Privacy Policy
1. Purpose
This policy explains how Phases Innovations Inc. collects, uses, protects, discloses, retains, and deletes personal data through the Phases website, authenticated platform, and related services. It supports privacy notice obligations under applicable data-protection laws, including the CCPA/CPRA, EU GDPR, and UK GDPR.
In summary, Phases processes personal data to operate and secure its website and platform, respond to inquiries and support requests, administer user accounts, and provide clinical trial management services to customers. Phases stores the personal data needed for these purposes, shares it only with authorized customers, service providers, subprocessors, or other parties described in this policy, and retains it only as long as needed under this policy, customer agreements, legal obligations, and retention requirements. Access is limited to authorized personnel and service providers, and personal data is protected using the security controls described below.
2. Scope
This policy describes how Phases handles personal data for website visitors, prospects, account users, workforce contacts, and support contacts. When Phases provides services to customers, Phases processes customer-controlled personal data on behalf of the customer and under the applicable customer agreement, Data Processing Agreement, and Business Associate Agreement where applicable. Phases acts as a controller only where it determines the purposes and means of processing, such as for its own workforce administration and direct business operations.
Customer-controlled clinical trial data remains governed by the customer agreement, Data Processing Agreement, and Business Associate Agreement where applicable. This policy does not replace customer obligations to provide privacy notices to trial participants, investigators, site staff, or other data subjects for customer-controlled processing.
Phases Innovations Inc. is a United States company based in San Francisco, California. Company, DPO, EU representative, and UK representative contact details are listed in Section 17.
3. Notice at Collection
At or before the point of collection, Phases informs individuals of the categories of personal data collected, the purposes of processing, whether data is sold or shared, and the applicable retention period.
| Category | Examples | Primary Purpose | Sold or Shared for Cross-Context Advertising | Retention Basis |
|---|---|---|---|---|
| Contact information | Name, email address, phone number | Inquiries, accounts, support, marketing communications | No | Active relationship plus legal needs |
| Account information | Login identifiers, authentication status, communication settings | Provide and secure the platform | No | Account life plus legal needs |
| Inquiry data | Messages, questions, feedback | Respond to requests and maintain support history | No | Support need plus legal needs |
| Device and usage data | IP address, browser type, operating system, referring URL, pages | Security, diagnostics, service improvement | No | Operational need plus legal needs |
| Strictly necessary cookie data | Session, CSRF, tenant routing, UI preferences, and cookie-consent choices | Authentication, routing, fraud prevention, usability | No | Session or configuration need |
| Product analytics data | Feature-usage events, masked session recordings, blog page views with consent | Understand platform and blog usage and improve the service | No | Operational need plus legal needs |
| Customer-controlled clinical data | Clinical metadata, trial documents, platform-generated work items | Provide contracted clinical trial services | No | Customer agreement and retention policy |
| Authorized Google Workspace data | Gmail message content, metadata, attachments, and contact context | Provide the Email Agent service requested by users | No | Service need plus user deletion request |
Phases does not sell personal data. Phases does not share personal data for cross-context behavioral advertising.
4. Personal Data Collected
4.1 Information provided by individuals
Phases collects contact information, account information, inquiry data, support content, and communication preferences when individuals submit forms, communicate with Phases, create or use an account, or request services.
Phases also collects email addresses submitted through the Site's subscription form. Phases uses Resend to manage subscriptions and send optional product and blog updates. Subscribers may unsubscribe at any time.
Unless stated otherwise, providing personal data is not a statutory requirement. Contact and account data may be contractually required or necessary to enter into or perform a contract. If required data is not provided, Phases may be unable to create an account, provide the requested feature or service, or respond to a request. Optional data may be withheld without affecting unrelated services.
4.2 Information collected automatically
Phases collects device and usage data needed to operate, secure, diagnose, and improve the services. This may include browser type, operating system, IP address, pages visited, referring URLs, timestamps, authentication events, and security events.
In the marketing website's blog section, Phases may use PostHog to collect page-view and related usage data only after the visitor gives consent as described in Section 8.1. Phases does not use marketing or advertising cookies on the marketing website.
On the authenticated platform, Phases also uses PostHog to collect in-product feature-usage events and session recordings that help Phases understand how the platform is used and improve it. Session recordings are captured with on-screen text, form inputs, and element attributes masked so that customer-controlled clinical data and other on-screen content are not recorded. These technologies are used only as described in Section 8.
