Privacy Policy

Last updated: October 8, 2026

1. Introduction and scope

Coralis Bio, Inc. ("Coralis," "we," "us") provides an AI-powered regulatory intelligence platform for cell and gene therapy developers (the "Service"), currently offered through a free, invitation-only beta. This Privacy Policy explains how we handle personal information when you visit coralis.bio, use the Service, attend our events, or contact us. Capitalized terms not defined here have the meanings in our Terms of Service.

We handle two kinds of information in different roles:

• Customer Data is what your organization and its users submit to the Service, such as documents, data, prompts and files ("Customer Content"), plus the AI-generated results ("Outputs"), together with the search indexes and embeddings derived from them. We process Customer Data only to provide the Service to the organization it belongs to, on that organization's instructions, acting as its service provider (Terms, Section 6.9). Our Terms govern Customer Data and control if anything here conflicts with them.
• Account, usage and business contact information is what we need to run the Service and our business, such as your name, email, login activity and support requests. For this information, we are the controller.

This policy is about personal information. Your organization's proprietary scientific and business information is also protected by the confidentiality terms in our Terms of Service. We describe our safeguards here because the same controls protect both.

2. Our core commitments

Your data trains nothing, never goes to a public AI API, and stays in a private workspace that only your organization can use. Specifically:

• No training, ever. We never use Customer Data to train, fine-tune, evaluate or otherwise improve any AI model, ours or anyone else's, including in anonymized, aggregated or de-identified form (Terms, Section 6.4).
• No public AI APIs. We process Customer Data with AI only through Amazon Bedrock within our own AWS environment, never through public AI services such as OpenAI's or Anthropic's public APIs.
• A private workspace. Your Customer Data is kept in a logically separated workspace, in its own database schema, that only the users your organization invites can access. It never informs another customer's results.
• Shared knowledge comes only from public sources. The regulatory knowledge available to all customers is built from public material: regulations, FDA and other agency guidance, approval documents and published literature. Nothing from any customer is added to it.
• Staff access only with your permission, apart from narrow security and legal exceptions (Section 5).
• Analytics without content. Our product analytics provider receives your name, email, approximate location and product usage events, never the contents of your documents, prompts or Outputs.
• No selling. We do not sell personal information or share it for targeted advertising.
• Real deletion. After your organization leaves, we delete its Customer Data, including search indexes and embeddings, within 30 days and schedule deletion of its encryption keys (Section 9).

3. Information we collect

We collect only what we need to provide, secure and support the Service.

Data you must not upload. Section 4 of our Terms lists restricted data that must not be submitted to the Service. In short: information that directly identifies a patient, donor or study subject, including protected health information; subject-level clinical data; other sensitive personal information, such as government identifiers, financial account numbers, or genetic or biometric data about identifiable individuals; and classified or export-controlled technical data. Coded manufacturing and donor identifiers, such as chain-of-identity numbers and donor codes, and coded genomic or characterization data about donor material or cell lines, are permitted when only your organization or its partners hold the key linking them to a person. If restricted data is uploaded by mistake, tell us at privacy@coralis.bio and we will remove it. We do not intentionally collect sensitive personal information.

4. How we use information

We use Customer Data only to provide the Service to the organization it belongs to; everything else below uses account and usage information.

AI outputs support human decisions. The Service produces drafts and analysis for review by qualified people. We do not make automated decisions that have legal or similarly significant effects on individuals.

5. How AI processing works

Every AI request runs through Amazon Bedrock in our own AWS account, reached over AWS PrivateLink so the traffic does not cross the public internet.

