Privacy Policy

Last updated: March 10, 2026

1. Introduction

NousLab ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered medical research platform.

2. Data Controller

The data controller responsible for your personal data is:

  • Name: Jesus Arias Romero
  • NIF: 46605472C
  • Address: August Rodin, 10, 43850 Cambrils (Tarragona), Spain
  • Email: privacy@nouslab.org

3. Information We Collect

3.1 Information You Provide

  • Account information (name, email, organization)
  • Research data you upload to the platform (papers, documents)
  • Hypotheses and protocols you create
  • Contact form submissions (name, email, organization, message)
  • Communications with our support team

3.2 Automatically Collected Information

  • Usage data (features accessed, time spent)
  • Technical data (IP address, browser type, device information)
  • Cookies and similar tracking technologies (see our Cookie Policy)

3.3 Analytics

We use Google Analytics 4 to understand how visitors interact with our website. This service collects:

  • Pages visited and time spent
  • Geographic location (country/city level)
  • Device and browser information
  • Referral sources

Google Analytics only activates after you accept cookies. You can opt-out using the Google Analytics Opt-out Browser Add-on.

3.4 Security Services

We use Google reCAPTCHA v3 to protect our forms from spam and abuse. This service may collect:

  • IP address
  • Browser and device information
  • Interaction patterns

For more information, see Google's Privacy Policy.

4. AI Processing of Your Data

Our platform uses artificial intelligence to process your research data:

  • Paper Analysis: Documents you upload are processed by AI to extract insights, generate summaries, and identify key findings.
  • Hypothesis Generation: AI algorithms analyze your data to suggest research hypotheses.
  • Protocol Building: AI assists in creating research protocols based on your inputs.

Important: Your research data may be processed by third-party AI providers (such as OpenAI, Anthropic, or Google) depending on your organization's configuration. These providers process data according to their respective privacy policies and data processing agreements. Alternatively, your organization can use Ollama for fully on-premise AI processing, where data never leaves your infrastructure. Your organization administrator can configure which AI providers are used.

5. How We Use Your Information

We use your information to:

  • Provide and improve our AI research platform
  • Process and analyze research papers using AI
  • Generate hypotheses and build protocols
  • Respond to contact form inquiries
  • Communicate with you about our services
  • Ensure security and prevent fraud
  • Comply with legal obligations

6. Legal Basis for Processing (GDPR)

We process your personal data based on:

  • Contract: To provide the services you have requested
  • Consent: For analytics cookies and marketing communications
  • Legitimate interest: For security, fraud prevention, and service improvement
  • Legal obligation: To comply with applicable laws

7. Data Security

We implement industry-standard security measures to protect your data:

  • SSL/TLS encryption for data transmission
  • Encrypted storage of research data
  • Access controls and authentication protocols
  • Regular security reviews
  • Secure hosting infrastructure

8. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), you have the following rights:

  • Right to access: Request a copy of your personal data
  • Right to rectification: Correct inaccurate data
  • Right to erasure: Request deletion of your data ("right to be forgotten")
  • Right to data portability: Receive your data in a structured format
  • Right to object: Object to certain processing activities
  • Right to restrict processing: Limit how we use your data
  • Right to withdraw consent: Withdraw consent at any time

To exercise these rights, contact us at dpo@nouslab.org.

9. Data Retention

We retain your personal data only for as long as necessary:

  • Account data: Until account deletion or 2 years of inactivity
  • Research data: Until you delete it or your organization's subscription ends
  • Contact form data: 2 years from submission
  • Analytics data: 14 months (Google Analytics default)

10. Sharing Your Information

We do not sell your personal information. We may share data with:

  • AI Providers: To process your research data (OpenAI, Anthropic, Google, or Ollama for on-premise, as configured)
  • Service providers: Hosting, email, and analytics services (under strict confidentiality)
  • Your organization: Organization administrators can access organization data
  • Legal authorities: When required by law

11. International Data Transfers

Your data may be transferred to and processed in countries outside the EEA, including the United States (for AI processing). We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

12. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or platform notification. The "Last updated" date indicates when changes were last made.

14. Contact Us

For privacy-related questions or to exercise your rights:

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

AI