Pharma Observatory Explore Privacy Policy
Last updated: 2026-10-11
1. Who is responsible for your data #
Pharma Observatory Explore is operated by The Assay Depot LLC, trading as Scientist.com. For the personal data described in this policy, Scientist.com is the controller. For any question about this policy, write to support@scientist.com.
2. What this policy covers #
This policy covers the personal data we process when you create an account for Pharma Observatory Explore, sign in to it, and use it. It also covers the personal data we process if you request a gated PDF from one of our public pages, even if you never create an account (section 4).
It does not cover other Scientist.com products or the Scientist.com marketplace, each of which has its own arrangements. It also does not describe the biomedical, corporate, and regulatory reference data that Pharma Observatory Explore presents; that content is assembled from external published sources and is covered by the terms of use.
3. How the system is built, and why that matters here #
Two facts about the architecture shape everything below.
Your account lives in our identity service, not in the Explore application. Sign-in uses a hosted sign-in service, WorkOS AuthKit, operated by WorkOS, Inc., a third-party identity provider. That identity service is the system of record for your account: your email address, your name, your credential, your verification status, and your permissions all live there.
Pharma Observatory Explore itself keeps almost no user records. The Explore application has no users table and no user database. When you sign in, it reads a small set of claims from the identity token, specifically a stable account identifier, your email address, your display name, and your permission roles, and stores just those in an encrypted session cookie in your browser. Every page request rebuilds who you are from that cookie. When you sign out, the application clears the session. The application’s own database tables hold only operational records about data pipeline runs, and those records identify what triggered a run by category, not by person.
There is one narrow exception, and we state it plainly because it is the only place the application writes a person into durable storage. Scientist.com administrators who use the internal data curation tool have their account identifier, or their email address if no identifier is available, recorded against each curation decision they make, together with a timestamp. That record is deliberately append-only: a later decision supersedes an earlier one rather than overwriting it, so the review history survives. This applies only to Scientist.com staff acting as reviewers, not to customer accounts, but it is personal data and it is durable, so it is disclosed here.
4. What we collect, and why #
Account information you give us at registration. Your email address and your name, and a password that the identity service stores only in hashed form. We use this to create your account, to identify you when you sign in, to let you recover access if you forget your password, and to contact you about your account and your access request.
Email verification status. We record whether you have proved control of the email address you gave us. This protects you and us against someone registering with an address that is not theirs.
Your permissions. We record whether an administrator has approved your access to the product, and which datasets your permissions cover. Creating an account grants no access by itself; an administrator has to approve it. That approval decision, and any later withdrawal of it, is recorded in the identity service’s administrative audit log together with who made the change and when, so that access decisions are accountable.
Authentication records. The identity service records sign-in events and related security events, which we use to operate the login system, to investigate suspicious activity, and to protect accounts against attack.
Your session. While you are signed in, an encrypted cookie in your browser holds your account identifier, email address, display name, and permission roles. This is what keeps you signed in between pages. It is not a tracking cookie, it is not used for advertising, and it is not shared with anyone. A signed-out visitor to pharmaobservatory.com receives the same cookie too, because our sign-in and request forms need a security token to be kept between pages; for a signed-out visitor it holds only that token and no personal data. Every cookie and similar browser storage item we use is listed by name in the cookie policy.
Server and infrastructure logs. Our servers and infrastructure produce ordinary operational logs of requests, which can include an IP address, a browser user agent, a timestamp, and the page requested. We use these to keep the service running, to diagnose faults, and to detect abuse. The application is configured to filter sensitive values, including email addresses, passwords, and tokens, out of the request parameters it logs. It never stores your sign-in token.
Error diagnostics. When something goes wrong on our servers or in your browser, an error report goes to Sentry, a third-party error monitoring service, so that we can find and fix the fault. A report contains the error and where in our code it happened, the address of the page without its query string (the part after a question mark), your browser and operating system, and, for an error in your browser, a short record of your most recent page navigations (page addresses only, also without query strings). Reports do not include form contents or request bodies, your cookies, or your request headers other than the browser identification, and no session recording is used for these reports. Occasionally an error message produced by our code or our database may quote a value involved in the error, for example an email address that a database rejected as a duplicate. Reports from your browser are sent to our own domain and relayed by our server, so your browser does not contact Sentry directly. We configure reports not to include your IP address; because our server relays them, Sentry receives our server’s address and not yours. Our servers also send Sentry performance timings (the page path without its query string and how long each step took). We additionally send performance traces to a monitoring system we run ourselves inside our own infrastructure; those traces record the addresses of the pages and queries involved.
