Personal Information We Collect

**Sage Bionetworks Privacy Policy**  

Last updated: Nov 15, 2024  

Sage Bionetworks (“**Sage**,” “**we**,” “**our**,” and/or “**us**”)
values the privacy of individuals who use our services, including our Synapse Platform (https://www.synapse.org/), our portals, our other websites, and services provided by us (collectively, our “**Services**”). This privacy policy (the “**Privacy Policy**”) explains how we collect, use, and disclose Personal Information from users of our Services (“**you**” or “**your**”). Please read this Privacy Policy carefully. If you do not agree with this Privacy Policy or any part thereof, you should not access or use any part of the Services. Beyond the Privacy Policy, your use of our Services is also subject to the Sage [Terms of Service](https://www.synapse.org/TrustCenter:TermsOfService) which are incorporated herein by reference (the “**Terms of Service**”). All terms not herein defined shall have the meaning as set forth in the Terms of Service.  

If we are providing the Services to you on behalf of a third-party partner (such as your employer), we will abide by the terms of our agreement with that third-party partner related to the use of the Personal Information we collect on their behalf. To understand how our third-party partners process your Personal Information, please refer to the relevant third-party partner’s privacy policy.  

The table below highlights key elements of Sage’s privacy practices. For more information, please scroll down to read our full Privacy Policy.  

<table>
<colgroup>
<col style="width: 100%" />
</colgroup>
<tbody>
<tr>
<td style="text-align: left;"><p><strong>Collection of Personal Information</strong></p>
<ul>
<li><p><strong>We collect Personal Information that you provide to us.</strong></p></li>
<li><p><strong>We automatically collect Personal Information from your device.</strong></p></li>
<li><p><strong>We do not access your contacts, photos, or other Personal Information stored on your device.</strong></p></li>
</ul>
<p><strong>Tracking</strong></p>
<ul>
<li><p><strong>We use cookies.</strong></p></li>
<li><p><strong>We collect standard log information and browsing activity on our Services.</strong></p></li>
<li><p><strong>We track your device’s general (but not precise) location.</strong></p></li>
<li><p><strong>We do not track your browsing activities on other websites or services.</strong></p></li>
</ul>
<p><strong>Use and Sharing of Personal Information</strong></p>
<ul>
<li><p><strong>We do not sell or rent your Personal Information.</strong></p></li>
<li><p><strong>We share Synapse Platform users’ account information with third parties.</strong></p></li>
<li><p><strong>We do not use your Personal Information for advertising.</strong></p></li>
<li><p><strong>We transfer your Personal Information outside Europe with appropriate safeguards.</strong></p></li>
</ul>
<p><strong>Privacy Tools and Controls</strong></p>
<ul>
<li><p><strong>We rely on valid legal bases when processing Personal Information.</strong></p></li>
<li><p><strong>Among others, you can ask to access, download, or delete your Personal Information.</strong></p></li>
</ul>
<ul>
<li><p><strong>We retain your Personal Information for as long as we need it unless you request deletion.</strong></p></li>
</ul>
<p><strong>Communication</strong></p>
<ul>
<li><p><strong>We make a reasonable effort to notify you if we make changes to our Privacy Policy.</strong></p></li>
<li><p><strong>We send you communication materials, including marketing communications, when applicable with your consent.</strong></p></li>
</ul></td>
</tr>
</tbody>
</table>  

# Personal Information We Collect  

When you use our Services, you may provide to us, or we may collect, Personal Information about you, your devices, and your use of the Services to operate effectively and provide you with the best experience with our Services, as described below.  

In this Privacy Policy, “Personal Information” means any information relating to an identified or identifiable individual. We collect various types of Personal Information from or about you or your devices from various sources. In some cases, if you choose not to provide the requested Personal Information, you may not be able to use our Services. We will tell you if providing the Personal Information is required by law or under a contract and the consequences of failing to provide it.  

## A. Personal Information You Provide to Us.  

**Account Information**. We collect the Personal Information you provide us for account creation and authentication, including but not limited to your name, username, password, and email address. If you sign up using a social media account (e.g., Google) or researcher credentialing web services (e.g., ORCID), we will also receive Personal information from those social media services, based on the privacy settings you applied to these social media accounts.  

