Privacy Policy

1. Controller

The controller within the meaning of the GDPR is the operator, see the Legal Notice.

2. What data we store

• Account: email, password (bcrypt hash), optional display name and institution.
• Your own domains / constructs: the CAR-T sequences and metadata you create.
• API keys: if you provide your own Anthropic/OpenAI key, it is stored encrypted (Fernet) in the DB.
• Usage data: number of AI full analyses per month (for quota management).

3. Processing by third parties

For full analyses, amino-acid / DNA sequences are transmitted to the following services:

• NCBI (Bethesda, USA) — BLAST + PubMed search
• Anthropic / OpenAI / Google (depending on provider choice) — AI evaluation
• Europe PMC / Semantic Scholar — literature search
• EPO / The Lens (optional) — patent search
• EMBL-EBI (Hinxton, UK) — BLAST fallback; only queried when NCBI is congested or unreachable

Important: Sequences you analyze are sent over the internet to these third parties. Do not submit confidential, patent-protected or unpublished constructs, and no patient-identifiable sequence data without appropriate agreements. Patient-related genetic data constitutes sensitive personal data (Art. 5 lit. c FADP) and a special category of personal data (Art. 9 GDPR); processing such data through this service is neither intended nor permitted.

4. Applicable law and legal bases

The operator is domiciled in Switzerland, so the Swiss Federal Act on Data Protection (FADP) applies. Insofar as the service is directed at users in the EU/EEA, the GDPR applies in addition (Art. 3(2)(a) GDPR).

Account data is processed to perform the contract (Art. 6(1)(b) GDPR; Art. 31(2)(a) FADP). Sequences are transmitted to the services listed in section 3 solely on the basis of your explicit consent (Art. 6(1)(a) GDPR; Art. 6(6) FADP). It is obtained in a dedicated dialog before your first full analysis, naming the recipients, the destination countries and the risks; the grant is logged with its timestamp and wording (Art. 7(1) GDPR). Without a recorded consent the server refuses to run a full analysis. You may withdraw at any time with effect for the future — one click in Settings; analyses already performed are not undone (Art. 7(3) GDPR). If the set of recipients changes, existing consent ceases to apply and is obtained afresh.

5. Transfers abroad

Some of the services listed in section 3 are located outside Switzerland and the EU/EEA:

• United Kingdom (EMBL-EBI, Europe PMC): transfer based on the adequacy decisions (Art. 45 GDPR; Art. 16(1) FADP in conjunction with Annex 1 DPO).
• USA — certified recipients (AI providers, insofar as certified under the EU-U.S. / Swiss-U.S. Data Privacy Framework): transfer based on the corresponding adequacy decisions (Art. 45 GDPR; Art. 16(1) FADP).
• USA — NCBI (National Center for Biotechnology Information, NIH/NLM): as a U.S. federal agency, NCBI is not certified under the Data Privacy Framework, and standard contractual clauses cannot be concluded with it. The transfer therefore relies solely on your explicit consent after having been informed of the risks (Art. 49(1)(a) GDPR; Art. 17(1)(a) FADP).
• Australia (The Lens, optional patent search): no adequacy decision; transfer only with explicit consent (Art. 49(1)(a) GDPR; Art. 17(1)(a) FADP).

Risk notice: In the cases above without an adequacy decision, protection equivalent to that of Switzerland or the EU is not guaranteed. In particular, U.S. authorities may access transmitted data under surveillance powers (including 50 U.S.C. § 1881a — FISA Section 702 — and Executive Order 12333) without effective remedies being available to you. Enforcement of your data subject rights may be practically impossible there.

6. Storage location + hosting

Server hosting with Hetzner Online GmbH, data center in Germany. Database backups remain within the EU.

7. Cookies

We set a single technically necessary cookie (cartcheck_token) for the login session. No tracking, no analytics, no advertising.

8. Your rights

You have the right to information, rectification, erasure, restriction of processing, data release or portability, and to object (Art. 25 et seq. FADP; Art. 15–21 GDPR). You also have the right to lodge a complaint — in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC), in the EU with the supervisory authority of your country of residence. Please write to admin@car-t-check.com.

9. Delete account

Upon request to admin@car-t-check.com, your account will be irreversibly deleted including all domains, groups and stored API keys.

Last updated: 26 July 2026