4.3 Customer-controlled clinical data
Customers may upload or connect data that includes clinical trial information, personal data, or Protected Health Information. Phases processes that data on customer instructions and under the applicable customer agreements. Phases does not use customer-controlled clinical data for advertising or model training.
4.4 Authorized Google Workspace data
When a user authorizes the Email Agent through OAuth, Phases accesses only the Google Workspace data needed to provide the user-requested Email Agent service. Section 16 describes this processing.
5. Processing Purposes and Legal Bases
Phases processes personal data for the purposes and legal bases below.
| Purpose | Legal Basis or Basis for Processing |
|---|---|
| Provide and administer services | Contract, customer instructions, legitimate interest |
| Respond to inquiries and support requests | Contract, legitimate interest, consent where required |
| Create, authenticate, and manage accounts | Contract, legitimate interest, legal obligation |
| Secure, monitor, and improve services | Legitimate interest, legal obligation |
| Maintain audit, compliance, and legal records | Legal obligation, legitimate interest, customer contract |
| Send optional marketing communications | Consent or legitimate interest where permitted, with opt-out rights |
| Process customer-controlled clinical data | Customer instructions under the Data Processing Agreement or BAA |
| Provide AI-assisted platform features | Contract, customer instructions, user authorization where applicable |
Phases relies on legitimate interests only for Phases-controlled processing, such as security, fraud prevention, business inquiries, compliance records, and relevant customer or prospect communications. Customer-controlled clinical data is processed under customer instructions and applicable data processing terms. UK, EU, and EEA residents may object to legitimate-interest processing as described in Section 12.
6. Sensitive Personal Information
Phases does not knowingly collect sensitive personal information from website visitors or prospects unless they choose to provide it in an inquiry. Customer-controlled clinical trial data may include sensitive personal data or Protected Health Information. Such data is processed by Phases as a processor or business associate on behalf of the customer and is governed by the applicable customer agreement.
Phases uses sensitive personal information only for permitted service, security, legal, or compliance purposes. Phases does not use sensitive personal information for advertising, profiling, or model training.
7. Sharing and Disclosure
Phases may disclose personal data to:
- Service providers and subprocessors that process data on behalf of Phases under written agreements.
- Customers or authorized customer administrators where Phases processes data under a customer agreement.
- Legal, regulatory, or governmental authorities where required by law or legal process.
- Professional advisers under confidentiality obligations.
- Parties involved in a business transfer, merger, acquisition, financing, or asset sale, subject to appropriate notice where required.
A current subprocessor list is available at https://trust.phases.ai/.
7.1 LinkedIn company page
Phases operates a LinkedIn company page. LinkedIn processes member profile and interaction data to provide Phases with aggregated Page Insights. For personal data of members in the EEA and Switzerland used to generate those insights, Phases and LinkedIn Ireland Unlimited Company are joint controllers under LinkedIn's Page Insights Joint Controller Addendum.
Phases uses Page Insights to understand engagement and improve its business communications based on its legitimate interests. LinkedIn is responsible for providing information about its processing and supporting data subject rights for Page Insights. Requests may also be sent to Phases as described in Section 12.4.
8. Cookies and Similar Technologies
For this policy, cookies include similar technologies such as localStorage, sessionStorage, and pixel tags.
8.1 Marketing website
Phases uses cookies and similar technologies on the public marketing website at phases.ai (the "Site"). For this Section, cookies include localStorage, sessionStorage, JavaScript tags, and similar storage or access technologies.
Strictly necessary technologies
The Site uses strictly necessary technologies required for basic operation, security, and consent management. This includes limited localStorage used for page rendering and framework state, and localStorage used to record a visitor's cookie-consent choices so the Site does not ask again on every visit. These technologies are not used for analytics, advertising, or cross-site tracking.
Analytics technologies (blog, with consent)
In the Site's blog section, including the blog index and article pages, Phases may use PostHog to understand how blog content is read and to improve the Site. With consent, this service may collect page views and related usage data such as browser type, device type, referring page, and IP address. Phases configures this service not to capture session recordings on the marketing Site and to strip query strings and fragments from URLs before events are sent.