**Attestation Documents.** If you wish to validate your user account to be eligible to request access to certain functions, we may ask for documentation intended to verify your credentials, such as a letter from a signing official, a notarized letter, or a copy of your professional license.  

**Survey Information.** When you fill out a survey, we collect your responses, which, depending on the survey type, may include products or areas of interest, satisfaction, area of expertise, and agreement to terms.  

**Communications**. If you contact us directly, we collect any Personal Information that you provide in your message to us. For example, when you participate in our public forum or when you contact our Customer Support Team at [[email protected]](mailto:[email protected]), we will receive your name or username, email address, the contents of the message, and any attachments that you may send to us. If you subscribe to our newsletter, we will collect your email address. When we send you emails, we track whether you open them to learn how to deliver a better customer experience and improve our Services.  

**Careers.** If you decide to apply for a job with us, you may submit your contact information, such as your name, email address, and phone number, and your resume online. We will collect the Personal Information you choose to provide on your resume, such as your education and employment experience. You may also apply through career services such as LinkedIn. If you do so, we will collect the Personal Information you make available to us through these career services.  

**Payment Information.** If you make a purchase through our Services or donate money, we or our third-party payment processor collect and process your payment-related information, such as your name, purchase information, billing address, payment card information, and other transaction information.  

## B. Personal Information We Collect Via Automated Means.  

We use technology to collect Personal Information automatically when you use our Services that do not directly reveal your identity:  

**Location Information**. When you use our Services, we infer your general location information, such as your internet protocol (IP) address.  

**Device Information**. We receive Personal Information about the device and software you use to access our Services, including IP address, web browser type, operating system version, phone carrier and manufacturer, application installations, device identifiers, mobile advertising identifiers, and push notification tokens.  

**Usage Information**. To help us understand how you use our Services and improve them, we automatically receive Personal Information about your interactions with our Services, such as the pages or Content you view, the searches you conduct, any Content you Post, and the dates and times of your visits.  

**Widget Information.** Other websites may integrate Sage’s widgets. When you visit a site with a Sage widget embedded, we may receive certain information, including information about the web page you visited, your IP address, and other information about your device. Sage and the widget can recognize you across websites containing Sage’s widgets, and the widget may be used to show personalized content or advertising. We know when you interact with a widget, and websites containing the widgets may receive this information.  

**User Feedback.** Users can rate and review each other, including submitting comments and reactions to articles and posts published on our Services. If you choose to provide feedback on the Services, that information may be publicly viewable.  

**Information from Cookies and Similar Technologies.** Cookies are small text files containing a string of alphanumeric characters. Log files track actions that occur on the Services and collect device information. Web beacons and pixel tags are electronic files that record usage information. We and our third-party partners collect Personal Information using cookies, pixel tags, or similar technologies (collectively, “**Cookies**”). Our third-party partners, such as analytics partners, use these technologies to collect Personal Information about your online activities over time and across different services. We may use both session Cookies and persistent Cookies. A session Cookie disappears after you close your browser. A persistent Cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services. For more information on our use of Cookies and how to exercise your choices with regard to these Cookies, please see our [Cookies](https://www.synapse.org/TrustCenter:Cookies) page.  

Please review your web browser’s “Help” file to learn how you may modify your Cookie settings. Please note that if you delete or choose not to accept Cookies from the Service, you may not be able to utilize the features of the Service to their fullest potential.  

## C. Personal Information We Receive from Third Parties.   

**Information from third-party services.** If you choose to link our Services to a third-party account, we receive Personal Information about you, including your user account information, photo, and use of the third-party account. If you wish to limit the Personal Information available to us, you should visit the privacy settings of your third-party accounts to learn about your options.  

**Background Checks**. We work with third-party partners to perform background checks on job applicants, and where permitted by applicable law, receive publicly available information such as alias and address history, and inclusion in several criminal national databases, sex offender registries, or terrorist watchlists.  

**Other third parties.** We may receive additional information about you from third parties such as social media platforms like LinkedIn, blogs like WordPress, and other publicly available databases, and may combine it with other information we have about you.  

