Privacy Notice

This Privacy Notice explains how EFEVRE TECH LTD ("EFEVRE TECH," "we," "us," or "our") collects, processes, and protects personal data through the BioSkepsis biomedical literature platform, accessible via bioskepsis.ai, app.bioskepsis.ai, related APIs, SDKs, plug-ins, and applications (collectively, the "Service"). It is issued under the General Data Protection Regulation (EU) 2016/679 (GDPR), the ePrivacy Directive 2002/58/EC, and Cyprus Law 125(I)/2018.

1. Data Controller and Contact

For all personal data processed through the Service, including account data, queries, uploaded documents, model outputs returned to you, billing information, and support correspondence, EFEVRE TECH LTD acts as the data controller within the meaning of Article 4(7) GDPR.

EFEVRE TECH LTD only acts as a data processor on your behalf where we have entered into a separate written Data Processing Agreement (e.g., for enterprise or institutional customers who upload personal data of their own data subjects). Absent a signed DPA, our default role is controller.

EFEVRE TECH LTD
Limited liability company incorporated in the Republic of Cyprus
Cyprus company registration no.: HE 384880
Registered office: 104 Kykliki Leoforos Street, 6056 Larnaca, Cyprus
Email: [email protected]

We have not appointed a Data Protection Officer because our processing does not meet the thresholds in Article 37(1) GDPR. Privacy enquiries should be sent to the email above. As an EU-established controller, we are not required to designate an Article 27 representative.

You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection (Cyprus): www.dataprotection.gov.cy · [email protected], or with the supervisory authority in your EU/EEA Member State of residence.

2. Categories of Data We Process

• Account information: name, email, organisation/affiliation, hashed credentials (managed by Clerk).
• Usage and device data: IP address, user-agent, browser type, device class, timestamps, page views, referrer, and basic technical logs.
• Search and query data: prompts, search terms, filters, uploaded documents, and the AI outputs returned to you. Stored under your account so you can revisit your history.
• Billing data: subscription tier, billing email, transaction identifiers, country, VAT details where applicable. Card and bank data are handled directly by Stripe; we do not store full card numbers.
• Research-interest indicators: topic, entity, methodology, assay, biomarker, target, and therapeutic-area signals derived from your queries and saved papers. These are used to operate and personalise the Service and, only as described in §4, in Commercial Data Products.
• Support correspondence: the content of any messages you send us.
• Cookie and consent data: your cookie-consent choice and the resulting analytics/ad-measurement signals: see the Cookie Policy.

We do not request and do not knowingly collect special categories of personal data under Article 9 GDPR (e.g., health, biometric, or genetic data identifying a living individual). Do not upload such data unless you have a clear legal basis and a compelling need. If you do, you are solely responsible for that processing.

3. Purposes and Legal Bases

4. Model Training, Data Disclosure, and Commercial Data Products

4.1 No model training by us. EFEVRE TECH LTD does not use your prompts, uploaded documents, AI outputs, or any other user-provided content to train, fine-tune, or evaluate any machine-learning model of ours, and we do not supply that content to anyone else for model development. The AI providers that generate your answers make their own commitments about the content we send them, and we set out what each of them actually states in §5.

4.2 Baseline on disclosure. Except in the two cases described in §4.3 and §4.4, we do not sell, license, or otherwise disclose your identifiable content for marketing, profiling, or AI-development purposes. We never disclose your raw prompts, queries, or uploaded documents to any Recipient.

4.3 Anonymised, aggregated insight products. We may process, license, and sell anonymised, aggregated statistical data derived from use of the Service, such as thematic research-interest trends, topic- and entity-frequency indicators, methodology and assay interest, biomarker and target signals, and therapeutic-area demand signals. Recipients may include pharmaceutical, biotechnology, diagnostics, genomics, life-science technology, and research organisations and their agents.

Anonymised, aggregated metrics that cannot reasonably be re-identified (e.g., feature usage rates, latency distributions) are also used to improve the Service.

Anonymisation methodology. Data released under §4.3 is irreversibly anonymised and aggregated so that no individual is reasonably identifiable by any means reasonably likely to be used, whether alone or in combination with other data available to the Recipient. Before any release we run a documented re-identification assessment covering small cohorts, rare or unique query combinations, and free-text that could reveal an individual, and we suppress, generalise, or aggregate further (for example by applying minimum-cohort thresholds) where residual risk exists. Outputs are screened so they do not reveal special-category or sensitive data about any individual, including a user researching their own health condition. Only derived, aggregated indicators are released. Because data meeting this standard is not personal data, this processing does not rely on your consent; the act of anonymising is carried out under our legitimate interests (Art. 6(1)(f)). Every release is made under a written agreement prohibiting re-identification and restricting onward use to the agreed purpose.

