Privacy Notice

Prism Biosciences LLC is the controller of the personal information described here. This notice explains how we handle information collected through our website, researcher dashboard, batch-verification tools, calculators, customer correspondence, and order fulfilment operations. It applies to prospective, current, and former customers and to institutional contacts named on purchase orders. It does not apply to third-party sites linked from our pages, which publish their own notices.

• Account data — name, email address, institution or laboratory name, role, and the authentication identifiers used to access the researcher dashboard. Passwords are stored only as salted hashes by our authentication provider and are never visible to us.
• Order data — items purchased, quantities, lot numbers released to you, shipping and billing addresses, delivery contact details, subscription cadence, and order correspondence.
• Payment data — the last four digits, card brand, and expiry returned by our payment processor, or the public wallet address used for a digital-asset settlement. We never receive or store full card numbers, CVV codes, or bank credentials.
• Compliance records — research-use attestations, institutional confirmations, purchase orders, and tax-exemption documentation you submit.
• Technical data — device and browser metadata, IP address, pages viewed, and aggregate usage of tools such as the reconstitution calculator and batch lookup, collected to keep the service secure and working.

We process personal information to:

• authenticate access to gated analytical documentation and order history;
• fulfil, pack, and ship orders under cold-chain conditions, and to service subscriptions, invoices, refunds, and replacements;
• maintain lot traceability so that a quality investigation or recall can identify every recipient of an affected batch;
• satisfy recordkeeping obligations tied to research-use attestation, tax, and export-compliance screening;
• detect fraud, diversion, and abuse, and to secure accounts and infrastructure;
• respond to quality, technical, or support enquiries, and to send transactional messages such as shipping and excursion notices.

We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use order history to target third-party advertising. Marketing email is sent only with consent and can be withdrawn from any message.

Where the GDPR or UK GDPR applies, we rely on performance of a contract for account and order processing; legal obligation for tax, traceability, and export screening; legitimate interests for security, fraud prevention, and service improvement, balanced against your rights; and consent for optional marketing communications, which you may withdraw at any time without affecting prior processing.

Certificates of Analysis, batch-vault history, and order records in the researcher dashboard are protected by row-level authorization enforced in the database, not merely in the interface: an authenticated account can retrieve only the lots and orders associated with that account, and unauthenticated requests return nothing. Public batch lookup returns summary purity, identity, and release data only, with no customer information attached.

We share the minimum necessary data with processors that support our operations — managed cloud hosting and database infrastructure, payment processors, tax calculation services, transactional email delivery, and insulated cold-chain carriers. Processors are bound by contract to process data only on our instruction, to apply appropriate security, and not to use it for their own purposes.

We may also disclose information where required by law, valid legal process, or a regulatory request; to protect our rights, personnel, or customers; or, in the event of a merger or asset sale, to the acquiring entity under equivalent protections.

We use strictly necessary cookies and local storage to keep you signed in, hold cart contents, and protect against fraud. We use limited, aggregated analytics to understand which pages and tools are used; we do not run advertising pixels or cross-site trackers. Blocking necessary cookies in your browser will prevent sign-in and checkout from working.

Order, attestation, and lot-traceability records are retained for a minimum of seven years to support quality investigations, recall capability, and tax and recordkeeping obligations. Account details and marketing preferences are retained while the account is active and until you request deletion. Technical and security logs are retained on a rolling short-term basis, typically no more than 12 months, and are then deleted or aggregated.

You may request access to, correction of, or deletion of your personal information, request a portable copy, object to or restrict certain processing, and opt out of non-transactional email at any time. Deletion requests are honoured except where records must be retained for lot traceability, tax, or other legal obligations, in which case we restrict the record rather than erase it and tell you why.

Submit requests to privacy@prismbio.co from the address on file, or from the dashboard while signed in. We respond within 30 days and never charge a fee or degrade service for exercising a right. You may authorize an agent to act for you, and you may lodge a complaint with your local supervisory authority if you are unsatisfied with our response.

Data is transmitted over TLS and stored in access-controlled managed infrastructure with authenticated, per-account authorization policies, least-privilege administrative access, and audit logging. No system is perfectly secure; please use a unique password and notify us immediately at security@prismbio.co of suspected unauthorized account access. Where a breach is likely to create a risk to you, we notify affected customers and applicable regulators without undue delay.

Our services are not directed to anyone under 21 and we do not knowingly collect information from minors; if we learn we have, we delete it. Data is processed in the United States and may be accessed by processors in other countries. Where required, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses, together with supplementary technical measures.

We may update this notice as our operations, processors, or legal obligations change. The effective date above always reflects the current version, and material changes are announced by email or a prominent dashboard notice before they take effect.