Correspondence. If you write to support@scientist.com we keep the message and our reply so that we can answer you and keep a record of the request.
Product analytics. We use an analytics service, PostHog, to understand which pages of the application are used. It is configured to collect page-visit data only. It does not record sessions, does not read the content of anything you type, and sets no cookie. Before you choose in the cookie banner, it keeps its random visitor identifier in the page’s memory only, so nothing is written to your device. If you allow the Analytics category, it uses your browser’s temporary session storage instead of a cookie, which is cleared when you close your browser tab and is never shared across a browser session boundary; if you later withdraw, we remove it. If you are signed in, PostHog additionally associates your page visits with your account using the same stable account identifier your session already carries (see section 3), and, at the moment you sign in, we also send PostHog your email address and your name as properties of that identifier. If you request a gated PDF (below), PostHog also receives your email address, associated with a separate stable identifier for that request rather than with your account identifier. We do not use PostHog for advertising, and it does not share data with third parties for its own marketing.
If you request a PDF from a public page (“lead capture”). Some pages of the site are
public and offer a downloadable PDF built from the full data behind that page. If you ask
for one, we collect: the email address you give us; the page you were on; how you arrived
(the referring website and any campaign tags carried in the link, such as utm_source); a
Google Ads click identifier if one is present in the link you followed (see “Advertising
click identifiers”, below); and the text of the consent statement you saw and the time you
agreed to it. We use this to send you the PDF, to run the confirmation and follow-up emails
described below, and to understand which pages and campaigns are working. To slow down
automated abuse of this form we may briefly use technical signals such as your IP address at
the moment you submit it; these are not kept against your lead record afterwards.
Confirming your email address. Before we send anything else, we email you a confirmation link to prove you control the address you gave us (a “double opt-in”). We do not send the PDF, or any other message, until you confirm.
The PDF we send you. Once you confirm, we email you a secure link to download the PDF you asked for, hosted on our own site (pharmaobservatory.com) and backed by storage in the European Union. The link works for 72 hours; if it has expired by the time you use it, asking again on the page where you requested it sends you a fresh one at no extra cost against your free-PDF limit, as long as the underlying data has not changed. Depending on how we have the system configured at the time, we may instead attach the PDF to the email directly rather than send a link; either way, each page of the PDF carries your email address in its footer (for example, “Prepared for jane@example.com”), so the document identifies its intended recipient wherever it is later found. A PDF never contains restricted-tier third-party content; see the terms of use.
Further emails (the “drip”). After you confirm, you may receive up to five further emails over the following few weeks with content related to the page you asked about, and, if the data behind a PDF you already hold changes, an update notice, at most one such notice per month. The lawful basis for these further emails is the consent you give when you submit the form and confirm your address; you can withdraw that consent at any time. Every one of these emails carries an unsubscribe link, and unsubscribing is final: we stop mailing that address for this programme and do not ask again.
Replies you send us. If you reply to any of these emails, we keep your reply, and it is forwarded to a real inbox so a person can answer you.
A limit on free PDFs. We currently limit each email address to three separate PDFs before asking you to create an account to see more; the page tells you when you reach that limit. We may change this number.
Advertising click identifiers (not yet active). If you follow a link from a Google Search ad to reach the site, that link can carry a Google click identifier (“gclid”). We plan to store that identifier with your lead record and, if you later become a paying customer, to report that single event back to Google as an advertising conversion, without sharing any other information about you or your visit. As of the date at the top of this policy we run no Google Ads campaigns (our advertising budget is set to zero) and no Google advertising script or pixel runs in your browser on this site (the LinkedIn Insight Tag described below is the one advertising tag the site can run); this paragraph describes what will happen once Google Ads campaigns start, so this policy is accurate on the day they do. If you allow the Advertising category in the cookie banner, the click identifier is also kept in your browser’s session storage for the life of the tab, so a later page can attach it; if you do not, it is used only from the address of the page you are on, and if you later withdraw, we remove it. The same applies to the click identifiers LinkedIn (“li_fat_id”) and Microsoft Advertising (“msclkid”) add to a link from their ads: they are kept the same way, and stored with your lead record, for the same purpose.
