Privacy Policy.

DRAFT FOR LAWYER REVIEW. NOT FINAL LEGAL TEXT. Draft 2 of 2026-10-14. This page describes in plain language what the Design Engine collects and does with data, as the software works today. It has not been reviewed by a lawyer and must not be relied on. Items in [LAWYER: ...] brackets need a lawyer; [DECISION: ...] items are undecided choices; [TO CONFIRM] marks a fact about a third party we must check. Nothing here claims compliance with any law. The version users accept is recorded with the date (setting PRIVACY_VERSION; currently draft-0).

1. Who is responsible

Regelife Inc. ("Regelife", "we"), Boulder, Colorado, runs the Design Engine and decides how your data is used. [DECISION: P01. Who is responsible for the data (controller), their address, a privacy contact address, and whether a data protection officer or an EU/UK representative is needed. Not decided.] [LAWYER: P03. Which laws apply and the legal basis for each use of data (contract, legitimate interest, consent). The page gives a plain-language list of purposes only. Users are expected in the United States and Japan; clinical use may follow.]

2. In short

• We keep your sign-in details and profile separate from what you type in the chat. Chats are filed under a random identifier, not your name or email.
• Your chats are stored so you can reopen them and so we can run and improve the service. You can delete any chat, or your whole account, yourself.
• Using your chats to improve the service is a separate, optional choice that you can switch off at any time.
• We never see or store your card number. Stripe handles payments.
• We do not sell personal information. [LAWYER: P13. Statement that we do not sell personal information or share it for advertising. True for the code as written (no advertising integrations); confirm before publishing.]
• Please do not type patient information or other people's personal data.

3. What we collect

Waitlist form

Name, email, institution, role, a short description of what you want to design biomaterials for, and optionally a cell system (for example MSC, iPSC, organoid). We use it to decide who to admit and to contact you. A confirmation email is sent to the address you enter.

Your account

Sign-in is handled by Firebase Authentication (Google). If you use email, Firebase stores your email and a protected form of your password, which we never see; if you use Google sign-in, Google gives us your email address and display name. We keep a user record with your email, name, the profile fields from your waitlist entry (institution, role, cell system, use description), whether you are admitted, when the account was created, and your consent and subscription records.

Consent records

When you accept the Terms and Privacy Policy we store the version of each, the time, and your separate answer about the improvement permission with its time and the Terms version. Every change (accepted, permission granted, permission switched off) is added to a history you can see on the account page.

Conversations

The messages you type, the assistant's replies, the design parameters extracted from the conversation, which studies and conditions were recommended (stored as identifiers), a title (the start of your first message, which you can rename), the model name and version, the version of our database and prompts, token counts and response time. If you rate a reply we store the thumb, an optional comment of up to 500 characters, and whether you used the design. All of this is filed under a random content identifier. The conversation records contain no email, name, account id, IP address or browser details. The link between you and the identifier is kept in your user record. [DECISION: P15. Who at Regelife can read stored conversations and under what rule. The design separates identity from content, but anyone with database access can link them through the user record. Name the people or roles and the policy (for example: only to fix a reported problem, with the audit log).]

Subscription

Stripe's customer identifier, subscription status and dates (free period end, renewal, cancellation), the invitation code you used and when. Stripe collects and keeps your card and billing address; we never store them. Occasionally we ask Stripe for the last four digits of your card at the moment we send a reminder email so the email can show them; we do not keep them. A log records each Stripe event we processed (identifier, type, time, outcome) without personal or card data.

Usage counts

To enforce limits and control cost we count messages and model usage (tokens) per person per day and across all users. These counters are keyed by a one-way hash of your account id (or IP address for the waitlist) and are meant to expire after a few days. We also report aggregate numbers (sign-ups by role and institution type, active seats, cancellations, conversions), described in section 4. [LAWYER: P18. Aggregate reporting. Regelife reports aggregate numbers (sign-ups by role and institution type, active seats, cancellations, conversion) to itself and investors. Confirm that this use needs disclosure or any consent.]

