.svg)
Privacy Notices
Arboretum Privacy Policy
Last Updated: 05/04/2026
Arboretum LifeSciences, Inc. (“Arboretum,” “we,” “our,” and/or “us”) values the privacy of individuals who use our websites, research platforms and related services (collectively, our “Services”), including the Research Participant Platform and the Research Analysis Environment, each as further described in the Terms of Service. This Privacy Policy explains how we collect, use, and disclose information from users of our Services.
If you create an account with the Services, you are an “Individual User.” If you opt into one or more research studies (“Research Studies”), you are a “Research Participant.” Research study coordinators and healthcare providers who access the Services are “Research Affiliates.” By using our Services, you acknowledge the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service, and informed consents as applicable.
Research Participant data collected and processed through our Services is governed by research protocols approved by an Institutional Review Board (IRB) and conducted in accordance with the Federal Policy for the Protection of Human Subjects (the “Common Rule,” 45 C.F.R. Part 46). Research Participants provide informed consent prior to data collection. Nothing in this Privacy Policy limits the rights afforded to Research Participants under their informed consent.
Scope of Notice
Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” or, under the Health Insurance Portability and Accountability Act (“HIPAA”), a “business associate,” processes personal data on behalf of a controller subject to the controller’s instructions. This Privacy Policy does not cover or address how our customers may process personal data when they use our Services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor (or business associate under HIPAA). As a result, we recommend referring to the privacy notice (or HIPAA Notice of Privacy Practices) of our customer with whom you have a relationship for information on how they engage processors, like us, to process personal data on their behalf.
This Privacy Policy describes our privacy practices where we are acting as the controller of personal data.
Information We Collect
We may collect a variety of information from or about you or your devices from various sources, as described below.
A. Information You Provide to Us.
User Registration Data. When you sign up for an Individual User account, we collect your name, email address, and/or phone number. You may also provide additional information such as your date of birth, address, gender, demographic information, which may include health-related information collected for the purpose of determining your eligibility for a Research Study (collectively, “User Registration Data,” as defined in the Terms of Service). Your User Registration Data cannot be viewed by other Individual Users.
When you set up an Individual User account with Arboretum, you are creating a relationship with Arboretum that enables you to access and utilize the Services, regardless of whether you become a Research Participant. As an Individual User, we will send you information about research studies, clinical trials, and research opportunities as part of our Services.
Research Affiliate accounts will be provisioned by Arboretum. In order to provision those accounts we collect your name, email address, and/or phone number.
Your Research Data. If you enroll in a Research Study, we collect information as described in the applicable research consent (also referred to as informed consent) and HIPAA authorization, including survey responses, participant-reported outcomes, medical records shared pursuant to a HIPAA authorization, genetic information, and biospecimen-derived data (collectively, “Your Research Data,” as defined in the Terms of Service). Your Research Data may be shared with your healthcare providers or Research Affiliates in accordance with the study’s informed consent.
Biospecimen Information. As a Research Participant, you may be invited to provide a biospecimen for testing as described in the relevant consent documentation. We collect this information to facilitate research; we do not share it in response to general third-party inquiries (e.g., requests from your employer or insurance provider). Please see “How We Disclose the Information We Collect” for more information about our information disclosure practices.
Communications. If you contact us directly, we may receive additional information about you, such as your name, email address, phone number, the contents of messages or attachments that you may send to us, and other information you choose to provide. When you communicate with us online, third-party vendors may receive and store these communications on our behalf. When we send you emails, we may use embedded pixels or other technologies to track information about your receipt and interaction with our emails, such as whether and when you open them, whether you access any links included in our emails, how long you read our emails, whether you forward our emails and to whom, and your Device Information (described below), to learn how to deliver a better experience and improve our Services.
Event Information. If you register to attend one of our events such as a webinar or attend a conference where we are in attendance, we may collect contact information such as your name, position, organization name, email address, and other information that you choose to provide.
B. Information We Collect When You Use Our Services.
Consents. As a Research Participant, when you complete a consent form via our Services, we receive the information that you have included in the consent form.
Information from Third Parties. We, and our third-party partners, automatically collect information you provide to us and information about how you access and use our Services when you engage with us. We typically collect this information through the use of a variety of our own and our third-party partners’ automatic data collection technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. Information we collect automatically about you may be combined with other personal information we collect directly from you or receive from other sources.
We, and our third-party partners, use automatic data collection technologies to automatically collect the following data when you use our Services or otherwise engage with us:
• Information About Your Device and Network, including the device type, manufacturer, and model, operating system, IP address, browser type, Internet service provider, and unique identifiers associated with you, your device, or your network (including, for example, a persistent device identifier or advertising ID). We employ third- party technologies designed to allow us to recognize when two or more devices are likely being used by the same individual and may leverage these technologies (where permitted) to link information collected from different devices.
