LAB BELAY PRIVACY POLICY

Last Updated: September 4, 2026
Effective Date: September 4, 2026

1. INTRODUCTION AND OVERVIEW

Lab Belay LLC (“Lab Belay,” “Company,” “we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, and security of our users’ personal information and organizational research data.

This Privacy Policy (“Privacy Policy”) describes our practices regarding the collection, use, processing, storage, sharing, and protection of information when you:

• Visit our website at labbelay.bio (the “Site”);
• Register for or access our web-based laboratory operations management platform and self-service SaaS applications;
• Interact with the BeakerAI artificial intelligence assistant, automated protocol engine, and workflow tools;
• Utilize our software APIs, client applications, or in-facility Lab Belay Stations and Belay Devices; or
• Communicate with our customer support, sales, or technical teams.

Collectively, the Site, web platform, BeakerAI, software, hardware, and related support services are referred to as the “Service” or “Services.”

2. GOVERNING CONTRACT, DPA, AND ORDER OF PRECEDENCE

2.1 Commercial and Self-Service Context

The Service is a specialized business-to-business (B2B) and institutional laboratory management platform designed for commercial biotechnology companies, pharmaceutical firms, academic laboratories, research institutions, and individual professional scientists.

2.2 Relationship to Terms of Service and Enterprise Agreements

• For self-service and online subscribers, this Privacy Policy is incorporated into and subject to the Lab Belay Terms of Service.
• If your organization has entered into a separately negotiated SaaS Services Agreement, Master Subscription Agreement, or Order Form (an “Enterprise Contract”) and/or an executed Data Protection Addendum (such as the Bonterms DPA Setup Page), the terms of such Enterprise Contract and DPA shall govern and control in the event of any conflict or inconsistency regarding the processing of Customer Data and Personal Data.

2.3 Role as Data Controller and Data Processor

• Data Processor / CCPA Service Provider: When Lab Belay processes Customer Data (including laboratory inventory, chemical records, experimental metadata, protocol documents, and user inputs) submitted by or on behalf of an enterprise or organizational Customer, Lab Belay acts as a Data Processor (or “Service Provider” under the California Consumer Privacy Act). The Customer acts as the Data Controller (or “Business”).
• Data Controller: Lab Belay acts as a Data Controller with respect to account administrative data, billing information, website visitor telemetry, and direct customer support communications.

3. INFORMATION WE COLLECT

We minimize data collection to align with our commercial laboratory focus. We collect information in the following categories:

3.1 Information You Provide Directly

• Account and Profile Information: When you register for an account or are provisioned access by an organizational administrator, we collect your name, business or institutional email address, organization name, job title, department, and account credentials (such as hashed passwords and authentication tokens).
• Billing and Payment Data: If you purchase a paid subscription, our third-party payment processor (e.g., Stripe) collects and processes your payment card details, billing address, and transaction history. Lab Belay does not store full credit card numbers on its servers.
• Support and Communications: Information you provide when submitting helpdesk tickets, participating in onboarding calls, responding to surveys, or contacting support@labbelay.bio.
• Customer Laboratory Content: Information uploaded or entered into the platform, including chemical inventories (CAS numbers, storage locations, quantities), equipment records (model, serial numbers, maintenance logs), laboratory bench configurations, task lists, and experimental protocols.

3.2 Information Collected Automatically (Telemetry, Proximity, and Operational Data)

When you browse the Site or interact with the Service, we automatically collect technical information:

• Device and Connection Data: IP address, browser type and version, operating system, device identifiers, language preferences, and referring URLs.
• Laboratory Proximity & Bench Location Data: When your facility utilizes in-facility Lab Belay Stations, Belay Devices, or sensor beacons, we collect indoor proximity events, bench-level assignments, device interaction timestamps, and workstation occupancy telemetry. This data is collected solely for operational laboratory management, bench scheduling, task routing, and protocol handoffs within your facility, and is never used for off-premises tracking or consumer geolocation profiling.
• Log and Telemetry Data: Timestamps of access, pages viewed, features accessed, API calls, error logs, latency metrics, and session duration.
• Cookies and Local Storage: We use essential cookies and session tokens strictly necessary for user authentication, session persistence, security verification, and load balancing. We do not use third-party tracking cookies for cross-context behavioral advertising.

3.3 BeakerAI Inputs and Interaction Data

When you use BeakerAI, we process the prompts, queries, parameters, protocol notes, and scientific queries you submit (“Inputs”), as well as the responses generated by the system (“Outputs”).

