Skip to content

Privacy Policy

Last updated: 22 July 2026

This Privacy Policy explains how UMMS Biocore collects, uses, stores, and protects personal data when you use the Foundry Connect instance operated by UMMS Biocore, and describes the rights you have over that data. It is written to meet the transparency requirements of the General Data Protection Regulation (GDPR), and the rights described below are extended to all of our users.

Which deployment this policy covers

Foundry Connect can be self-hosted — installed and operated by another organization on its own infrastructure or in its own cloud account.

  • This policy applies only to the instance operated by UMMS Biocore.
  • If you access Foundry Connect through your own institution, employer, or another provider, that organization is the data controller for your personal data, and its privacy policy governs — not this one. UMMS Biocore has no access to the data held in deployments it does not operate. Contact that organization's administrator or privacy contact for their policy.

Policy Contents

Who We Are

For the instance we operate, the data controller is UMMS Biocore, the Bioinformatics Core at the University of Massachusetts Chan Medical School. You can reach us at biocore@umassmed.edu for any question about this policy or about your personal data.

Data Collection

UMMS Biocore collects the following personal data:

  • Identity and contact data — your name, email address, and affiliated organization
  • Account data — your credentials and account settings
  • Application data — the pipelines, runs, projects, and files you create or upload, together with the activity logs needed to operate and support the service

Data Gathering Methods

We collect data only from you, through the following means:

  • Registering for, or requesting access to, our services
  • Using services hosted by UMMS Biocore
  • Viewing or using our website, through the cookies described below

Under the GDPR we must have a lawful basis for each purpose. Ours are:

Purpose Legal basis
Creating and administering your account; providing the service you requested Performance of a contract (Art. 6(1)(b))
Operating, maintaining, and securing the platform; preventing abuse; keeping audit and activity logs Legitimate interests (Art. 6(1)(f)) — running a reliable, secure research platform
Allocating and optimizing application resources Legitimate interests (Art. 6(1)(f))
Complying with legal, institutional, and research-governance obligations Legal obligation (Art. 6(1)©)

Where we rely on legitimate interests, we have considered the impact on you and do not process your data in ways you would not reasonably expect. You may object to that processing — see Data Protection Rights.

Is providing this data required? Yes, in practice. Account data is necessary to create an account and give you access; without it we cannot provide the service.

Data Storage and International Transfers

Your data is stored on institutional infrastructure operated by UMMS Biocore at the University of Massachusetts Chan Medical School, in the United States.

For users in the EEA, the UK, and Switzerland

Our service is hosted in the United States, so if you use it from outside the US, the data you provide is stored on US infrastructure. You provide it to us directly — we do not receive it from an intermediary in your country, and we do not pass it on to further countries. Questions about where your data lives are welcome at biocore@umassmed.edu.

Data Retention

We keep your personal data only as long as we need it:

  • Account and identity data — for as long as your account is active.
  • Application data (pipelines, runs, files) — for as long as your account is active, or until you delete it.
  • Security, audit, and activity logs — for as long as needed to operate and secure the service.

  • Access tokens — these expire automatically:

    • Personal access tokens expire 30 days after creation by default. You may set a shorter period when you create one, up to a maximum of one year.
    • Tokens issued by the "Connect to Claude" authorization flow expire 90 days after you authorize.

    An expired token stops working and can no longer be used to reach your data. You can delete any token yourself, at any time, from your Personal Access Tokens page.

After an account is closed, we delete or anonymize personal data unless we are required to retain it to meet a legal, institutional, or research-governance obligation. You may request deletion at any time — see Data Protection Rights.

Data Sharing

We do not sell your personal data, and we do not share it with partner companies for their own purposes. We may disclose data only where we are legally required to do so, or to service providers acting on our instructions who are bound to protect it.

Security

We apply appropriate technical and organizational measures to protect your personal data, including encrypted connections, authenticated and role-based access control, and access restricted to personnel who need it. No system can be guaranteed completely secure, but we work to protect your data and to respond promptly if a problem arises.

Automated Decision-Making

We do not use your personal data for automated decision-making or profiling that produces legal effects concerning you, or that similarly significantly affects you.

Data Protection Rights

UMMS Biocore wants you to be fully aware of your data protection rights. You are entitled to the following:

  • Right of access — You may request copies of your personal data. The first copy is provided free of charge. We may charge a reasonable fee based on administrative costs only for additional copies, or where a request is manifestly unfounded or excessive.
  • Right of rectification — You may ask us to correct data you believe is inaccurate, and to complete data you believe is incomplete.
  • Right of erasure — Under certain conditions, you may ask us to delete your personal data.
  • Right to restrict processing — Under certain conditions, you may ask us to limit how we process your personal data.
  • Right to object to processing — Under certain conditions, you may object to our processing of your personal data, including processing based on legitimate interests.
  • Right to data portability — Under certain conditions, you may ask us to transfer the data we have collected to another organization, or directly to you.

To exercise any of these rights, email us at biocore@umassmed.edu. We respond within one month. That period may be extended by up to two further months where a request is complex or where we have received a number of requests; if so, we will tell you within the first month and explain why. Exercising these rights is free of charge.

Right to lodge a complaint

If you believe we have not handled your personal data properly, you have the right to complain to a data protection supervisory authority — in the EEA or the UK, the authority in the country where you live or work. We would appreciate the chance to address your concern first, at biocore@umassmed.edu.

Cookies

Cookies are small text files placed on your device that let a website recognize your browser between requests. For general background on cookies, see allaboutcookies.org.

Cookies We Use

We use only strictly necessary cookies. We do not use advertising, analytics, tracking, or third-party cookies, and we do not track you across other websites.

Cookie Purpose
foundry-connect-cookie (and the legacy viafoundry-cookie) Keeps you signed in
jwt-vsso, vsso_authorization.sid, jwt-vfoundry Single sign-on and session management
VF_SPJSESSION Maintains your session when you launch an interactive application
OAuth authorization cookies Complete an authorization you started, and protect it against cross-site request forgery

These cookies are essential to sign you in and keep the service secure. Because they are strictly necessary to deliver a service you have requested, they do not require your consent — and for that reason we do not show a cookie consent banner.

Managing Cookies

You can set your browser to refuse cookies or to delete cookies already stored; your browser's help pages explain how. Note that our cookies are required to sign in — if you block them, you will not be able to log in or use the service.

Third-Party Privacy Policies

Our website may contain links to other websites. This privacy policy applies only to our own site and service, so if you follow a link elsewhere, we encourage you to read that site's privacy policy.

Policy Modifications

UMMS Biocore reviews this privacy policy regularly and posts any modifications on this page. The Last updated date at the top of this page reflects the most recent change.

Contact Information

For any question about this privacy policy, the data we hold about you, or to exercise one of your data protection rights, contact us by email at biocore@umassmed.edu.