Privacy Policy
How Husk Labs collects, protects, processes, and governs personal data, scientific telemetry, and enterprise metadata across global jurisdictions.
1. Scope & Data Controller Details
This Privacy Policy applies to the data processing practices of Husk Labs Private Limited and its global affiliates (collectively "Husk Labs", "we", "us", or "our"). It governs personal data and technical metadata collected through our primary domain (husklabs.co), client discovery channels, consultation platforms, technical whitepapers, and customer portal interfaces.
For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), the United Kingdom Data Protection Act 2018 / UK GDPR ("UK GDPR"), and the Swiss Federal Act on Data Protection (FADP), Husk Labs acts as the Data Controller with respect to personal information collected directly from website visitors, prospective enterprise partners, webinar attendees, and general business contacts.
When delivering contracted software engineering, bioinformatics pipeline execution, cloud infrastructure automation, or GxP data platform services to enterprise clients, Husk Labs acts primarily as a Data Processor (or Service Provider under US State privacy laws, and Business Associate under HIPAA) subject to executed Data Processing Agreements (DPAs) and Master Services Agreements (MSAs).
2. Categories of Personal Data Collected
We collect personal data in three primary ways: information you explicitly submit to us, data generated automatically through your interaction with our digital platforms, and technical metadata gathered during enterprise communications.
| Category | Specific Data Elements | Collection Source |
|---|---|---|
| Contact & Identity | Full name, business email address, direct phone number, professional mailing address. | Contact forms, discovery booking, email inquiries. |
| Professional & Affiliation | Employer name, department, job title, scientific specialization, project timeline estimates. | Scoping questionnaires, discovery calls, event registrations. |
| Technical Telemetry | IP address, browser type and version, operating system, referrer URL, device identifiers, session timestamps. | Automated server logs, privacy-preserving web analytics. |
| Commercial & Financial | Corporate billing address, VAT/tax identification numbers, contract signatory details, payment transaction logs. | Vendor onboarding, procurement, contractual execution. |
Notice: We do not knowingly collect sensitive financial account numbers or raw credit card data on our public website. All commercial payments are processed via verified corporate electronic funds transfer (EFT/ACH/Wire) under formal invoicing.
3. Scientific, Clinical & Regulated Health Data Governance
Our public website (husklabs.co) does not collect, ingest, or store Protected Health Information (PHI), raw genomic datasets, patient medical records, or active clinical trial records.
In the scope of our commercial consulting and engineering services for biotechnology, biopharmaceutical, and life sciences clients:
- HIPAA / HITECH Compliance: When engagements require access to or engineering of environments handling electronic Protected Health Information (ePHI) as defined under the US Health Insurance Portability and Accountability Act (45 CFR § 160.103), Husk Labs enters into a formal Business Associate Agreement (BAA) before receiving any data access.
- De-Identification & Anonymization: Where feasible, client data processed in development or staging environments must be fully anonymized or de-identified pursuant to the HIPAA Safe Harbor method (45 CFR § 164.514(b)(2)) or Expert Determination method (45 CFR § 164.514(b)(1)), or the European Data Protection Board (EDPB) guidelines on anonymization.
- GxP & Electronic Records (FDA 21 CFR Part 11): Scientific workflows developed for regulatory submissions comply with Good Laboratory Practice (GLP), Good Clinical Practice (GCP), and Good Manufacturing Practice (GMP) requirements, incorporating audit trails, electronic signature integrity, and computerized system validation (CSV/CSA).
4. Legal Bases for Processing (GDPR & UK GDPR)
Under European and United Kingdom data protection law (GDPR/UK GDPR Article 6), we must establish a recognized lawful basis for processing personal data:
Processing necessary to perform our obligations under an agreement with you or to take preliminary steps at your request prior to entering into a Master Services Agreement (e.g., scoping calls, technical diagnostics).
Processing necessary for our legitimate commercial interests in securing our digital infrastructure, preventing fraud, conducting technical analytics, and communicating B2B marketing updates (subject to your right to object).
Processing necessary to comply with applicable statutory obligations, tax filings, trade sanctions screening, export administration regulations, and lawful government subpoenas.
