in and security logs | Legitimate interests (art. 6(1)(f)): security, fraud and abuse prevention |
| Understand how the website is used | Aggregate, cookieless analytics | Legitimate interests (art. 6(1)(f)): running and improving a corporate website |
| Improve our models and products with your content | Scientific inputs and outputs | Only with your opt-in under a written agreement [[GAP: confirm]]: contract (art. 6(1)(b)) or consent (art. 6(1)(a)) |
| Send you product news | Email address | Consent (art. 6(1)(a)), withdrawable at any time. We send none today [[GAP: newsletter plans]]. |
| Comply with the law, answer lawful requests, establish or defend legal claims | Whatever the obligation or claim requires | Legal obligation (art. 6(1)(c)); legitimate interests (art. 6(1)(f)) |
| Reorganize, finance or sell the business | Business records | Legitimate interests (art. 6(1)(f)), under confidentiality |
We do not use personal data for a new purpose that is incompatible with the one it was collected for without telling you first and, where the law requires it, asking for your consent.
Scientific inputs and outputs
Confidential to your account. Your inputs and outputs are visible to you and to the people in your organization you share them with. Epitorix staff access them only when needed to run, support or secure the platform, and only under confidentiality obligations [[GAP: access policy and logging]].
No training on your data. We do not use customer inputs or outputs to train or fine-tune models made available to other customers unless you opt in under a written agreement [[GAP: confirm]]. Aggregate statistics that cannot identify you, your organization or your molecules — for example how many jobs ran in a month — may be used to operate and improve the platform.
Third-party models. Xenoclea and some EPiQ workflows call models operated by third-party providers [[GAP: providers]]. We send them only what the task needs, under contracts that prohibit training on your data and require deletion after processing [[GAP: confirm no-training and retention terms]].
Ownership. As between Epitorix and the user, the user retains rights to the molecular outputs generated through their authorized EPiQ account, subject to the applicable platform agreement. Epitorix does not claim ownership of a user’s generated outputs solely because they were created using the platform. See the terms of use.
Retention and deletion. Content stays in your workspace until you delete it [[GAP: confirm self-service deletion]]. After an account closes, content is deleted within [[GAP: period]], except where an agreement or the law requires us to keep it longer.
Analytics
We measure how this website is used with Cloudflare Web Analytics, a cookieless service operated by Cloudflare, Inc. It counts page views, the site a visit came from, the country of the visit, browser and device type, and how fast our pages load. It does not set cookies, does not use local storage, does not build a profile of you, and does not follow you across websites or over time. Your IP address is processed by Cloudflare to deliver the page and to derive the country of the visit; it is not stored by us and we cannot see it.
Because nothing is stored on or read from your device, we do not show a consent banner. Our legal basis is our legitimate interest in understanding and improving this website (Article 6(1)(f) GDPR). Cloudflare processes this data on our behalf under its data processing addendum, keeps the unsampled records for seven days and the aggregated statistics for six months.
You can object at any time and for free: block the script at static.cloudflareinsights.com with a content blocker [[GAP: state here whether the site honors Global Privacy Control or Do Not Track by not loading the script]]. The website works exactly the same without it. The platform at app.epitorix.com [[GAP: platform analytics, if any]].
Cookies and similar technologies
epitorix.com sets no cookies and stores nothing in your browser — not for analytics, not for advertising, and not for the contact form. No Formspark script runs on our pages: the form only sends your entries to Formspark when you press Send, and that request sets no cookie.
app.epitorix.com uses strictly necessary cookies to keep you signed in and to protect your session [[GAP: cookie names, purpose, lifetime, and whether an authentication provider sets them]]. They are not used to track you and the platform sets no advertising or analytics cookies [[GAP: confirm]].
You can block or delete cookies in your browser settings. The website will work exactly the same; the platform will sign you out.
Who we share data with
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal data to four kinds of recipients.
Processors and sub-processors
Companies that host and run the service for us, on our written instructions, under contracts that meet Article 28 GDPR. They may use the data only to provide their service to us.
