Privacy Policy

Lind AI, Inc. ("Lind AI," "we," "us," or "our") provides clinical trial matching technology to healthcare organizations. The responsible stewardship and protection of personal information is a core part of our work. This Privacy Policy ("Policy") explains how we handle personal information through our public website at www.lind.care (the "Site") and our provider-facing clinical trial matching platform (the "Platform"). Together, the Site and Platform are referred to as the "Services."

We do not sell personal information for monetary or other valuable consideration. Any use of customer data to improve the Platform depends on the applicable Customer Agreement, customer authorization, and law, as explained below.

If Lind AI processes consumer health data subject to Washington's My Health My Data Act ("MHMDA"), our Washington Consumer Health Data Privacy Policy provides additional information.

Scope and Our Role

Public Site and business contacts

Lind AI determines how and why personal information submitted through the Site or through direct business communications is processed. For that information, Lind AI acts as a controller or business under applicable privacy law.

Provider-facing Platform

The Platform is deployed for healthcare organizations in separate or logically segregated environments. Customer workforce users must be authorized and invited by the customer. Authorized Lind AI personnel may also access customer information as permitted by the applicable customer agreement, including any business associate agreement ("BAA") or data processing agreement (together, the "Customer Agreement"), and applicable law. Lind AI does not offer patient self-service accounts or a personal health record service, and we do not collect a driver's license or patient photograph to create or verify a Platform account.

Healthcare customers determine the purposes and means of processing patient information in the Platform. When Lind AI processes patient information or protected health information ("PHI") on a customer's behalf, Lind AI acts as that customer's service provider, processor, and, where applicable, business associate. Exemptions depend on the applicable law: for example, MHMDA exempts qualifying information, not automatically every activity of an organization. We process customer information under the Customer Agreement, authorized customer instructions, and applicable law. Patients should direct requests concerning information held by their healthcare organization to that organization. We assist our customers in responding as required by our agreements and applicable law.

What Information We Collect and Maintain

Site visitors and business contacts

You can visit the Site without directly submitting personal information. If you request a demo through the Site, we collect your first and last name, work email address, organization, and any role you provide. The demo form requests business contact details only. If you contact us, subscribe to updates, or otherwise communicate with us, we may collect your name, business contact information, organization, job title, the content of your communication, and other information you choose to provide. Please do not submit patient information or PHI through the demo form, public Site, or general contact channels.

If you send unsolicited health information through a business contact channel, we limit its use to securing and reviewing the submission, responding to your request, and arranging appropriate removal or handling through an authorized channel. We restrict access to personnel who need to handle the matter and address copies held by the providers involved. We do not use this unsolicited health information for marketing, advertising, analytics, product development, or model training.

Authorized Platform users

For workforce users invited to the Platform by a healthcare customer, we may process account and access information such as name, work email address, organization, role, authentication identifiers, permissions, and security and audit logs. We use this information to provision and secure the account, provide the Platform, support the customer, and meet contractual and legal requirements.

Customer-directed clinical data

Healthcare customers may provide or make available patient and clinical information for processing in the Platform, including demographic information, medical records, diagnoses, treatments, medications, laboratory results, and other information used for customer-directed clinical trial matching. The healthcare customer, not the patient, supplies this information to the Platform and controls its processing. The particular information processed depends on the customer's configuration, instructions, and authorized data sources.

Technical and usage data

When you use the Services, we may automatically receive technical information from your browser, device, and network. This may include IP address, browser and device type, operating system, referring and exit pages, pages visited, date and time of access, and security and application event data.

Cookies and Site analytics

The Site uses cookies and similar technologies for operation and to understand Site usage. Google Analytics operates on the public Site and may collect information such as device and browser characteristics, approximate location derived from IP address, pages viewed, and interactions with the Site. We configure the Site's analytics tag with advertising storage, Google Signals, and advertising personalization disabled. We do not place third-party advertising cookies or advertising beacons on the public Site.

You can manage cookies through your browser settings and use the Google Analytics Opt-out Browser Add-on for supported browsers. The add-on limits the collection of visit activity by Google Analytics; it does not remove existing cookies or control other services. Blocking cookies may affect some Site features.

How We Use and Process Your Information

Depending on the context and applicable law, we process personal information to perform our contracts, pursue legitimate business interests, comply with legal obligations, or with consent. We use personal information to:

Operate, provide, secure, maintain, and support the Services;
Provision and administer authorized workforce-user accounts;
Perform customer-directed clinical trial matching and related contracted services;
Improve the Platform, where permitted by the applicable Customer Agreement, customer instructions, and applicable law;
Respond to demo requests, questions, requests, and business communications;
Send requested updates and other communications, including marketing communications where permitted by law;
Monitor performance, prevent misuse, troubleshoot issues, and protect the Services and their users;
Understand use of the public Site and improve the Services;
Comply with contractual, legal, regulatory, audit, and recordkeeping obligations; and
Establish, exercise, or defend legal claims and manage our business.

We may use aggregated or de-identified information only as permitted by the applicable customer agreement and law. We take reasonable measures to ensure de-identified information cannot be associated with an individual, do not attempt to re-identify it, and contractually require any recipient to comply with the same restrictions.

