Privacy Policy

1. Introduction

Biobase, Inc. ("Biobase," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information this website (biobase.ai) collects, how we use it, how long we keep it, and who processes it on our behalf. It covers the marketing website only; our platform product is governed by the agreements in place with each customer.

2. Information We Collect

Information you provide

We collect the information you choose to give us through this website:

• Data-request chat. On our "Request data" page you describe the clinical data or biospecimens you're looking for in a conversational intake. The conversation transcript and the structured request extracted from it are stored so our team can follow up. Please do not enter protected health information (PHI) in the chat.
• Contact, referral, and "monetize" forms. When you submit one of these forms we collect the details you enter, typically your name, email address, organization, and the message or asset details you provide.
• Sign-in email. To let you track a submitted request, we send a one-time sign-in link to the email address you enter.
• Marketing list. An email address you give us through any of the above may also be added to a list we use to send occasional company and product updates, not only to answer the specific request you sent. Every such email carries a one-click unsubscribe link, and unsubscribing stops the marketing email without affecting our reply to a request you have made.

Information collected automatically

• IP address for rate limiting. We use your IP address to enforce short-window rate limits that protect our forms and chat from abuse. These counters are transient and expire within minutes.
• Abandonment capture. If you have a substantive conversation in the data-request chat but leave before submitting your contact details, your browser sends us the partial transcript so our team can still understand the interest and, where possible, follow up. This happens without additional consent; if you do not want a partial transcript sent, do not begin the chat.
• Email opens and clicks. Marketing and campaign emails we send contain a small tracking image and rewritten links, so we can see whether a message was opened and which links in it were clicked, and tie that to the address it was sent to. This is on by default in the tools described in Section 4. It tells us that a specific recipient opened a specific email; it does not read anything else in your mailbox. Most email clients can block the tracking image — many now do so automatically — and unsubscribing stops both.
• Visitor identification. We use a third-party service (RB2B) that attempts to identify the person and organization behind a visit to this website. It sets cookies in your browser, collects your IP address and basic browser and page details, and matches them against third-party identity graphs and data providers. Those partners may associate your activity here with other personal information they or others already hold about you, including by association with your email address. Where a match is found, we receive a professional profile of you — typically name, employer, role, and a work email or professional-network profile — even if you never filled in a form, and we or providers acting for us may then send business communications to that email address.
• Where visitor identification does not run. We do not load the identification service at all, on any page, if either of the following is true. Where it is blocked, no identification cookie is set, no request is made to the service or its identity partners, and we receive nothing about you.
  • Your browser sends a Global Privacy Control signal. We check this ourselves rather than relying on the vendor to.
  • Your device indicates you are in the United Kingdom, the European Union or the wider European Economic Area. We use your device's time zone to determine this, which is an approximation and errs toward not tracking.
  Everywhere else, identification runs on every page of this website without additional consent. See Cookies and Tracking for how to opt out.
• Advertising measurement. Because we advertise on LinkedIn, we run LinkedIn's Insight Tag on most pages of this site. It records that a visit happened and reports it to LinkedIn, so we can see which campaigns lead to enquiries and can show follow-up ads to people who have been here. LinkedIn may recognize you as one of its members. It is blocked in the same two cases as the identification above — a Global Privacy Control signal, or a device indicating the UK,EU or EEA — and we do not run it on the sign-in-only request-tracking pages at all. SeeCookies and Tracking for detail and opt-outs.
• How you reached us. When you submit a request, we attach how your visit began — any campaign tags in the link you followed, and the website that linked you here, if any — so we know which of our own posts or pages led to it. This is stored with your request, not used to build a profile of you, and sent nowhere else.
• Recognizing you from an email we sent. If you reach this site by clicking a link in one of our outbound emails, that link may carry a random code that tells us which of our recipients it was sent to. The code is meaningless on its own — it is a random string, not your address in disguise — and only our own servers can match it back to the address we mailed. Your browser is never told who you are, and the code expires after 180 days.
  
  While that code is present, and only in the cases where the visitor identification described above is permitted, we also record which pages of this site you view during that visit, and we may be notified that you are browsing. If you then submit a request, the pages you viewed are attached to it. We use this to know which of our emails and pages lead to enquiries, and to give you a better-informed reply. It is not used for automated decision-making, and it is not shared with anyone outside the services in Section 4. If you would rather we did not do this, seeCookies and Tracking.

3. How We Use Your Information

• To respond to your request, inquiry, referral, or supplier interest
• To identify the people and organizations visiting this website and follow up with relevant business communications, which may include emailing a work address obtained through the visitor identification described in Section 2 rather than from you directly
• To measure which of our advertising campaigns lead to enquiries, and to show follow-up advertising to people who have visited this website
• To send marketing and campaign email — company and product updates, and outbound introductions — and to measure which messages were opened and which links were clicked, so we can tell what is worth sending
• To operate the request-tracking feature and authenticate sign-in links
• To protect the website against abuse (rate limiting and spam controls)
• To operate, maintain, and improve the website
• To comply with legal obligations

4. Subprocessors and Sharing

We do not sell your personal information. We share it with the service providers below that help us operate this website, and — through the visitor identification described in Section 2 — we also obtain personal information about you from third-party data sources:

• Microsoft Azure. Hosts the website and stores form and chat submissions (Azure Static Web Apps and Azure Cosmos DB). Transactional email (confirmations, notifications to our team, and sign-in links) is sent via Azure Communication Services.
• Anthropic. The data-request chat is powered by Anthropic's Claude model. The messages you send in that chat are processed by Anthropic to generate replies and extract your structured request.
• RB2B. Provides the visitor identification described in Section 2. Your IP address and browsing details on this site are sent to RB2B and its own upstream providers, which include an IP geolocation service and third-party identity graphs, in order to resolve a visit to a named individual and employer. Information RB2B holds about you is governed by RB2B's own privacy policy and retention practices, not ours.
• Resend. Sends our company and product update emails. Resend processes the recipient's email address and name, and records whether each message was opened and which links were clicked.
• Instantly. Sends our outbound introduction sequences to business contacts. Instantly processes the recipient's business contact details and the same open and click information, and is the platform behind the campaign-tagged links that bring people to this site.
• Cloudflare. Serves this website as our content-delivery network and security proxy, so requests to this site pass through Cloudflare's network. We also use Cloudflare Web Analytics to count page views and visits in aggregate, and Cloudflare Turnstile on our contact form to tell a person from an automated script — Turnstile receives technical signals from your browser for that check only, and we use it because the form was being abused. That service sets no cookies and does not identify individual visitors, build a profile of you, or follow you across sites.
• LinkedIn. We advertise on LinkedIn and run its Insight Tag on most pages of this site, described in Section 2. Your visit — the page, and the technical details that accompany any web request — is reported to LinkedIn so we can measure campaigns and build retargeting audiences. LinkedIn may match the visit to your member account, and what it does with that is governed by LinkedIn's own privacy policy, not ours. We have not enabled its "enhanced matching" feature, so we do not send LinkedIn email addresses or any other customer records.
• Legal and business transfers. We may disclose information when required by law or in connection with a merger, acquisition, or sale of assets.

5. Data Retention

We keep stored data requests (including chat transcripts and the structured intake) for up to 180 days, after which they are automatically deleted. One-time sign-in tokens expire after approximately 15 minutes. Rate-limiting counters expire within minutes. Emails sent to our team (for example, form submissions and abandonment notifications) are retained in our mailbox under our standard business email retention practices. We may keep information longer where required for legal or compliance reasons.

6. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or port your personal information, or to object to certain processing. To exercise any of these rights, email us athello@biobase.ai and we will respond in accordance with applicable law.

To stop marketing email, use the unsubscribe link in any message we have sent you, or email hello@biobase.ai and ask. Unsubscribing also stops the open and click tracking described in Section 2, because we stop sending you the emails that carry it. We will still reply to a request or message you send us — that is not marketing.

8. Cookies and Tracking

This website sets three kinds of cookies.

Functional. bb_session is an HTTP-only session cookie set only after you sign in with a one-time link, so the request-tracking page knows you are signed in.

Visitor identification. The RB2B service described in Section 2 sets its own cookies, including _reb2bloaded andrb2b_md5, and loads scripts from third-party identity providers. These are tracking cookies: their purpose is to recognize you and match you to an identity held by a third party.

Advertising. We advertise on LinkedIn, and we run LinkedIn's Insight Tag so we can tell which campaigns produce enquiries and show follow-up ads to people who have visited this site. It sets its own cookies — li_fat_id, li_gc and li_mcamong them — and reports your visit to LinkedIn, which may set further cookies of its own. LinkedIn can recognize you as one of its members. We do not run it on the sign-in-only request-tracking pages, and it is subject to the same exclusions as the visitor identification above: if you send a Global Privacy Control signal, or appear to be in the EU,UK or EEA, it does not load. We have not enabled LinkedIn's "enhanced matching", so we do not upload email addresses or other customer records to LinkedIn.

Recognition from our emails, without cookies. A link in one of our emails may carry a random recognition code (Section 2). We keep it, and the list of pages you view, in your browser's session storage — not in a cookie — under the names bb_c and bb_trail. Session storage is cleared when you close the tab, and is never sent to another site. Two ways to avoid it entirely: delete the ?c= part from the address before loading the page, or send a Global Privacy Control signal, which stops the page-by-page part along with the visitor identification above. Removing the code also stops us from connecting a request you submit to the email we sent you.

Analytics, without cookies. We use Cloudflare Web Analytics to count page views and visits. It sets no cookies and stores nothing on your device, and it does not identify you or track you between sites — it tells us how many people viewed a page, not who they were. It is separate from the visitor identification above, and it runs for everyone, including visitors who are excluded from that identification.

We do not display advertising on this website and we do not sell your personal information. We do advertise elsewhere, and we use the tracking described above both to identify business visitors for our own sales and marketing and to measure and target those ads. You should be aware that the identity and advertising partners involved operate in the advertising and identity-resolution industry, so your visit to this site is disclosed to them as part of the matching and measurement process.

How to opt out. You have several routes, and they do different things:

• Global Privacy Control. If your browser or an extension sends a GPC signal, we do not load the identification service at all. This is the simplest route and it requires nothing from us: turn it on and it applies here immediately, and on every other site that honours it. Some browsers include it; others need an extension. Seeglobalprivacycontrol.org.
• Opt out at the source. To stop this identification and the resulting marketing email across every site that uses this vendor, use the vendor's own opt-out atapp.retention.com/optout. This is operated by our vendor under its Retention.com brand.
• If you are in the EU or UK, you can additionally opt out of this collection under the GDPR atrb2b.com/rb2b-gdpr-opt-out.
• For the LinkedIn advertising tag specifically, LinkedIn members can turn off off-site ad tracking in LinkedIn's own settings, under Advertising data. A Global Privacy Control signal also stops the tag loading here, as above.
• Block it in your browser. Blocking third-party scripts and cookies, or using a tracker-blocking extension, prevents the identification and the advertising tag from running on this site.
• Ask us directly. Emailhello@biobase.ai and we will suppress and delete any profile we hold about you. This covers our own records; it does not remove you from the vendor's, so use the first link as well.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last updated" date above.

10. Contact Us

If you have any questions about this Privacy Policy or your data, contact us at:

Biobase, Inc.
Email: hello@biobase.ai