Where you have provided affirmative consent, such as opting into scientific research newsletters, whitepaper downloads, or specific cookie tracking categories (which may be withdrawn at any time).
5. Purposes & Processing Methods
Husk Labs processes personal data solely for defined, transparent business and engineering purposes:
- Diagnostic Scoping & Proposals: Evaluating client operational bottlenecks, data pipeline requirements, and instrument integration architectures to prepare tailored milestone proposals.
- Service Execution & Delivery: Provisioning dedicated software environments, continuous integration/continuous deployment (CI/CD) pipelines, and collaborative communication channels.
- Infrastructure Security & Telemetry: Monitoring website server availability, enforcing Web Application Firewall (WAF) rate limits, detecting brute-force intrusions, and ensuring zero unauthorized system access.
- Regulatory & Legal Governance: Maintaining auditable records of contractual agreements, nondisclosure agreements (NDAs), intellectual property assignments, and compliance logs.
- Professional Communication: Responding to inquiries submitted through our contact form, coordinating discovery calls, and providing technical notices concerning service updates.
Automated Decision-Making & Profiling: Husk Labs does not subject visitors or clients to automated decision-making or profiling that produces legal or similarly significant effects under GDPR Article 22.
6. Data Sharing & Sub-processors
We disclose personal data strictly to vetted service providers and sub-processors bound by stringent confidentiality and data protection agreements:
- Cloud Infrastructure & Hosting: Enterprise cloud providers (e.g., Amazon Web Services, Google Cloud Platform, Microsoft Azure, Vercel) operating under SOC 2 Type II and ISO 27001 certifications.
- Professional Communications & Scheduling: Secure enterprise email providers, video conferencing platforms, and calendar scheduling integrations.
- Legal & Compliance Advisors: External legal counsel, certified public accountants, and independent compliance auditors bound by professional duties of confidentiality.
- Statutory Authorities: Law enforcement, regulatory bodies, or judicial courts only when legally compelled by a valid subpoena, court order, or applicable statutory mandate.
- Corporate Transactions: In the event of a merger, acquisition, corporate reorganization, or asset divestiture, subject to standard non-disclosure safeguards and continuity of this Privacy Policy.
7. Cross-Border & International Data Transfers
Husk Labs operates globally. Information collected may be stored, processed, or transferred across our primary data centers and cloud hosting regions in the United States, the European Union, the United Kingdom, and India.
When transferring personal data originating in the European Economic Area (EEA), the UK, or Switzerland to countries that have not received an adequacy decision from the European Commission:
- We execute the European Commission's approved Standard Contractual Clauses (SCCs) pursuant to Decision (EU) 2021/914 (Module 1 Controller-to-Controller or Module 2 Controller-to-Processor).
- For UK transfers, we execute the UK Information Commissioner's Office (ICO) International Data Transfer Addendum (IDTA).
- We implement supplementary technical and organizational safeguards, including end-to-end transport layer encryption (TLS 1.3), AES-256 data-at-rest encryption with managed key rotation, and strict zero-trust access controls.
8. Data Retention & Destruction Policy
We retain personal data only for as long as necessary to fulfill the specific purposes for which it was gathered, satisfy contractual deliverables, resolve disputes, and meet statutory accounting, tax, and regulatory compliance obligations.
| Data Classification | Retention Period | Destruction Protocol |
|---|---|---|
| Prospective Inquiries & Discovery Logs | 24 months from the last documented communication. | Cryptographic erasure from CRM and operational queues. |
| Executed Contracts & Invoicing Records | 7 years following contract completion or termination. | Secure archival and eventual automated purging per statutory retention laws. |
| Server & Security Telemetry Logs | 90 to 180 rolling days. | Automated rotation and permanent overwriting. |
| Client Project Code & Ephemeral Staging Data | Transferred 100% to client upon milestone sign-off; purged within 30 days of offboarding. | DoD 5220.22-M / NIST SP 800-88 compliant digital sanitization. |
9. Technical & Organizational Security Measures (TOMs)
Husk Labs implements comprehensive defense-in-depth security measures aligned with SOC 2 Type II and ISO/IEC 27001 information security frameworks to protect personal data against accidental loss, unauthorized access, destruction, or alteration:
- Cryptographic Safeguards: Mandatory TLS 1.3/TLS 1.2 encryption for all web communications and data in transit; AES-256 encryption for all data at rest and database volumes.