These analytics technologies are optional. They are disabled by default and are used only after a visitor gives consent through the cookie banner or cookie settings on the Site. Phases applies this consent requirement on the Site regardless of location. Phases does not use them for advertising, retargeting, audience segmentation, profiling, or cross-site tracking. Visitors may decline or withdraw consent without losing access to the Site.
PostHog is listed on Phases' subprocessor list at https://trust.phases.ai/.
Marketing and advertising technologies
Phases does not use marketing or advertising cookies on the marketing website.
8.2 Authenticated platform
The authenticated platform uses strictly necessary cookies and similar technologies for authentication, tenant routing, CSRF protection, security, and limited user-interface preferences. These technologies are required for the platform to function.
The authenticated platform also uses PostHog, which may store or access cookies and local storage to measure in-product usage and capture masked session recordings. Phases sends the authenticated user's user ID, name, and email address to associate usage with the account. This processing is used solely to improve the service and never for advertising, profiling, or cross-site tracking. In the European Economic Area, the United Kingdom, and Switzerland, these non-essential technologies are used only with the user's prior consent, which the user may decline or withdraw without affecting access to the platform. Section 8.3 describes how to manage these technologies.
8.3 Managing cookies
On blog article pages, visitors may accept, decline, or customize cookie choices through the cookie banner. On any Site page, visitors may manage those choices using Cookie settings in the Site footer. Declining analytics cookies does not block access to the Site.
Individuals may also disable cookies through browser settings. Disabling strictly necessary cookies on the authenticated platform will prevent normal sign-in and session operation. Where the platform presents a consent choice for non-essential product-analytics technologies, individuals may decline or later withdraw consent through that choice.
9. Data Retention
Phases retains personal data only as long as needed for the purposes described in this policy, customer agreements, legal obligations, security obligations, dispute resolution, or audit requirements. Customer-controlled clinical data is retained according to the applicable customer agreement and SVP-SOP-RD-001.
Production Site access logs have a 90-day retention period and are then automatically deleted.
Deletion requests for data that Phases controls are handled within the timeframes required by applicable law unless retention is required by law, contract, security, or compliance obligation.
10. Data Accuracy
Phases takes reasonable steps to keep personal data accurate and up to date for the purposes for which it is processed. Individuals may request correction of inaccurate personal data by contacting founders@phases.ai.
11. Data Security
Phases applies technical and organizational measures designed to protect personal data, including encryption in transit, encryption at rest, access control, audit logging, vendor controls, secure development controls, vulnerability management, and incident response. Security controls are governed by SVP-ISP-001 and supporting SVP documents.
If a personal data breach creates a notification obligation, Phases notifies affected customers, individuals, regulators, or other required parties according to applicable law and contractual obligations.
12. Privacy Rights
12.1 United States residents
Depending on state of residence, individuals may have the right to know what personal data Phases collects and why, access personal data, delete personal data, correct inaccurate personal data, opt out of data sale or sharing, limit use of sensitive personal information, and exercise privacy rights without discrimination.
12.2 California residents
California residents may receive a notice at collection, request information about personal information collected and disclosed in the prior 12 months, request correction or deletion, opt out of sale or sharing, limit use of sensitive personal information, and submit requests through an authorized agent with proper documentation.
Phases does not sell personal information and does not share personal information for cross-context behavioral advertising.
12.3 United Kingdom, European Union, and EEA residents
UK, EU, and EEA residents may have the right to access personal data, rectify inaccurate personal data, erase personal data, restrict processing, receive data portability, object to processing based on legitimate interests, withdraw consent without affecting prior lawful processing, and lodge a complaint with a supervisory authority.
UK residents may contact the Information Commissioner's Office at https://ico.org.uk. EU and EEA residents may contact their national Data Protection Authority; the European Data Protection Board maintains a list at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
12.4 Exercising rights
Individuals may submit privacy requests by email to founders@phases.ai. EU and EEA residents may also submit requests through https://phases.gdprlocal.com/eu, and UK residents may submit requests through https://phases.gdprlocal.com/uk. Phases may verify identity before processing a request. Authorized agents may submit requests with written authorization or other documentation required by applicable law.
For UK, EU, and EEA privacy requests, Phases responds without undue delay and within one month, unless an extension of up to two further months is permitted by law. For California privacy requests, Phases confirms receipt within 10 business days and responds within 45 days, unless a one-time extension of up to 45 additional days is permitted by law.