4. HOW WE USE YOUR INFORMATION

We process personal information and operational data for specific, legitimate business purposes:

5. ARTIFICIAL INTELLIGENCE, BEAKERAI, AND DATA PROTECTION

Lab Belay is built around strict data integrity and privacy principles for laboratory environments:

5.1 Strict Model Training Prohibition on Personal Data

In full accordance with our Bonterms Data Protection Addendum:

Lab Belay shall not use Personal Data to develop, train, fine-tune, or otherwise improve artificial intelligence or machine learning models.

5.2 Inference Processing

When you submit an Input to BeakerAI, your data is processed transiently in real time solely to generate the requested Output (“Inference Processing”). Personal Data submitted during Inference Processing is not incorporated into foundational model weights or permanent model parameters.

5.3 Service Improvement and De-Identified Data

In accordance with our data minimization and privacy principles:

• Lab Belay may analyze aggregated, de-identified Operational Data and system metrics to monitor feature adoption, resolve bugs, improve system latency, and enhance domain-specific laboratory workflow tools.
• Before any data is utilized for internal system optimization or model evaluation, it is processed through industry-standard de-identification procedures to remove all personal identifying information, customer names, organizational identifiers, and proprietary scientific formulations.

5.4 Third-Party AI Sub-processors

To deliver specialized language and reasoning capabilities, Lab Belay may route encrypted inference requests to vetted enterprise AI providers (e.g., enterprise cloud API endpoints). All third-party AI providers are contractually bound by data protection terms ensuring:

• They process data strictly as sub-processors on Lab Belay’s behalf;
• They do not retain customer inputs beyond transient execution; and
• They are strictly prohibited from using customer inputs or outputs to train their public or proprietary models.

Lab Belay maintains an up-to-date list of all authorized third-party sub-processors and AI service providers, which is available to Customers upon request by contacting support@labbelay.bio.

6. HOW WE SHARE AND DISCLOSE INFORMATION

Except as expressly stated in this Privacy Policy, we do not sell, rent, trade, or share your Personal Information with third parties for marketing or advertising purposes.

We disclose information only under the following limited circumstances:

6.1 Sub-processors and Service Providers

We share information with trusted third-party service providers who assist us in operating the platform. These providers are bound by written agreements requiring them to safeguard your data with security controls no less protective than those described herein:

• Cloud Infrastructure & Hosting: Amazon Web Services (AWS) / Google Cloud Platform (GCP) (secure data center hosting, compute, and encrypted database storage);
• Payment Processing: Stripe (PCI-DSS compliant payment processing and subscription billing);
• AI Inference Infrastructure: Enterprise cloud AI endpoints (transient model inference);
• Email & Customer Support: Transactional email and customer helpdesk platforms.

6.2 Organizational Account Administrators

If your account is provisioned under an organizational subscription, the designated Admins of your organization have access to view your user profile, active sessions, bench assignments, and laboratory activity logs within the organization's workspace.

6.3 Legal Compliance and Protection of Safety

We may disclose information if we have a good-faith belief that disclosure is reasonably necessary to:

• Comply with applicable laws, regulations, legal processes, or enforceable governmental requests (such as a valid subpoena or court order);
• Enforce our Terms of Service or investigate potential violations;
• Detect, prevent, or address fraud, security vulnerabilities, or technical malfunctions; or
• Protect against imminent harm to the rights, property, or physical safety of Lab Belay, its users, laboratory personnel, or the public, as required or permitted by law.

6.4 Business Transfers

If Lab Belay is involved in a merger, acquisition, corporate reorganization, asset sale, or bankruptcy proceeding, your account information and customer records may be transferred as a business asset. We will provide notice before your personal information becomes subject to a materially different privacy policy.

7. DATA SECURITY AND SAFEGUARDS

Lab Belay maintains comprehensive administrative, technical, and physical safeguards designed to protect personal information and laboratory data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

• Encryption Standards: All data in transit across public networks is encrypted using Transport Layer Security (TLS 1.3). All persistent data, database records, and backups are encrypted at rest using Advanced Encryption Standard (AES-256).
• Access Control & Authentication: Access to production infrastructure is restricted on a least-privilege basis, requiring multi-factor authentication (MFA), role-based access controls (RBAC), and virtual private network (VPN) access.
• Tenant Isolation: Multi-tenant database architectures logically isolate each customer’s laboratory records and workspace data.
• Audit Logging & Vulnerability Management: Continuous system logging, automated intrusion detection, regular code security reviews, and vulnerability scanning.
• Breach Notification: In the event of a confirmed security incident affecting Customer Personal Data, Lab Belay will notify affected Customers without undue delay and within forty-eight (48) hours of becoming aware of the breach, in accordance with our Data Protection Addendum and applicable law.

