Privacy Policy
The short version
Aver is built so that patient data never reaches us. The platform benchmarks laboratory pipelines against public reference materials (GIAB, SEQC2, GeT-RM); no endpoint, upload or log line accepts a patient identifier, clinical sample name or clinical annotation, and uploads whose sample names do not match a registered public reference material are rejected before anything is stored. What we do process is the minimum needed to run an account.
What we collect
- Account data: your name, work email address, password hash and two-factor enrolment, held by our authentication provider.
- Organisation data: your laboratory's name, members and roles, pipeline names and descriptions, dependency snapshots (tool names, versions, container digests), benchmark metrics against public reference materials, run-level QC metric names and numbers, drift events, evidence packs and the append-only audit log of actions taken in the product.
- Operational data: request logs with IP address, timestamps and request IDs, kept for security and troubleshooting.
- Email: messages you send us, and transactional email we send you (sign-in, alerts you configure).
What we never collect
- Patient genomes, reads, VCFs from clinical samples, or any patient identifier.
- The contents of your pipeline's input or output files. The open-source CLI and the Runner send metrics and metadata only; reads, VCFs and reports stay on your machines.
- Marketing-site analytics cookies. The marketing site sets no cookies and runs no third-party trackers. The application uses only the strictly-necessary storage needed to keep you signed in.
Why we process it
To provide the service under our Terms of Service (contract), to secure it (legitimate interest: abuse prevention, audit integrity), and to meet legal obligations. We do not sell personal data, run advertising, or use your data to train models.
Where it lives (subprocessors)
Aver runs on established infrastructure providers that process data on our instructions: database and authentication hosting, application hosting, content delivery and DNS, job queueing, object storage and transactional email. A current subprocessor list is available on request at [email protected]. Data is encrypted in transit (TLS) and at rest.
Retention
Account and organisation data are kept while your account is active. Evidence packs and the audit log exist to serve as laboratory records: you can export them at any time, and on account closure we delete them after the export window unless you ask us to remove them sooner. Operational logs are kept for a limited period and then deleted.
Your rights
Depending on where you are (including under GDPR and US state privacy laws), you may have the right to access, correct, export or delete your personal data, and to object to or restrict processing. Write to [email protected] and we will respond within the statutory period. If you are in the EU/EEA or UK you may also lodge a complaint with your supervisory authority.
Changes
If this policy changes materially we will note it here with a new effective date and, for significant changes, email account owners.