# How We Use the Personal Information We Collect  

We use the Personal Information we collect for the purposes described below:
- To provide, maintain, improve, and enhance our Services;
- To understand and analyze how you use our Services and develop new products, services, features, and functionality;
- To communicate with you, about our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
- For marketing communications, such as developing and providing newsletters and other promotional and advertising materials that may be relevant, valuable, or otherwise of interest to you;
- To generate aggregate data containing only de-identified information that we may use to understand trends and for purposes such as publishing reports;
- To process job applications;
- To facilitate transactions and payments;
- To prevent, investigate or provide notice of fraud and abuse, and respond to trust and safety issues that may arise;
- For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
- For other purposes for which we provide specific notice at the time the Personal Information is collected.  

<u>Legal Bases for Processing European Personal Information</u>  

If you are located in the European Economic Area (“**EEA**”), Switzerland, or the United Kingdom (“**UK**”) (together “**Europe**”), we only process your Personal Information when we have a valid legal basis, including as set forth below.  

**Consent**. You have consented to the use of your Personal Information, such as to send you marketing communications or to use Cookies.  

**Contractual Necessity**. We need your Personal Information to provide you with our Services. For example, we may need to process your Personal Information to respond to your inquiries.  

**Compliance with a Legal Obligation**. We are legally obligated to use your Personal Information. For example, we may process your Personal Information to comply with tax, labor, and accounting obligations.  

**Legitimate Interests**. We or a third party have a legitimate interest in using your Personal Information. Specifically, we have a legitimate interest in using your Personal Information for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of our Services. We only rely on our or a third party’s legitimate interests to process your Personal Information when these interests are not overridden by your rights and interests.  

# How We Share the Personal Information We Collect  

**Business Partners and Investors**. We share Personal Information, in de-identified and/or aggregated form where possible, with our existing or potential business partners and investors to demonstrate our Services' value and capabilities.  

**Vendors and Service Providers.** We share Personal Information we receive with vendors and service providers retained to provide our Services.  

**User Activity Information.** Our Services are collaborative services in which you can upload, use, edit, and analyze data, depending on your user level and eligibility. Your name, username, and other account information will always be viewable and searchable by other users. We cannot prevent others from using such data, so you should carefully consider whether, where, and what to Post or how you identify yourself on our Services.  

**Marketing.** We do not rent, sell, or share Personal Information about you with non-affiliated companies for their direct marketing purposes unless we have your permission.  

**Analytics Partners.** We use analytics services such as Google Analytics to collect and process certain analytics data. You can visit [Google](https://www.google.com/policies/privacy/partners/) to learn more about Google’s practices and opt out of them by downloading the Google Analytics opt-out browser add-on, available at [Google tools](https://tools.google.com/dlpage/gaoptout?hl=en). To help us understand how you use our Services and to help us improve them, we automatically receive Personal Information about your interactions with our Services, such as the pages or other content you view, the searches you conduct, people you follow, purchases you make, your comments, any Content you Post, and the dates and times of your visits.  

**Advertising Partners.** We may occasionally work with third parties to show you content that we think may interest you. These recommendations are intended to enhance your experience by exposing you to relevant datasets and resources from various platforms within the open science community.  Some of our advertising partners are members of the [Network Advertising Initiative](https://optout.networkadvertising.org) or the [Digital Advertising Alliance](https://optout.aboutads.info). If you prefer not to receive these recommendations, you have the option to opt-out. You can manage your preferences through the settings available on your device, or by utilizing tools such as the AppChoices mobile app. These options allow you to control the type of content you are exposed to in alignment with your research needs and preferences.  

**As Required By Law and Similar Disclosures.** We may access, preserve, and disclose your Personal Information with law enforcement agencies, regulatory bodies, and public authorities or pursuant to the exercise of legal proceedings if we believe doing so is required or appropriate to (a) comply with law enforcement requests and legal processes, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your Personal Information may occur if you Post any objectionable Content on or through our Services.  

**Merger, Sale, or Other Asset Transfers.** We may disclose your Personal Information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your Personal Information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable Personal Information was collected.  