Where Phases processes personal data as a processor or business associate, Phases supports the customer in responding to privacy rights requests according to the customer agreement.
13. Children's Privacy
The services are not intended for individuals under 16. Phases does not knowingly collect personal data from anyone under 16. If Phases learns that it collected personal data from a child under 16, it deletes the data promptly unless retention is legally required.
14. International Data Transfers
Personal data is stored and processed in the United States. When personal data is transferred from the United Kingdom, European Union, EEA, or another jurisdiction requiring transfer safeguards, Phases uses appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism.
15. Policy Updates
Phases keeps this privacy notice under regular review to make sure it is up to date and accurate. Updates are published with a new version and effective date. If a change materially affects how Phases uses personal data, Phases provides notice by email, website notice, platform notice, or another legally appropriate method before the change takes effect.
16. AI Processing and Email Agent Data Usage Addendum
This addendum describes how Phases uses AI-assisted features and how the Email Agent service accesses and uses Google Workspace data when a user authorizes access through OAuth.
16.1 AI-assisted platform features
Phases uses AI-assisted features to support clinical trial operations, including document analysis and authorized email workflows. These features may process customer-controlled clinical trial data, email content authorized by the user, and related context only to provide the requested service or contracted platform functionality.
Phases does not use customer-controlled clinical data, Google Workspace data, or sensitive personal information to train AI models. AI providers used by the platform or in company-authorized AI tools are required to process data under contractual controls that prohibit training on Phases data.
AI outputs support user workflows and are not used by Phases to make solely automated decisions that produce legal or similarly significant effects about individuals. The platform preserves user review, audit, and accountability controls.
16.2 Google data accessed
When authorized by the user, the Email Agent may access:
- Email messages, including subject lines, body content, sender and recipient information, and attachments.
- Email metadata, including timestamps, labels, thread information, and read or unread status.
- Contact context, including email addresses from contacts and message history.
16.3 Use of Google data
Phases uses Google data only to provide the user-requested Email Agent service. Permitted uses include analyzing email content to provide AI-powered assistance, generating user-requested draft responses or suggestions, organizing messages, categorizing messages, sending emails when explicitly requested, and marking messages as read when explicitly requested.
Google data is not used to train AI models, serve advertising, retarget users, sell data, or support unrelated product analytics.
16.4 Google API Limited Use
Phases' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
16.5 Google data retention and deletion
Phases retains Google data only as long as needed to provide the Email Agent service, comply with legal obligations, or complete deletion workflows. A user may request correction or deletion at any time. Phases acknowledges deletion requests within 5 business days and completes deletion within 30 calendar days unless retention is legally required.
16.6 Revoking Google access
Users can revoke Phases' access to Google data at any time by visiting https://myaccount.google.com/permissions, selecting the Phases Email Agent application, and removing access. After revocation, Phases deletes retained Google data within 30 calendar days unless retention is legally required.
17. Contact
Questions, privacy requests, and data deletion requests may be sent to founders@phases.ai.
Company contact: Phases Innovations Inc., San Francisco, California, United States, founders@phases.ai.
Data Protection Officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany, datenschutz@heydata.eu, www.heydata.eu.
EU Representative: Under Article 27 of the EU GDPR, Phases has appointed Instant EU GDPR Representative Limited as its EU representative:
- Adam Brogden, contact@gdprlocal.com
- Web: www.gdprlocal.com
- Privacy request submission page: https://phases.gdprlocal.com/eu
- Tel: +353 1 554 9700
- INSTANT EU GDPR REPRESENTATIVE LIMITED, Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland
UK Representative: Under Article 27 of the UK GDPR and the UK Data Protection Act, Phases has appointed GDPRLocal Ltd. as its UK representative:
- Adam Brogden, contact@gdprlocal.com
- Web: www.gdprlocal.com
- Privacy request submission page: https://phases.gdprlocal.com/uk
- Tel: +44 1772 217800
- GDPRLocal Ltd., 1st Floor Front Suite, 27-29 North Street, Brighton, England, BN1 1EB
Individuals may also complain to a competent supervisory authority about the way Phases processes their personal data. UK residents may contact the Information Commissioner's Office at https://ico.org.uk. EU and EEA residents may contact their national Data Protection Authority; the European Data Protection Board maintains a list at https://edpb.europa.eu/about-edpb/about-edpb/members_en.