• Information About the Way Individuals Use Our Services and Interact With Us, including the site from which you came, the site to which you are going when you leave our Services, how frequently you access our Services, whether you open emails or click the links contained in emails, whether you access our Services from multiple devices, and other browsing behavior and actions you take on our Services (such as the pages you visit, the content you view, videos you watch, the communications you have through our Services, and the content, links and ads you interact with). We employ third-party technologies designed to allow us to collect detailed information about browsing behavior and actions that you take on our Services, which may record your mouse movements, scrolling, clicks, and keystroke activity on our Services and other browsing, search or purchasing behavior. These third-party technologies may also record information you enter when you interact with our Services, or engage in chat features or other communication platforms we provide.
• Information About Your Location, including general geographic location that we or our third-party providers may derive from your IP address.
All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our Services, and to improve the effectiveness of our Services, offers, advertising, communications and customer service. We may also use this information to: (a) provide custom, personalized content and information, including targeted content and advertising; (b) identify you across multiple devices; (c) provide and monitor the effectiveness of our Services; (d) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (e) diagnose or fix technology problems; and (f) otherwise to plan for and enhance our products and services.
C. Information We Receive from Other Sources.
Affiliates. We may receive information from our current or future affiliates for any of the purposes described in this Privacy Policy.
Research Affiliates. We may receive information from our Research Affiliates who work with us when conducting research studies. The use and disclosure of Your Research Data received from Research Affiliates is governed by the applicable research consent and HIPAA authorization.
Information from Third-party Services. If you choose to link our Services to a third-party account (e.g., an account with your third-party healthcare provider), we may receive information about you, including your profile information, contact information, and health information.
Clinical Trial Participant Information. If we receive information about your participation in a clinical trial from a third party (e.g., the trial sponsor) in accordance with your informed consent, we may link that information to your account.
How We Use the Information We Collect
A. How We Use Information Through the Services
We use User Registration Data and information collected through the Services to:
• Operate, maintain, improve, and enhance the Services;
• Personalize your experience, such as by providing tailored content and recommendations;
• Communicate with you, including operational messages about your use of the Services. Sending information about research studies, clinical trials, and research opportunities is core to our Services and, as such, are transactional or operational messages. We may also send, and subject to your consent if required, messages about products and services offered by Arboretum, its affiliates, or third-party partners that Arboretum believes may be relevant to you.
• Understand and analyze how you use the Service and develop new products, services, features, and functionality;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.
B. How Arboretum Uses Your Research Data
Arboretum uses Your Research Data as described in the applicable research’s informed consent, including to:
• Return Research Results to Research Participants, including results such as genetic information and diagnostic information (where eligible);
• Identify ways in which genes and other health factors may affect disease risk or treatment response;
• Train, develop, and improve artificial intelligence, including generative artificial intelligence, machine learning, and other algorithmic or computational models that support our Services, including models used for variant interpretation, risk stratification, research analytics, and participant matching, subject to the following practices:
• Arboretum uses de-identified data for AI model training by default. Individual-level data may be used for model training where necessary to support research objectives, and only in accordance with the applicable informed consent.
• The Service uses artificial intelligence, including generative artificial intelligence, machine learning, and other algorithmic or computational models to support research analytics, participant matching, and communications about research opportunities and products and services. These uses are informational in nature and do not constitute decisions regarding your medical care or treatment. Artificial intelligence does not autonomously make decisions regarding your medical care or treatment or any other consequential or significant decisions.
• All AI-generated outputs related to Research Results are reviewed by qualified personnel before being communicated to you or your healthcare provider. Where generative artificial intelligence is used to draft communications containing your research information, such communications are reviewed prior to delivery.
• Assess your eligibility for and match you to Research Studies, research opportunities, and products or services offered by Arboretum, its affiliates, or third-party partners that may be relevant to you;
• Generate de-identified or aggregated data sets that cannot reasonably be used to identify individual Research Participants, which information we may use for purposes outside the scope of this Privacy Policy, including but not limited to, scientific research, data analysis, quality improvement, or other lawful business purposes including commercialization. If such data is shared with third parties, this will be subject to a data sharing agreement.
C. Other Purposes
For other purposes for which we provide specific notice at the time the information is collected.
How We Disclose the Information We Collect
Affiliates. We may disclose any information we receive to our current or future affiliates for any of the purposes described in this Privacy Policy.
Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services.
Healthcare Providers. For Research Participants eligible to receive Research Results that include clinical information, those results may be reported to the healthcare provider(s) involved in your care.
Research Affiliates. We may disclose information about you, such as account registration information, to our Research Affiliates who work with us when conducting research studies.