• Models. We use foundation models, including Anthropic's Claude models, provided through Amazon Bedrock in AWS regions in the United States. Bedrock may route a request to any of those US regions to balance capacity. The models are AWS-managed infrastructure; they do not learn from or remember your requests.
• What AWS commits to. Per AWS's Bedrock data protection documentation, Bedrock does not store or log prompts and completions, does not use them to train models, and does not share them with third parties. Model providers such as Anthropic have no access to Bedrock prompts or outputs.
• Our configuration. Bedrock model-invocation logging is disabled. We do not fine-tune or customize any model with Customer Data.
• Search and retrieval. To find relevant material, we convert your documents into numerical representations (embeddings) using Amazon Titan embedding models in Bedrock. Embeddings are stored in your organization's database schema alongside the documents they come from, and are deleted with them.
• What a request can see. Each AI request draws only on the public regulatory knowledge base and your own organization's Customer Data. It cannot retrieve another customer's data.
• Staff access. Coralis personnel view Customer Data only with your organization's permission, for example to provide support you ask for or to help with an export, or when strictly necessary to respond to a security incident or threat, investigate a suspected breach of the acceptable-use or restricted-data rules in our Terms, or comply with law. Your administrators grant and revoke that permission in the Service, and every such access is logged (Terms, Section 6.5). Automated processing by the Service is not staff access.
• Review AI outputs. AI-generated content can be incomplete or wrong. It is a starting point for qualified professionals, not a substitute for their judgment or for regulatory advice (Terms, Section 5).

6. Product analytics (PostHog)

We use PostHog to see which features are used and to diagnose problems. It never receives the contents of your documents, prompts or Outputs, or anything else in the right-hand column below, apart from one narrow case in crash reports explained after the table.

We enforce this in configuration, not just policy. Automatic event capture excludes on-screen text and form inputs, and session recording is turned off. Crash reports are rebuilt in your browser before they are sent: the text of an error message is replaced by a category, and only the error type, where in our code it happened and, for some errors, the name of the property involved (such as “title”) are kept. That name normally comes from our code. Occasionally our code names a property after a value from your data, such as a field name you created; if that property is involved in a crash and the value is a single word or code of up to 41 letters, digits or underscores, it is sent as the property name. Any other value is replaced with “[dynamic]”. Page addresses and titles identify documents by ID, not by name. Your IP address is used to estimate location and is then discarded. PostHog stores this data in its US cloud under a data processing agreement with us, for up to 12 months.

In the UK and EEA, we set analytics cookies only after you consent. You can change your choice at any time in the Service's cookie settings.

7. How we share information

Within the Service, only AWS processes Customer Data on our behalf; our other providers receive account, usage or contact information.

Please share documents through the Service rather than by email, so they stay in your private workspace.

Each sub-processor is bound by a written agreement that limits use of the data to the service it provides and prohibits training its own models on Customer Data. We give organizations at least 30 days' notice before adding or replacing a sub-processor that processes Customer Data, including our AI service, and an organization that objects can end its participation before the change takes effect (Terms, Section 7.2).

We otherwise share information only:

• Within your organization, according to the permissions your administrators set.
• With your consent or at your direction, for example when you export a document.
• For legal reasons, when required by law, subpoena or court order. We will notify the affected organization before disclosure unless the law forbids it, disclose only what is required, and may challenge overbroad requests (Terms, Section 9.3).
• In a corporate transaction, such as a merger or acquisition. The new owner must agree to be bound by our Terms, and your organization will be notified and can export its data, have it deleted and leave (Terms, Section 8.5).

8. Security

Each organization's Customer Data lives in its own database schema, is encrypted in transit and at rest, and staff access to it is logged.

• Separate workspaces. Each organization's Customer Data is kept in a dedicated database schema, and every application query is scoped to a single organization.
• Encryption. Customer Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Uploaded files are also encrypted with keys specific to your organization.
• Private networking. Our databases and AI processing have no public endpoints; services communicate over private AWS networking.
• Access control. Users sign in through our authentication provider, and your administrators control who can access your workspace. Coralis staff get only the access their role needs, use multi-factor authentication, and their access to Customer Data is logged.
• Activity logs. The Service records prompts, Outputs and related activity, with timestamps and the user involved, and includes them in exports. These are not audit trails under 21 CFR Part 11, and the Service is not validated as a GxP system (Terms, Sections 5.7 and 6.7).
• Backups. Encrypted backups for disaster recovery are stored in a separate US region and kept for no more than 35 days on a rolling basis.
• Incidents. If we confirm a security incident affecting Customer Data, we will notify your organization's administrators without undue delay and within 72 hours (Terms, Section 7.4).