8. DATA RETENTION AND DELETION

We retain Personal Information and Customer Data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, provide active subscriptions, comply with statutory obligations, resolve disputes, and enforce our agreements:

• Active Subscriptions: Account information and laboratory records are maintained throughout the duration of your active subscription.
• Post-Termination Deletion: Upon cancellation or termination of a subscription, Customers have thirty (30) days to request an export of their laboratory records. Following this 30-day window, Lab Belay will securely delete, anonymize, or overwrite Customer Data from active production databases in accordance with our retention schedule.
• Archival / Accounting Records: Limited transaction records, billing history, and legal logs are retained for statutory retention periods (typically up to 7 years) to satisfy tax, audit, and regulatory requirements.

9. YOUR PRIVACY RIGHTS AND CHOICES

Depending on your geographic jurisdiction (including the European Economic Area, the United Kingdom, Switzerland, and various U.S. states such as California, Virginia, Colorado, Connecticut, Utah, and Texas), you have specific statutory rights regarding your personal information:

9.1 European / UK GDPR and Swiss FADP Rights

If you are located in the EEA, UK, or Switzerland, you have the right to:

• Access: Request a copy of the personal information we maintain about you.
• Rectification: Request correction of inaccurate, incomplete, or outdated personal information.
• Erasure (“Right to be Forgotten”): Request deletion of your personal information, subject to legal exceptions.
• Restriction: Request that we restrict processing of your personal data in certain circumstances.
• Data Portability: Receive your personal information in a structured, commonly used, and machine-readable format.
• Object: Object to our processing of your personal information based on legitimate interests.
• Lodge a Complaint: Lodge a complaint with your local Data Protection Authority (DPA) or Supervisory Authority.

9.2 California Consumer Privacy Act (CCPA / CPRA) Disclosures

Under the CCPA/CPRA, California residents have the right to:

• Know / Access: Request disclosure of the categories and specific pieces of personal information collected, sources, business purposes, and categories of third parties with whom it was disclosed.
• Delete: Request deletion of personal information collected from you.
• Correct: Request correction of inaccurate personal information.
• Opt-Out of Sale / Sharing: Lab Belay does NOT sell personal information and does NOT share personal information for cross-context behavioral advertising. We do not engage in targeted third-party advertising.
• Non-Discrimination: You will not receive discriminatory treatment or diminished service quality for exercising any of your CCPA rights.

9.3 Exercising Your Rights

To exercise any of your privacy rights, please contact us at support@labbelay.bio with the subject line “Privacy Rights Request.” We will verify your identity and respond within the statutory timeframes prescribed by applicable law (typically 30 or 45 days).

If your personal information was submitted to the Service by an enterprise Customer (acting as Data Controller), please direct your deletion or access request directly to your organization's designated administrator. We will cooperate with our Customers to fulfill verified user requests.

10. INTERNATIONAL DATA TRANSFERS

Lab Belay is based in the United States and operates hosting infrastructure within the United States. If you access the Services from the European Union, United Kingdom, Switzerland, or other regions with comprehensive data protection laws:

• Your personal information will be transferred to, stored, and processed in the United States.
• Where required by applicable law for cross-border transfers, Lab Belay implements appropriate transfer mechanisms, including the European Commission Standard Contractual Clauses (SCCs) (Module 2 Controller-to-Processor and Module 3 Processor-to-Processor) and the UK International Data Transfer Addendum, as incorporated into our Bonterms Data Protection Addendum.

11. CHILDREN’S PRIVACY

The Service is strictly designed for professional and institutional laboratory research and operations. The Service is not directed to children, minors, or individuals under eighteen (18) years of age. We do not knowingly collect or solicit personal information from individuals under 18. If we learn that we have inadvertently collected personal information from a minor, we will delete that information immediately. If you believe a minor has provided us with personal information, please contact us at support@labbelay.bio.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our platform features, legal requirements, or privacy practices.

• When we make changes, we will update the “Last Updated” date at the top of this page.
• If we make material modifications that significantly affect your rights, we will provide at least thirty (30) days’ advance notice by sending an email notification to the primary administrative contact for your account or by posting a prominent notice on our Site prior to the changes taking effect.
• Non-material changes or clarifying edits will take effect immediately upon posting.

13. CONTACT INFORMATION

If you have any questions, concerns, feedback, or requests regarding this Privacy Policy, our data practices, or our Bonterms Data Protection Addendum, please contact our privacy team at:

Lab Belay LLC
78 W Sharpnack St
Philadelphia, PA 19119
United States
Attn: Privacy & Data Protection Officer
Email: support@labbelay.bio