| Processor | What it does for us | Data | Location and transfer basis |
|---|---|---|---|
| Cloudflare, Inc. | Hosts the website (Pages) and its security-report sink (Workers); cookieless web analytics | Request data and IP address while a page is delivered; aggregate analytics | United States, with a worldwide network. Cloudflare customer data processing addendum with standard contractual clauses; EU-U.S. Data Privacy Framework participant [[GAP: confirm current certification]] |
| Formspark (Trampoline Software SRL, Mazy, Belgium) | Receives contact-form submissions, screens them for spam, keeps them in our form archive and emails them to our mailbox | Form fields, the page and topic you wrote from, your IP address and an approximate location derived from it, browser identification, referring page | Belgium; submissions stored in Ireland and Germany (EEA) on Amazon Web Services and Hetzner. Spam scoring by OOPSpam in the United States, where the copy is scored and discarded; Formspark publishes no transfer safeguard for that vendor. Formspark’s data processing agreement and subprocessor list apply; its privacy policy describes its own retention |
| Microsoft (Microsoft 365) | Company mailboxes where contact-form messages and correspondence are received and kept | Message contents, sender details | [[GAP: tenant region]]. Microsoft Products and Services data protection addendum with standard contractual clauses; EU-U.S. Data Privacy Framework participant |
| Platform hosting [[GAP: provider]] | Runs app.epitorix.com and stores platform content | Account details, usage, scientific inputs and outputs | [[GAP: region and transfer basis]] |
| Authentication provider [[GAP: provider]] | Sign-in, sessions and single sign-on | Email address, credentials or identity-provider token, sign-in events | [[GAP: region and transfer basis]] |
| Third-party AI model providers [[GAP: names]] | Run some Xenoclea and EPiQ steps | Prompts and the minimum content the task needs | [[GAP: regions]]; no training on your data and deletion after processing [[GAP: confirm]] |
| Others [[GAP: payments, support desk, error monitoring, platform email]] | [[GAP: purpose]] | [[GAP: data]] | [[GAP: region and transfer basis]] |
Your organization
If your employer or institution holds the platform agreement, its administrators can see who holds accounts under it and how the platform is used.
Advisers and authorities
Lawyers, accountants, auditors and insurers under professional confidentiality. Courts, regulators and law enforcement where the law requires or permits it; we review every request and challenge those we consider unlawful or excessive.
A change of ownership
If Epitorix is involved in a merger, acquisition, financing or sale of assets, personal data may be transferred to the counterparty under confidentiality, and this policy continues to apply to it.
International transfers
Epitorix operates from [[GAP: country of establishment]], and our processors run in the United States and elsewhere. When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on one of the following:
- the European Commission’s standard contractual clauses (Decision (EU) 2021/914), with a transfer risk assessment;
- the UK International Data Transfer Agreement, or the UK Addendum to the EU clauses;
- the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, for recipients that are certified;
- an adequacy decision, such as the European Commission’s renewed decision for the United Kingdom of December 2025.
You can ask us for a copy of the safeguards that apply to your data (see How to contact us).
How long we keep data
We keep personal data only as long as the purpose needs it. When a period ends we delete the data or anonymize it so that it no longer identifies you. Backups roll off within [[GAP: backup window]].
| Data | Kept for | Why |
|---|---|---|
| Contact-form messages (email in our mailbox) | [[GAP: period, for example 24 months after the last exchange]], then deleted | To answer you and keep a record of the conversation |
| Contact-form submissions in Formspark’s archive | Until we delete them; a deleted submission stays recoverable for 30 days | Delivering the message and recovering one that was filtered or mis-filed |
| Your IP address and approximate location at Formspark | 12 months (Formspark’s policy) | Filtering automated submissions and securing the form service |
| Website analytics (Cloudflare Web Analytics) | Unsampled records seven days; aggregated statistics six months | Understanding how the site is used |
| Web server logs (Cloudflare) | [[GAP: Cloudflare’s retention for Pages request logs]] | Delivering the site and defending it from attacks |
| Platform account details | Life of the account, then [[GAP: period]] after closure unless the law requires longer | Providing the service; accounting and legal obligations |
| Scientific inputs and outputs | Until you delete them; [[GAP: period]] after account closure | Providing the service; your ownership of the outputs |
| Platform sign-in and security logs | [[GAP: period, for example 12 months]] | Security and incident investigation |
| Business correspondence and contracts | The relationship, then [[GAP: statutory limitation period]] | Legal obligations and claims |
| Requests to exercise your rights | 24 months | Proving how we handled the request (required by California regulations) |
Your rights and how to use them
If you are in the EEA, the UK or Switzerland
You have the right to:
- access the personal data we hold about you and receive a copy (Article 15);
- have inaccurate data corrected and incomplete data completed (Article 16);
- have your data erased where there is no longer a good reason to keep it (Article 17);
- restrict how we use it while a dispute or check is resolved (Article 18);
- receive the data you gave us in a machine-readable format and have it moved to another provider where technically feasible (Article 20);
- object to processing based on legitimate interests, and to direct marketing at any time (Article 21);
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Article 22) — we make no such decisions;
- withdraw consent at any time, without affecting what was done before (Article 7(3));
- complain to a supervisory authority: the data protection authority of the EU country where you live or work, or where you believe the problem occurred; in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner. Our lead authority is [[GAP: lead supervisory authority]].