No system is perfectly secure. Please protect your credentials and tell us at security@coralis.bio if you suspect a problem.

9. Export, retention and deletion

You can export your Customer Data at any time, and we delete it within 30 days after your organization's participation ends.

Your administrators can export all Customer Data, including activity logs, in standard formats at any time, including during the 21-day window after participation ends. On request, we will confirm deletion in writing. We do not keep anonymized or aggregated copies of Customer Data after deletion. If your organization signs commercial terms with us before the export window closes, its Customer Data carries over under those terms instead of being deleted.

If Coralis shuts down or is acquired. Customer Data is not our asset, and we will not sell it as one. If we ever discontinue the Service, we will give at least 90 days' notice and keep the Service available for export until then. If we transfer the Service to another company, that company must agree to be bound by our Terms, and your organization will have 60 days after notice to export its data, have it deleted and leave (Terms, Section 8).

10. Where your information is processed

The Service and all Customer Data are hosted in the United States, and our team works from the United States and the United Kingdom. Staff in either country may access Customer Data only under the rules in Section 5.

During the beta, the Service is offered to organizations in the United States. If you visit our website or contact us from the UK, EEA or Switzerland, your personal information is processed in the United States, where data protection laws may differ from yours, and we protect it as this policy describes. Before any organization outside the United States joins the Service, we will put a data processing agreement with appropriate transfer safeguards in place.

11. Your privacy rights

Email privacy@coralis.bio with "Privacy Rights Request" in the subject line; we will verify your identity and respond within the time the law allows.

Customer Data. Your organization controls its Customer Data, so please send requests about it to your organization's administrator. We will help them respond.

Everyone can ask us to access, correct, delete or export their personal information, and can opt out of marketing emails at any time.

UK, EEA and Swiss residents also have the right to object to or restrict processing, to data portability, and to withdraw consent. We respond within one month, extendable by two months for complex requests. You may complain to your data protection authority, such as the UK Information Commissioner's Office.

California and other US state residents have rights to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share personal information for targeted advertising, and we do not use sensitive personal information for purposes that would require a right to limit it. We respond within 45 days, and we will not discriminate against you for exercising your rights. You may use an authorized agent. We honor Global Privacy Control signals.

12. Cookies, children, changes and contact

Cookies. In the Service, we use strictly necessary cookies to keep you signed in and secure, and PostHog analytics cookies as described in section 6. We do not use advertising cookies or cross-site tracking.

Website analytics. On our public website, coralis.bio, we use Google Analytics, provided by Google LLC, to count visits and see which pages are read. It sets first-party cookies (_ga and _ga_<ID>) that last up to two years, and it receives the pages you view, which of our contact links you click and where on the page they sit, your approximate location, and your browser and device type. It receives no account information or Customer Data. We turn off Google's advertising features, ad personalization and Google signals.

• UK, EEA and Swiss visitors: we ask first, and these cookies are set only if you accept. Our legal basis is your consent.
• Visitors elsewhere: these cookies are set by default, and you can decline at any time.
• Changing your choice: use Cookie preferences in the site footer. Declining removes the Google Analytics cookies from your browser.
• Global Privacy Control: if your browser sends this signal, we treat it as a decline.
• Your choice: we keep it in your browser's local storage (coralis-cookie-consent) and ask again after 12 months.

Children. The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect children's personal information.

Changes. We will notify you by email or in the Service at least 30 days before a material change takes effect, unless a change is needed sooner to comply with law or address a security risk. No change will weaken our commitments on AI training, security, business continuity or deletion for Customer Data already in the Service (Terms, Section 18.2).

Contact.

Coralis Bio, Inc.
5251 South 2100 East, Salt Lake City, UT 84117
Privacy: privacy@coralis.bio
Security: security@coralis.bio