Emails we send

All our emails are transactional (account, billing, reminders). A send log records which email went for which purpose and period, using a hashed key, with no address or name. [LAWYER: P14. Email policy: all emails are transactional (account, billing, reminders); there is no marketing and no unsubscribe link by design. Confirm that is acceptable, and what consent any future marketing needs.]

Security and operational logs

Our software writes logs that identify an account only by its internal id and note errors by type, without message text or email addresses. An audit log records actions by Regelife administrators (admitting people, creating invitation codes, viewing the waitlist). The infrastructure that runs the service (Google Cloud) also keeps its own request logs, which can include network details such as IP address and browser type. [LAWYER: P17. Server logs held by Google (Cloud Run and Cloud Logging) can contain request details such as IP address and browser type. Application logs written by our code avoid email addresses and message text. Confirm what the infrastructure logs and for how long.]

Browser storage

Signing in stores a token in your browser so you stay signed in. We found no advertising or analytics scripts on our pages. The pages load fonts from Google, and if bot protection is switched on, scripts from Google. [LAWYER: P12. Browser storage, cookies and third-party scripts. Firebase Authentication keeps a sign-in token in the browser; no advertising or analytics scripts were found in the site files, but Google Fonts are loaded from Google, and reCAPTCHA or App Check scripts load only if switched on. Confirm whether a cookie notice is needed.]

4. Why we use it

• to run your account, sign you in, admit people from the waitlist and keep the preview to its seat limit;
• to provide the Design Engine and let you reopen, rename and delete your chats;
• to take payment, send billing and reminder emails, and manage cancellations;
• to keep the service secure, limit abuse and cost, find and fix errors;
• to answer you and handle requests about your data;
• to produce aggregate figures about the preview for ourselves and our investors;
• to improve the service, using your conversations only if you opted in (section 5);
• to meet legal duties.

5. Using conversations to improve the service (optional)

When you accept the Terms you can tick a separate box. If you do, Regelife may use your conversations, in de-identified form, to improve the product and its models. In practice today that means: we may export your stored conversations, without your identity, to review how the assistant behaves, to improve its instructions and database, and to build test sets. The export keeps only an allowlisted set of fields and replaces email addresses typed in text. [LAWYER: P06. The optional permission to use conversations to improve the service. The checkbox says "in de-identified form". In truth the data is pseudonymised, not anonymised: names or affiliations typed inside a chat cannot be removed automatically (only email addresses are replaced). Align the wording, and decide whether Regelife may ever train or fine-tune models on it (today it is for improving prompts and building evaluation sets; model tuning is deferred).]

This is de-identified, not anonymous. The random identifier lets the conversations of one person be linked to each other, and we cannot reliably find names, affiliations or other details you type about yourself or your work inside a chat. Do not type anything you would not want in such a dataset.

Saying no is fine. Your access and features are the same. Chats of people who have not opted in are not exported for this purpose.

How to switch it off. Sign in, open the account page ("Account and data"), and turn off the training-data permission. From then on none of your stored conversations is included in new exports. Turning it back on only covers conversations you start afterwards. [LAWYER: P07. What withdrawing the permission does not do: it stops future exports and clears the flag on every stored conversation, but it does not recall files already exported or sit in backups.]

6. Who else handles your data

We use these service providers. Each is [TO CONFIRM]: exact products, locations, contracts and what each keeps must be confirmed. [LAWYER: P04. Service providers (sub-processors). Each is TO CONFIRM: the exact product, the data location, the contract or data processing terms in force, whether the provider keeps or trains on the data, and its retention.]

