Privacy Policy

This policy covers the Biosimulant hosted platform, public Hub, Studio on the web, the Biosimulant Studio apps for iOS and Android, our APIs, and related web services. Biosimulant is operated by Nitoons Limited (“Biosimulant”, “we”, or “us”).

What we collect

Biosimulant collects account, workspace, lab, run, billing, and support information needed to provide the hosted simulation platform and public Hub. We also collect operational telemetry to secure the service, understand reliability, and improve performance.

• Account information: your email address, name, and account ID. If you sign in with Apple, Google, or GitHub, we receive your name and email address from that provider.
• Content you create or upload: chat messages and prompts, the replies generated for you, and the files, photos, and voice notes you attach, along with your labs, runs, experiments, and workspace files.
• Notifications: if you turn on notifications in the mobile app, a push token for your device, the platform (iOS or Android), app version, language, device name, and your notification preferences.
• Security and service data: sign-in and account events, request logs, and server error reports, which we use to keep the service secure and working.

The Biosimulant Studio mobile apps

The app only uses your camera, photo library, files, or microphone when you choose to attach something or speak. Photos, files, and voice notes are uploaded to Biosimulant only when you attach them to a chat or add them to your files.

Dictation uses your device's built-in speech recognition (Apple's on iOS, and your device's speech service, usually Google's, on Android). Depending on your device and settings, that service may process your speech on the device or on Apple's or Google's servers under their own privacy terms. Biosimulant does not receive dictation audio, only the text you choose to send. A recording is sent to us only when you record a voice note and attach it to a message.

The app uses Firebase App Check (Apple App Attest or DeviceCheck on iOS, Google Play Integrity on Android) to confirm that requests come from a genuine copy of the app. This check does not include your account details or chat content. If you use chat without an account where that is offered, your chats are stored against a random guest session rather than your identity and are deleted after 30 days without use.

The mobile apps do not contain advertising, analytics, or crash-reporting tools, and they do not track you across other companies' apps or websites. Our websites use Google Analytics for Firebase to understand how the sites are used.

How we use information

We use personal information to authenticate users, operate simulations, generate chat replies, send notifications you have turned on, process support requests, prevent abuse, and meet legal obligations. Public labs, published runs, shared chats, and embed content are visible to other users and visitors according to the sharing settings selected by the owner.

Third-party AI providers

Biosimulant's chat assistant is powered by AI models from third-party providers. When you send a chat message, we send your message, the relevant conversation history, the files and photos you attach, and related workspace context to the model provider so it can generate a reply. We currently use OpenAI (our default) and Anthropic. They process this content on our behalf to generate replies for you. Under the API and commercial terms we use them on, they do not use this content to train their models (see OpenAI's API data controls and Anthropic's commercial terms). They may keep it for a limited time to monitor for abuse, as described in their terms.

Do not include information in a chat that you do not want shared with these providers. AI-generated replies can be wrong, so review them before relying on them.

AI clients you connect

When you connect ChatGPT, Codex, or another AI client, Biosimulant receives the tool arguments that client sends and returns the requested account-scoped results. These can include scientific evidence, workspace files, run inputs, outputs, and Passports. The AI client handles those returned data under its own privacy terms. Connections use your consent and can be revoked from your Biosimulant account. Never include passwords or access tokens in scientific content or prompts.

Sign-in and notification services

You can sign in with Apple, Google, GitHub (on the web), or an email address and password. We use Firebase Authentication, a Google service, to verify Apple, Google, and GitHub sign-ins. When you use Sign in with Apple or Google, that provider also handles your sign-in under its own privacy policy.

Push notifications are delivered through Firebase Cloud Messaging and, on iPhone and iPad, the Apple Push Notification service. You can change which notifications you receive in the app's settings or turn them off in your device settings. Signing out removes your device's push token from your account.

Sharing

We do not sell personal information, and we do not share it for advertising. We share information with infrastructure, compute, AI model, sign-in, notification, payment, analytics, email, security, and support providers only as needed to run Biosimulant and protect the service, and when the law requires it.

Deleting your account

You can delete your account in the Biosimulant Studio app under Settings > Delete account, or by emailing support@biosimulant.com from the address on your account with the subject “Delete my account”. Step-by-step instructions are on our account deletion page.

When you ask us to delete your account, we deactivate it right away: you are signed out on every device, and your API keys, agent connections, and push notifications stop working. We then complete the deletion within 30 days. We delete your sign-in links, devices, integrations, and personal chats with their attachments; remove your personal labs, runs, and files from the service; and replace your name and email address with an anonymous placeholder. Until then, you can cancel by contacting support@biosimulant.com.

Some records are kept after deletion. Labs, runs, chats, and files that belong to a team stay with that team and are shown as created by a deleted user. Published packages that other people's labs depend on and research dataset records stay available without your name. We keep billing and credit records for as long as the law requires, security logs for up to 90 days, and a minimal record of the deletion that does not contain your personal information. Copies in backups and compute storage are removed as they expire.

Your choices and contact

To request access, correction, deletion, or export of personal information, contact support@biosimulant.com.