4.4 Professional directories (opt-in only). Only if you give prior, specific, freely given, informed and unambiguous opt-in consent, we may include your professional profile in directories or datasets that we license or sell to life-science organisations for professional-engagement purposes.

• Categories of data disclosed: your name, professional email, institutional affiliation, and research-interest indicators derived from your use of the Service. Never your raw prompts, queries, or uploaded documents.
• Categories of Recipients: pharmaceutical, biotechnology, diagnostics, genomics, life-science technology, and research organisations, and agents acting on their behalf.
• Purposes: identification of subject-matter experts, advisory engagement, research collaboration, and scientific exchange.
• Controller-to-controller status: each Recipient acts as an independent data controller for its own use of the data. It is responsible for giving you its own transparency information and for honouring your rights against it. We disclose only under a written agreement requiring compliance with applicable data-protection law, no re-identification, and no unauthorised onward sale.
• Consent is optional and unbundled: your access to the Service, its price, and its functionality do not depend on whether you grant it. When we ask for it, we will do so separately from your acceptance of the Terms, with equal prominence given to "yes" and "no". We are not asking for it today: there is no opt-in control in the Service yet, so no profile is included and nothing is released under this section until that control exists and you have used it.
• Withdrawal: you may withdraw at any time and without detriment by emailing [email protected]. Withdrawal takes effect promptly and removes you from all future releases. It cannot recall data already disclosed to a Recipient, but we will notify Recipients of your withdrawal and require them to cease further processing where the law requires.
• Retention: we include your profile only while your consent remains active. On withdrawal, deletion of your account, or deletion of the underlying data, you are excluded from the next and all subsequent releases. Each Recipient sets its own retention period as an independent controller, and is contractually required to disclose that period to you.
• Sensitive data excluded: we do not knowingly include data revealing your own health condition or other special-category data (Art. 9 GDPR) or "sensitive personal information" under US law. Where such data is detected in free-text it is excluded before disclosure.

4.5 United States: notice of sale and share, and how to opt out. For the purposes of US state privacy laws, our disclosures under §4.4 may constitute a "sale" or "share" of personal information. Inclusion under §4.4 happens only where you have opted in, so if you have not opted in, nothing about you is released. You can decline, or withdraw an opt-in you have already given, at any time by emailing [email protected]. We also honour recognised opt-out preference signals, including Global Privacy Control (GPC): where your browser sends that signal, we treat it as an opt-out and the analytics and ad-measurement cookies described in the Cookie Policy are kept switched off. We do not sell or share the personal information of a consumer we know to be under 16 without opt-in consent, and we provide the right to limit the use of sensitive personal information where applicable. Disclosures under §4.3 involve anonymous data only and are therefore not a sale or share of personal information.

4.6 These products are forward-looking. Content collected before the effective date of this Notice, under our previous commitment not to disclose it, is not included in any Commercial Data Product. Only data collected after you have been given notice and, where §4.4 applies, have given consent, is eligible for inclusion.

5. Sub-Processors and Recipients

We use the following sub-processors. Each may receive limited categories of personal data strictly necessary for the function described. Written data processing terms that meet Article 28 GDPR are not yet in place with all of them, and we are putting them in place: we have no such agreement with Z.AI today, and for the other providers we have not yet confirmed a signed or accepted copy of their data processing terms.

AI providers. Generating an answer sends your question, the papers in the thread and any file you attach to the AI provider that serves your plan, so that provider receives the most sensitive category of content we handle. Today that provider is Z.AI, which serves the Basic, Plus, Pro and Team plans. Z.AI is operated by JINGSHENG HENGXING TECHNOLOGY PTE. LTD, registered in Singapore, and Z.AI states that customer data is generally processed in Singapore. Its data processing addendum for API services states that it does not store the content you provide or generate: the content is processed in real time and is not saved on its servers. Z.AI's published policy does not state whether it uses API content to train models, and we are seeking that commitment in writing.

Google Gemini, served through Google Cloud (Vertex AI), is a route we may use for the Organization tier in future. It is not part of the default path today: no user content is sent to Google for AI inference on any current plan. We will name the provider that serves your plan here whenever it changes, and Organization customers will receive advance notice of a change of AI provider under their contract.