Promotions. With your prior express consent, we may disclose your contact information to third parties so that they can contact you directly regarding their products and services. You may revoke this consent at any time within your Research Participant account settings or by emailing support@arboretum.bio.
Analytics Partners. We may use analytics services such as Google Analytics to collect and process certain analytics data.
Advertising Partners. We may work with third-party advertising partners to collect and process your information in order to show you ads that we think may interest you.
As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.
Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. Also, in the unlikely event of our bankruptcy, receivership, or insolvency, your personal information may be disclosed, transferred, or assigned to third parties in connection with the proceedings or disposition of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected.
Consent. We may also disclose your information with your permission.
Please note: We do not sell or share text messaging originator opt-in data and consent with any third party or affiliate for their own marketing or promotional purposes. All of the above categories of third-party data sharing exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services, except as needed in connection with a business transaction or reorganization, our legal obligations and rights, or otherwise with your consent or direction (each as described above).
Your Choices
The following privacy choices are made available to all individuals with whom we interact.
A. Communication Preferences
• Email Communication Preferences: You can stop receiving promotional email communications from us by clicking on the “unsubscribe” link provided in any of our email communications. Please note you cannot opt-out of service-related email communications (such as, account verification, transaction confirmation, or service update emails).
• Phone Communication Preferences: You can stop receiving promotional phone communications from us by informing the caller you no longer wish to receive promotional phone calls from us, following the instructions provided on the call for opting out of promotional phone calls (where available), or replying STOP to any one of our promotional text messages.
B. Automatic Data Collection Preferences
Certain of our Services may provide you with the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).
Where an Arboretum-specific preference manager or privacy setting is not available, you may be able to utilize third-party tools and features to further restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.
C. Targeted Advertising Preferences
We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.
You may be able to exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:
• Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt- outs.
• Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.aboutads.info/?c=2&lang=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self- regulatory program.
• Network Advertising Initiative: The Network Advertising Initiative similarly allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.networkadvertising.org/?c=1 to opt out of browser-based targeted advertising carried out by our third-party partners and other third parties that participate in the Network Advertising Initiative’s self-regulatory program.
• Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our Services. Instead, it means that the online ads you do see from relevant program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our Services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program.
D. Partner-Specific Preferences
Certain of our third-party providers and partners offer additional ways that you may exercise control over your personal information, or automatically impose limitations on the way we can use your personal information in connection with the Services they provide:
• Device-Specific / Platform-Specific Preferences: The device and/or platform you use to interact with us (such as your mobile device), may provide you with additional choices with regard to the data you choose to share with us. For example, many mobile devices allow you to change your device permissions to prevent our Services from accessing certain types of information from your device (such as your contact lists or precise geolocation data). Please refer to your device or platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.
• Google Analytics: Google Analytics allows us to better understand how our customers interact with our Services. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google's website here: www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Add-On here: https://tools.google.com/dlpage/gaoptout/. We may also utilize certain forms of display advertising and other advanced features through Google Analytics. These features enable us to use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick advertising cookie) or other third-party cookies together to inform, optimize, and display ads based on your past visits to our Services. You may control your advertising preferences or opt-out of certain Google advertising products by visiting the Google Ads Preferences Manager, currently available at https://myadcenter.google.com/?ref=help-center.
Third Parties
Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
Security
We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.
Retention of Personal Data
We will usually retain the personal data we collect about you for no longer than reasonably necessary to fulfil the purposes for which it was collected, and in accordance with our legitimate business interests and applicable law. If necessary, we may retain personal data for longer periods of time as required under applicable law or as needed to resolve disputes or protect our legal rights.
Children's Privacy
We do not knowingly collect or solicit personal information from children under 18, and no part of our Service is directed to children. If an individual is under the age of 18, they should not use our Service or otherwise provide us with any personal information. If a parent or guardian learns that a child has provided us with personal information in violation of this Privacy Notice, then they may alert us at privacy@arboretum.bio and request that we remove the personal information from our systems. If we learn that any personal information we collect has been provided by a child under the age of 18, we will promptly delete the personal information.
International Visitors
Our Services are hosted in the United States and intended for visitors located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the U.S. for storage and processing. We may also transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.
Update Your Information
You can update your account and profile information within your Arboretum account, using the Services we provide to you. To close your Research Participant account, you must first withdraw as a participant in the study by contacting the study team listed in your Research Participant account profile, then email support@arboretum.bio to request account closure. To close your Research Affiliate account, email support@arboretum.bio.
Access to Research Data
As a Research Participant, you may request your research data or test results in accordance with the terms of the study’s informed consent. Research data requests should be directed to the study team listed in your Research Participant’s account profile.
Changes to this Privacy Policy
This policy will be amended from time to time. We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.
Contact Information
If you have any questions, comments, or concerns about our processing activities, please email us at privacy@arboretum.bio.