• Google Cloud and Firebase (Google LLC) [TO CONFIRM]. Hosts the website and the service; stores accounts, conversations and logs; handles sign-in (Firebase Authentication, including Google sign-in and verification emails); holds our secrets; may run bot checks (reCAPTCHA Enterprise or App Check) if switched on. Region: us-central1 by default.
• Stripe [TO CONFIRM]. Takes your card and billing address, creates your subscription and invoices, sends payment notices. We send it your email and an internal account id.
• Model provider [TO CONFIRM]. Receives the text of your conversation (and our fixed instructions) to produce each reply. Today the default is Anthropic (Claude); Google (Gemini, directly or through Vertex AI) is supported and may become the provider. A local model is used only in development. It does not receive your name, email or account id.
• Email provider [TO CONFIRM]. Sends our own emails (waitlist confirmation, admission, subscription and cancellation confirmations, reminders, payment failure, account deleted). No provider is chosen yet; Resend is the one the software supports. Verification and password-reset emails are sent by Firebase.

We may also share data when the law requires it, to protect people or the service, or with a successor if the business is sold or merged. We do not sell your personal information.

7. International transfers

The service runs on Google Cloud in the United States by default and its providers may process data in other countries. [DECISION: P05. Region and international transfers. Default Cloud Run and Firestore region is us-central1 (cannot be changed for Firestore after creation); production region not decided. Mark to choose; lawyer to write the transfer wording.]

8. How long we keep data

[DECISION: P02. RETENTION PERIOD: NOT DECIDED. Today nothing deletes conversations automatically; the retention job keeps everything while `RETENTION_MONTHS` is unset. Mark and the lawyer must choose a number of months for chats, and periods for the other records below.]

• Conversations: [DECISION: not decided] months after last activity. Until a period is set nothing is deleted automatically; you can delete chats or your account yourself at any time.
• Account and consent records: until you delete your account, [DECISION: or a stated period].
• Waitlist entries of people who never sign up: [DECISION: not decided].
• Billing event log, email send log, administrator audit log: [DECISION: not decided]. They contain no names or emails (the audit log records the administrator's email).
• Usage counters: a few days.
• Backups: we keep database backups for [DECISION: 35 days at present]. Data you delete may remain in backups until they expire. [LAWYER: P08. What deletion removes and what remains: backups until they expire, the content-free logs, Stripe's own legally required records.]
• Stripe keeps payment records as its own terms and the law require.

9. Your choices and rights

On the account page ("Account and data" in the menu) you can, without contacting us:

• see your profile, consent history and subscription;
• download your data as a file (profile, consent history, subscription facts, and every conversation with its messages);
• switch the improvement permission off (section 5);
• delete a single chat from the history panel (deleted for good, no undo);
• delete your account: we cancel your subscription, delete your Stripe customer, delete your conversations and messages, your user record and waitlist entry, and your sign-in account, and keep a log entry that says only that a deletion happened.

For anything else, such as correcting information or asking a question, email mark@regelife.bio from the address on your account. [LAWYER: P16. Rights wording. The account page lets a signed-in user see their data, download it, switch the improvement permission off, delete single chats and delete the whole account. Other rights (correction, objection, restriction, portability formats, response deadlines, complaint to a regulator) depend on the laws that apply.]

10. Security

We use general measures such as: sign-in required for every part of the service except the waitlist; the database cannot be read directly from a browser; secrets kept in a secrets manager; payments handled by Stripe; chats kept separate from identity; limits on abuse. No system is perfectly secure, and we have not had an independent security review. [LAWYER: P09. General description of security measures. Drafted in general terms only; no independent security review has been done and none is claimed.] [LAWYER: P10. Breach notification statement. Draft only says we will notify as required by law.]

11. Children

The Design Engine is for adults and is not directed at children. [DECISION: P11. Minimum age. Draft says the service is for adults (18+) and not for children. Confirm the age.]

12. Changes

When we publish a new version of this policy it gets a new version number, and you must accept it the next time you sign in. The account page shows which version you accepted and when. Draft marker: Draft 2 of 2026-10-14.

13. Contact

mark@regelife.bio, Regelife Inc., Boulder, Colorado. [DECISION: P01. Who is responsible for the data (controller), their address, a privacy contact address, and whether a data protection officer or an EU/UK representative is needed. Not decided.]