Where the Location column reads "Confirming", we are verifying the provider's processing region and will state it here once we have it, rather than publish a location we cannot stand behind.

Recipients are not sub-processors. The life-science organisations that receive data under §4.4 are not sub-processors acting on our instructions. They are independent data controllers, and the Article 28 framework above does not apply to them. Their receipt of your data is governed by your consent under §4.4 and by a written controller-to-controller agreement. A current list of the categories of Recipients is maintained in §4.4, and we will update it as those categories change.

We may also disclose personal data where required by law, court order, or other lawful request from a competent authority.

6. International Transfers

Your account records, conversations and sources are held on our own dedicated server inside the European Economic Area. Two kinds of processing take place outside it. The first, and the largest flow of user content leaving the EEA, is AI inference: your question, the papers in the thread and any file you attach go to Z.AI in Singapore (§5). The second covers sign-in, payments, email delivery, error monitoring and content delivery, whose providers are established in the United States or operate global networks (§5).

We have not yet put a transfer mechanism recognised under Articles 45 to 49 GDPR in place for these transfers, and we are putting one in place for each provider. No Standard Contractual Clauses have been signed with any provider to date. There is no adequacy decision for Singapore, so the transfer to Z.AI has no transfer mechanism today. We will update this section as each arrangement is signed. We protect these transfers with encryption in transit, data minimisation and access controls. We do not encrypt data at rest today, so that measure is not among them; see §12.

7. Cookies and Analytics

What the Google tag does depends on where you are and which of our sites you are on. This section describes exactly what the code does.

• On bioskepsis.ai in the EEA, the UK and Switzerland: analytics and ad-measurement storage are denied by default under Google Consent Mode v2, so no analytics or advertising cookie is set until you grant consent in the cookie banner. The Google tag itself is still loaded on your first visit and, until you choose, sends Google measurement requests that carry no cookie and no identifier. If you choose "Reject all", the refusal is stored and the tag is not loaded on later visits at all.
• On bioskepsis.ai outside those regions: analytics and ad-measurement storage are granted by default. The Google Analytics and Google Ads cookies are set when the page loads, before you have answered the banner. Refusing in the banner stops them being used and stops them being set again on later visits; a cookie set before your refusal stays on your device until it expires or you delete it in your browser settings.
• In the app at app.bioskepsis.ai: analytics and ad measurement are off by default wherever you are, and the Google tag is not loaded until you grant consent in the cookie panel.

The banner appears on your first visit, and you can reopen it at any time from the "Cookie settings" link in the footer of any page, turn each category on or off, and save. Your choice is stored on the device you make it on for up to 12 months, after which we ask again. bioskepsis.ai and the app keep separate records, so make your choice on each, and repeat it on any other device or browser you use.

There is no ad personalisation anywhere. Where ad measurement is on, the only advertising cookies we set measure conversions from our own campaigns; ad personalisation stays denied whatever you choose, we do not use behavioural advertising cookies, and we do not build advertising profiles. Where your browser sends a recognised opt-out preference signal, including Global Privacy Control (GPC), we treat it as a refusal in every region: the Google tag is not loaded and both analytics and ad measurement stay off without you having to set anything yourself.

The Cookie Policy lists each category, its legal basis, and how long it lasts.

8. Data Retention

• Account data: retained for the lifetime of your account. After deletion, a copy can remain in a database backup until that backup ages out, which happens within a week.
• Search history, prompts, uploaded documents, and AI outputs: retained while your account is active so you can revisit them. After account deletion (or an earlier deletion request) a copy can remain in a database backup until that backup ages out, which happens within a week. You may delete individual items at any time from in-app controls.
• Operational and security logs: kept for a limited period for troubleshooting, abuse prevention, and service reliability, then rotated. We are confirming the exact rotation period and will publish it here rather than quote a figure we have not verified.
• Billing and tax records: retained for the period required by Cyprus tax and accounting law (currently 7 years).
• Cookie-consent record: retained on your device for up to 12 months so we can respect your choice between visits.
• Anonymised, aggregated data: may be retained and licensed indefinitely as it no longer identifies you (see §4.3).
• Professional-directory inclusion (§4.4): your profile is included only while your opt-in consent remains active. Withdrawal, account deletion, or deletion of the underlying data excludes you from the next and all subsequent releases. Data already released to a Recipient is retained by that Recipient under its own retention policy as an independent controller.
• Consent records: the record of your §4.4 consent or withdrawal, including its timestamp and the version of the Terms in force, is retained for the duration of your account plus 6 years, so that we can demonstrate the lawfulness of processing under Article 7(1) GDPR.