Permitted uses of customer data vary by customer. Where a Customer Agreement permits, we may use customer data to improve the Platform. Any use beyond delivering that customer's services requires authorization under the Customer Agreement and customer instructions and must comply with applicable law, including any requirements that apply to PHI. This Policy and an individual workforce user's acceptance of our Terms do not grant additional rights to use customer data.

Healthcare customers

We make Platform information available to the healthcare customer that authorized the account and directed the processing. The customer controls which of its workforce users may access its environment and patient information.

Service providers and subprocessors

We use service providers for cloud infrastructure, document processing, AI model hosting and inference, authentication, security, business communications, support, and public-Site analytics. The information a provider receives depends on its function and the customer's configuration and authorization. Providers are subject to contractual restrictions appropriate to their role and the information they process.

Platform processing: cloud and document-processing services, including Google Cloud and Document AI, and AI model hosting and inference providers, including Google, OpenAI, and Anthropic, may process customer-authorized clinical information to provide the Platform. Applicable customer and provider agreements govern these data flows.
Authentication: providers such as Clerk process workforce account and authentication information. They are not a channel for submitting patient records.
Business communications and support: email, ticketing, and collaboration providers handle business contacts and inquiries. Demo contact details are recorded in Linear, and Slack receives a notification linking to the request without copying the submitted contact details into the notification. These business channels are not intended for clinical records.
Site analytics: Google Analytics processes public-Site usage information as described above. We do not send demo form field values or customer clinical records to Site analytics.

Customer-directed disclosures

We may disclose customer data when the relevant healthcare customer directs or authorizes us to do so, including as part of a customer-directed clinical trial matching workflow. Lind AI does not independently disclose patient information to clinical trial sponsors for its own purposes.

Legal, safety, and corporate purposes

We may use or disclose personal information when we reasonably believe doing so is necessary to:

Comply with applicable law, regulation, court order, subpoena, or other legal process;
Investigate, prevent, or address fraud, security issues, illegal activity, violations of our agreements, or threats to people, property, or the Services;
Establish, protect, or exercise legal rights or defend against legal claims; or
Evaluate or complete a financing, merger, acquisition, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to appropriate confidentiality protections.

We may disclose aggregated or de-identified information only as permitted by the applicable Customer Agreement and law. We take reasonable measures to ensure de-identified information cannot be associated with an individual, do not attempt to re-identify it, and contractually require any recipient to comply with the same restrictions. We do not sell personal information for monetary or other valuable consideration.

Security for Privacy

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. These include access restrictions based on role and business need, separation or logical segregation of customer information, and procedures for reviewing security risks and responding to incidents. Safeguards are selected according to the sensitivity of the information and the risks involved; no system or transmission can be guaranteed completely secure.

Our confidentiality, security, and incident-notification obligations for customer data follow the Customer Agreement, including any BAA, and applicable law. To report a suspected security issue, contact security@lind.care without including patient information, passwords, or other sensitive details in ordinary email.

Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have rights to confirm whether we process your personal information; access, correct, or delete it; obtain a portable copy; restrict or object to certain processing; withdraw consent; opt out of sale, targeted advertising, or certain profiling; or obtain information about recipients of your personal information.

To exercise a right concerning Site, contact, or other information for which Lind AI determines the purposes of processing, email privacy@lind.care. Please describe your request and your interactions with Lind AI. We may request information reasonably necessary to verify your identity and authority. You may use an authorized agent where permitted by law; we may require proof of authorization and verification of your identity.

If your request concerns patient or clinical information that Lind AI processes for a healthcare organization, please contact that healthcare organization directly. Because the organization controls that information, we will refer the request to it or assist it in responding as required.

We will respond within the period required by applicable law. If applicable law provides a right to appeal our decision, you may submit an appeal to privacy@lind.care with the subject line "Appeal of Privacy Rights Request." You may opt out of marketing emails by using the unsubscribe instructions in the message or emailing us at privacy@lind.care.

For Washington rights that may apply to consumer health data processed by Lind AI as a controller, please review our Washington Consumer Health Data Privacy Policy. Residents of other states, including Nevada, may use the same privacy contact to exercise rights available under their applicable law.

External Links

The Services may contain links to third-party websites or services. Lind AI does not control and is not responsible for their content, security, or privacy practices. Review the privacy notices of third parties before providing information to them.

Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, meet customer instructions and contractual commitments, comply with law, resolve disputes, and enforce agreements. Retention, return, and deletion of customer-directed clinical data are governed by the applicable customer agreement, business associate agreement, documented customer instructions, legal holds, and applicable law. When information is no longer required, we delete or de-identify it using measures appropriate to its sensitivity and the Services.

International Users

Lind AI is based in the United States. Personal information may be transferred to, stored in, or processed in the United States or other countries where Lind AI or its service providers operate. Where required, we use appropriate safeguards for international transfers. Data-protection laws in those countries may differ from the laws where you live.

Children

The public Site is intended for a general business audience and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13 through the Site. Customer Platform accounts are for workforce users authorized by healthcare customers; patients do not create Platform accounts.

Changes to this Policy

We may revise this Policy to reflect changes to the Services, our practices, or applicable law. The version date identifies the reviewed text. This version takes effect when first published on this page, subject to any additional notice, consent, or timing requirements under applicable law or a Customer Agreement. We will post revisions here, update the version date, and provide additional notice or obtain consent where required.

How to Contact Us

For questions, concerns, privacy-rights requests, or appeals, contact Lind AI at privacy@lind.care.