Privacy Policy

1. Who we are

Lacuna Bio (Lacuna) is operated by 4Front 2 Market AB ("we", "us"), the data controller for the personal data described in this policy. For any privacy matter, including the exercise of your rights, contact us at [email protected].

2. The data we process

We process two distinct categories of personal data:

• Account data for our customers: your email address, authentication credentials (stored only as a salted hash by our authentication provider), your saved lists and searches, and your usage and billing records.
• Professional contact and research data about scientists, clinicians and company representatives. This is business-context data such as name, professional affiliation, public ORCID identifier, fields of research, published works, and, where publicly available, a professional email address.

3. Where the data comes from

The research and professional contact data is compiled from public and openly licensed sources, including ORCID, PubMed, Europe PMC and Semantic Scholar, public clinical-trial and grant registries, patent databases, and the public websites of companies and institutions. We do not purchase data from data brokers, and we do not process special categories of personal data (such as health, ethnicity or political opinions) about the individuals in our research dataset.

4. Why we process it, and our lawful basis

• To provide your account and the service (account data): performance of our contract with you, under Article 6(1)(b) GDPR.
• To provide business-to-business sales intelligence(professional research data): our legitimate interest, and that of our business customers, in identifying relevant scientific contacts in a professional capacity, under Article 6(1)(f) GDPR. We have balanced this interest against the rights of the individuals concerned: the data relates to their professional activity, is drawn from sources they have made public, and is presented only to vetted business users.
• To meter usage and prevent abuse (usage data): our legitimate interest in operating the service securely and billing it correctly.

5. Who we share it with

We do not sell personal data. We share it only with the service providers that run Lacuna on our behalf, under data-processing agreements: our cloud hosting, and the large-language-model provider that powers the in-product assistant. Content you submit to the assistant may be sent to that provider solely to generate your response, and is not used to train their models. Some of these providers may process data outside the EU/EEA, in which case the transfer is covered by the European Commission's Standard Contractual Clauses.

6. How long we keep it

Account data is kept for as long as your account is active and for a reasonable period afterwards to meet legal and accounting obligations. Research data is refreshed from its public sources on an ongoing basis; when a source removes or corrects a record, that change flows through on the next update.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your personal data, and the right to data portability. If you are a professional whose contact or research data appears in Lacuna and you do not wish it to, you may object at any time and we will remove it. To exercise any right, email [email protected] and we will respond within one month. You also have the right to lodge a complaint with your supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY, imy.se).

8. Cookies

We use only the strictly necessary cookies required to keep you signed in. We do not use advertising or third-party tracking cookies, so no consent banner is required for them.

9. Changes

We may update this policy as the service evolves. Material changes will be reflected in the "last updated" date above and, where appropriate, notified to you by email.