9. Your Rights

Under Articles 15 to 22 GDPR you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure ("right to be forgotten") subject to legal-retention exceptions;
• restrict processing in certain circumstances;
• receive your data in a portable, machine-readable format;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with a supervisory authority (see §1).

To exercise any of these rights, email [email protected]. We will respond within one (1) month of verifying your identity, extendable by up to two months for complex or numerous requests as permitted by Article 12(3) GDPR.

Commercial Data Products. In addition to the rights above, you may at any time withdraw your §4.4 consent, or object to that processing, by emailing us. We treat a request to be removed from our data products as covering all future releases, and we notify Recipients of your withdrawal so they can cease further processing where the law requires.

If you are a US resident. Depending on your state, you may also have the right to opt out of the sale or sharing of your personal information and of targeted advertising, to limit the use of sensitive personal information, to access, correct, and delete your personal information, to appeal a refused request, and not to be discriminated against for exercising any of these rights. To exercise any of them, email [email protected]. Cookie choices are made in the cookie banner, which you can reopen at any time from the "Cookie settings" link in the footer of any page. We also honour recognised opt-out preference signals including Global Privacy Control (GPC): where your browser sends that signal, analytics and ad-measurement cookies are kept switched off.

10. Automated Decision-Making (Article 22 GDPR)

BioSkepsis uses generative-AI models to produce literature summaries, citations, and answers in response to your queries. These outputs are informational and decision-support tools intended to be reviewed by you, and each one is marked as AI-generated: This answer was generated by an AI system. Check the cited sources before relying on it. We do not make any decision that produces legal effects or similarly significant effects concerning you (such as credit, employment, healthcare, insurance, or access to essential services) based solely on automated processing within the meaning of Article 22(1) GDPR.

11. Personal Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Cyprus supervisory authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk, we will notify affected data subjects without undue delay, in accordance with Article 34 GDPR.

12. Security

We implement technical and organisational measures appropriate to the risk. In place today: encryption in transit (TLS 1.2 or newer, HTTP Strict Transport Security, and a Content Security Policy), role-based access controls that keep one account's content out of another account's reach, and a route for reporting security problems: email [email protected] with "Security" at the start of the subject line. Our disclosure policy is published at bioskepsis.ai/security-policy and in /.well-known/security.txt.

Two measures are not in place today. Encryption at rest is not configured, either on the server or on our database backups, and we do not keep an audit log of who read or exported what. Both are planned work rather than commitments: encryption at rest depends on a hosting decision we have not yet taken, so we are not naming a date or a particular approach here. We will update this section when either measure is live, rather than describe a control before it exists.

No system is perfectly secure, and you remain responsible for the confidentiality of your credentials.

13. Social Logins (Clerk / Google)

Authentication is provided by Clerk, which supports email/password and social login (e.g., Google). If you sign in with a social provider, we receive basic profile data (such as email, name, and avatar URL) from that provider. We never receive your social-account password. Your use of the social provider remains subject to that provider's own terms and privacy policy.

14. Account Management and Deletion

You can view and update your account details from in-app account settings (managed by Clerk). To delete your account, use the in-app delete control where available or email [email protected]. Following a verified deletion request, we will erase your account from active systems within 30 days. Any copy held in a database backup is removed as that backup ages out, which happens within a week of the erasure, except where retention is legally required (see §8).

15. Children's Privacy

The Service is intended for professional and academic use by persons aged 18 or older. We do not knowingly collect personal data from children. If you are a parent or guardian and believe a child has provided personal data, contact [email protected] and we will delete the account and associated data without undue delay.

16. Third-Party Websites

The Service may contain links to third-party websites and resources (for example, publisher pages, PubMed records, or Semantic Scholar). Their privacy practices are not covered by this Notice. Please review the applicable third-party privacy policies before sharing personal data with them.

17. Updates to This Notice

We may update this Privacy Notice to reflect legal, technical, or operational changes. The "Last Updated" date above will always reflect the most recent revision. Material changes will be communicated through the Service or by email where appropriate. Continued use of the Service after the effective date of an update constitutes acceptance of the revised Notice.

18. Contact

Questions or requests should be directed to: [email protected].