**With Your Consent.** We may also disclose your Personal Information with your permission.  

# Your Rights and Choices  

**Marketing Communications.** You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us.  

**How to Block Cookies**. You can block Cookies by setting your internet browser to block some or all Cookies. You can withdraw your consent at any time by deleting placed Cookies and disabling Cookies in your browser, or as explained below. You can change your browser settings to block or notify you when you receive a Cookie, delete Cookies or browse our Services using your browser’s anonymous usage setting. Please refer to your browser instructions or help screen to learn more about how to adjust or modify your browser settings. If you do not agree to our use of Cookies or similar technologies that store information on your device, you should change your browser settings accordingly. If you use your browser settings to block all Cookies (including essential Cookies) you may not be able to access all or parts of our Services, and some features of our Services may not function properly.  

**Your European Privacy Rights**. If you are located in Europe, you have the following rights described below:  

**You have the right to request access to your Personal Information**. You can request to access any Personal Information we maintain about you or ask us to confirm whether we process Personal Information about you. You may request a copy of your Personal Information in a commonly used electronic form.  

**You have the right to rectification. You can request that we correct, update, and complete the Personal Information we hold about you**.  

**You have the right to erasure.** If appropriate, you may ask us to anonymize or delete your Personal Information.  

**You have the right to object to the processing.** You may object to the further processing of your Personal Information, including the right to object to processing your Personal Information for marketing purposes, if applicable.  

**You have the right to request to restrict the processing.** You can request that we restrict the processing of your Personal Information in certain situations (e.g., while we verify or investigate your concerns with this information);  

**You have the right to withdraw your consent.** You can withdraw your consent to our processing of your Personal Information, at any time, and free of charge. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdraw your consent.  

**You have the right to data portability.** You can request that your Personal Information be provided to you in a structured, commonly used, and machine-readable format to transmit them to a third party or to have their Personal Information transmitted directly to another organization where technically feasible.  

**You have the right to lodge a complaint**. You may do so with a supervisory authority, including in your country of residence, place of work, or where an incident took place.  

You may have additional rights in accordance with local applicable law and the above rights may also be limited in some circumstances, such as by local law.  

You may exercise these rights by contacting us using the contact details indicated in the “Contact Information” section below. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity.  

**Sharing**. You may choose to delete or revise the Content that you posted on our Services. Please note that our servers may still retain the deleted Content for some time.  

# Third Parties  

Our Services may contain links to other websites, products, or services owned or operated by third parties. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.  

**Retention**  

We take measures to delete your Personal Information or keep it in a form that does not permit identifying you when your Personal Information is no longer necessary for the purposes for which we process it, unless we are required by law to keep your Personal Information for a longer period. When determining the specific retention period, we consider various factors, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and the statute of limitations.  

**Security**  

We make reasonable efforts to protect your Personal Information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, because no electronic transmission or storage of Personal Information can be entirely secure, we can make no guarantees as to the security or privacy of your Personal Information.  

**Children’s Privacy**  

We do not knowingly collect, maintain, or use Personal Information from those under 18 years of age, and no part of our Services is directed to children. If you learn that a child has provided us with Personal Information in violation of this Privacy Policy, then please alert us at <[email protected]> or otherwise as indicated in the “Contact Information” section below.  

**Country/Region-Specific Disclosures**  

<u>Cross-Border Personal Information Transfers - Europe Residents</u>  

Your Personal Information may be transferred to, stored, and processed in a country other than the one where it was collected. We may transfer your Personal Information outside of Europe, including to the United States, to countries that have been found to provide adequate protection by the competent authorities as appropriate, rely on appropriate or suitable safeguards recognized under data protection law, such as standard contractual clauses, or rely on an appropriate legal derogation. For more information about how we transfer Personal Information outside Europe, or to obtain a copy of the contractual safeguards we use for such transfers, you may contact us using the contact details as indicated in the “Contact Information” section below.  

**Update Your Information**  

You can update your account information or close your account through your account settings.  

**Changes to this Privacy Policy**  

**<u>We may update this Privacy Policy from time to time.</u>** We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose Personal Information previously collected from you through our Services, we will make reasonable efforts to notify you through our Services, by email, or other communication.  

**Contact Information**  

Sage is the controller or entity responsible for processing your Personal Information. If you have any questions, comments, or concerns about our processing activities, please email us at [[email protected]](mailto:[email protected]) or write to us at Sage Bionetworks, Attn: Privacy Officer, 2901 Third Ave., Suite 330, Seattle WA 98121, U.S.A