You can also complain to us directly if you believe we have infringed data protection law. We will acknowledge your complaint within 30 days, look into it, keep you informed and tell you the outcome.
If you are a California resident
Under the California Consumer Privacy Act you have the right to know what personal information we collect, use and disclose, and to access it; to delete it; to correct it; to opt out of the sale or sharing of your personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising any of these rights. We do not sell or share personal information, so there is nothing to opt out of and we do not offer a “Do Not Sell or Share” link; we treat a Global Privacy Control signal from your browser as a valid opt-out request in any case. We do not use or disclose sensitive personal information for purposes that would trigger the right to limit, and we offer no financial incentives for personal information.
In the last twelve months we collected these categories of personal information, from you, your device or browser, and your employer where it holds our agreement: identifiers (name, email address, phone number, and the IP address of a contact-form submission, held by Formspark); customer records (business contact details); professional information (employer, title); internet activity (aggregate page views); coarse geolocation (country, derived by Cloudflare; an approximate location Formspark derives from the IP address of a contact-form submission); and, for platform accounts, account credentials [[GAP: confirm categories for platform accounts]]. We drew no inferences and collected no other sensitive personal information. Purposes are in Why we use it; the processors that received this information for a business purpose are in Who we share data with; retention periods are in How long we keep data. We do not disclose personal information to third parties for their own direct marketing (Civil Code section 1798.83).
If you live in another US state
State privacy laws (for example in Colorado, Connecticut, Texas and Virginia) give you similar rights of access, correction, deletion and portability, and the right to opt out of targeted advertising, sale of personal data and profiling in furtherance of significant decisions. We do none of those three. If we decline a request, you may appeal within the time your state allows by replying to our decision; we will answer within the statutory period and tell you how to contact your state Attorney General if you disagree.
How to make a request
Email support@epitorix.com or use the contact form; account holders can also [[GAP: in-app settings or support channel]]. Tell us what you want and how to reach you. Requests are free unless they are clearly unfounded or excessive. We reply within one month under the GDPR and within 45 days under the CCPA; where the law allows an extension we will tell you why and how long.
To protect your data we verify requests: for account holders, by asking you to sign in or to write from the account email address; for everyone else, by matching the details in your request against what we hold, and asking for more only where necessary. An authorized agent must show your signed permission or power of attorney. If we decline a request we say why; you can ask us to reconsider — the review is done by someone not involved in the first decision [[GAP: confirm]] — and you can complain to your supervisory authority or Attorney General at any time.
Children
Our website and platform are for professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Security
Every connection to the website and the platform is encrypted in transit (TLS), and our hosting providers encrypt stored data at rest. Access to personal data is limited to the people who need it for their work, protected by [[GAP: multi-factor authentication or single sign-on]] and logged. The website itself holds no personal data: the contact form hands each message to Formspark over an encrypted connection, and nothing you type is stored or logged on our side. Our processors are bound by contract to security measures appropriate to the risk.
No system is perfectly secure. If a personal-data breach is likely to put you at risk, we will tell you and the competent authority without undue delay and, where the GDPR applies, notify the authority within 72 hours of becoming aware (Articles 33 and 34).
Automated decisions and AI
We do not make decisions about you by solely automated means that have legal or similarly significant effects. Epitorix AI models predict properties of molecules — binding affinity, off-target interactions, biodistribution, organ and cell-type risk — not anything about people. PharmPhax reports combine model output with expert human review.
Epitorix is a research and development platform. Its predictions are not intended for patient-level or clinical decision-making.
Changes to this policy
We post changes here and update the date at the top of the page. For a change that materially affects account holders — a new purpose, a new category of data, or a new processor with access to platform content — we give notice in the platform or by email before it takes effect [[GAP: notice period]]. Earlier versions are available on request.
How to contact us
- Privacy questions and requests
- support@epitorix.com · the contact form · by post to [[GAP: postal address]]
- Data protection officer
- [[GAP: whether a DPO is appointed (Article 37); name and contact if so]]
- Representative in the European Union (Article 27 GDPR)
- [[GAP: EU representative, if Epitorix is not established in the EU]]
- Representative in the United Kingdom (Article 27 UK GDPR)
- [[GAP: UK representative, if Epitorix is not established in the UK]]
We answer privacy questions within [[GAP: service level, for example five working days]], and complaints as described in Your rights.