- Zero-Trust Access Control: Role-Based Access Control (RBAC) with Least Privilege enforcement, mandatory Hardware Security Key / FIDO2 Multi-Factor Authentication (MFA) on all corporate and cloud accounts.
- Audit Logging & Traceability: Immutable access logs for all administrative operations, code deployments, and staging environments to maintain full GxP and regulatory audit readiness.
- Vulnerability Management: Automated continuous dependency scanning, static code analysis (SAST), dynamic application security testing (DAST), and periodic third-party penetration testing.
- Incident Response & Notification: In the event of a confirmed security incident affecting personal data, Husk Labs maintains an incident response protocol to notify supervisory authorities and affected parties within 72 hours of becoming aware, pursuant to GDPR Article 33 and applicable US state data breach notification statutes.
10. Global Privacy Rights (GDPR, CCPA/CPRA & US State Laws)
Depending on your geographic location and jurisdiction, you possess specific legal rights regarding your personal data:
A. European Economic Area (EEA), UK & Swiss Residents (GDPR / UK GDPR)
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal records.
- Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data under certain conditions.
- Right to Restriction (Art. 18): Request temporary suspension of processing while a dispute is assessed.
- Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21): Object to processing grounded in legitimate interests or direct marketing.
B. California Residents (CCPA / CPRA - Cal. Civ. Code § 1798.100 et seq.)
- Right to Know & Access: Request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties with whom it was disclosed in the preceding 12 months.
- Right to Delete: Request deletion of personal information collected from you, subject to statutory exemptions.
- Right to Correct: Request rectification of inaccurate personal information maintained about you.
- Right to Opt-Out of Sale or Sharing: Husk Labs does not sell your personal information or share it for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: We do not collect or use sensitive personal information beyond what is strictly necessary to perform requested business services.
- Right to Non-Discrimination: We will never deny services, charge different prices, or provide a different level of quality if you exercise your CPRA rights.
C. Other US State Privacy Rights (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA)
Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with enacted comprehensive privacy legislation enjoy corresponding rights to access, correct, delete, port data, and opt out of profiling or targeted advertising.
How to Exercise Your Rights: To submit an authenticated data request, contact us at privacy@husklabs.co. We will verify your identity before fulfilling the request and respond within 30 days (or 45 days where permitted under US state law).
12. Children's Privacy Protection
Our website and services are exclusively designed for enterprise biotechnology professionals, academic researchers, and life sciences organizations. We do not knowingly market to, collect, or solicit personal data from individuals under the age of 18 (or 16 in the European Union). If we learn that we have inadvertently collected personal data from a child under the applicable legal age, we will take immediate steps to permanently delete the information.
13. Modifications & Update Notifications
Husk Labs reserves the right to amend this Privacy Policy periodically to reflect evolving legal frameworks, technological enhancements, or organizational changes. When updates are published, we will revise the "Effective Date" at the top of this document. In the event of material modifications that substantively alter your privacy rights, we will provide prominent notice via our website or direct email communication to registered enterprise contacts.
14. Data Protection Officer & Supervisory Authority Contacts
If you have questions, concerns, or requests regarding this Privacy Policy or our global data protection practices, please contact our Data Governance Office:
Primary Domain: husklabs.co
Direct Privacy Inquiries: privacy@husklabs.co
Information Security Officer: security@husklabs.co
General Legal Affairs: legal@husklabs.co
Right to Lodge a Regulatory Complaint
If you reside within the European Economic Area or the United Kingdom and believe that our processing of your personal data infringes applicable data protection laws, you retain the statutory right to lodge a complaint with your competent supervisory authority (e.g., the UK Information Commissioner's Office (ICO) or your local EU Member State Data Protection Authority).