Advertising partners. If you allow the Advertising category in the cookie banner, it covers our advertising partners for two purposes: conversion measurement (to see whether an ad led to a sign-up) and retargeting (to show our own advertisements to people who visited this site). The partners are LinkedIn, which is active now (the LinkedIn Insight Tag, below), Google (the click identifier described above, and a Google remarketing tag if we add one) and Microsoft Bing (a Bing advertising tag if we add one). This is one choice, limited to those partners and purposes, and we update this policy before a partner other than LinkedIn starts running a tag in your browser. Each such partner acts as an independent controller of what its tag collects.
LinkedIn Insight Tag (advertising). The site can load the LinkedIn Insight Tag, a small script from LinkedIn (snap.licdn.com), so that we can show our own advertisements on LinkedIn to people who have visited this site and measure whether they worked. It runs only if you allow the Advertising category in the cookie banner; until you do, nothing is requested from LinkedIn and no data is sent to it. Once it runs, LinkedIn receives, from your browser, the address of the page you are on, the page you came from, your IP address, your browser and device details, and a timestamp, and it may set or read its own cookies and identifiers for your browser (listed in the cookie policy). LinkedIn uses these to build an audience of site visitors for our campaigns and to match visitors to LinkedIn members; LinkedIn acts as an independent controller of the data it collects through the tag, under LinkedIn’s privacy policy. We do not send LinkedIn your email address or any account detail through the tag. If you withdraw the Advertising category, pages you open afterwards do not load the tag; to also remove LinkedIn’s cookies, clear them in your browser, or manage ad settings in your LinkedIn account.
Advertising on our map sites. The Contract Research Map shows sponsored cards from the ad server Kevel. Our server, not your browser, asks Kevel for the ads, reports that an ad was shown, and records a click before sending you on to the advertiser, so no Kevel script or tracking pixel runs in your browser. Kevel receives the browser identification string your browser sent us and a truncated version of your IP address (the last number of an IPv4 address set to zero; only the first three groups of an IPv6 address), which it uses to deliver, geo-target and filter ads. It receives your full IP address only if you allow the Advertising cookie category. It receives no account or identifier of yours. The ad’s picture is loaded from Kevel’s image host as an ordinary image request. Details are in the cookie policy.
What we do not collect. Beyond the product analytics and the lead-capture programme described above, the application uses no advertising or marketing trackers other than the LinkedIn Insight Tag described above, no session recording, and no cross-site tracking. The only cookie it sets is the session cookie described in section 3. It also keeps a few items in your browser’s local and session storage: your cookie choices, your light or dark theme preference and your map view (display preferences and not identifiers), and, only if you allow the matching category, the analytics and advertising items described above. Each one is listed in the cookie policy, and you can change your choices at any time from Cookie settings in the page footer. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use your personal data to make automated decisions that produce legal or similarly significant effects about you. The decision to approve your access is made by a person.
5. Email we send you #
Account email. All email about your account is sent by the identity service, not by the Explore application. We send:
- an address verification message when you register, so you can prove the address is yours;
- a password reset message when you ask to reset a forgotten password; and
- service messages about your account or your access, for example the outcome of an access request.
These are transactional messages that are necessary to operate your account, so they are not marketing and you cannot unsubscribe from them while your account is open.
Email is delivered through Mailgun, using a Scientist.com sending domain, with support@scientist.com set as the reply address. See section 7.
Email about a gated PDF you requested. If you ask for a gated PDF from a public page (section 4), the Explore application sends you email directly, through Resend, from chris@pharmaobservatory.com: the confirmation message, the PDF, up to five further messages, and, at most once a month, a notice that a PDF you hold has changed. What each of these contains, and how to stop them, is described fully in section 4. Unlike account email, this is a category of email you can unsubscribe from, and every message in it carries a link to do so.
6. Purposes of processing #
The table below sets out the purposes for which we process personal data, and the data each purpose involves.
| Purpose | What it involves |
|---|---|
| Creating and maintaining your account | Email, name, hashed password, verification status |
| Deciding and recording access approval | Permission roles, admin audit record |
| Authenticating you and keeping you signed in | Session cookie, sign-in events |
| Remembering your cookie choices and display preferences | Your choices and preferences, kept in your own browser |
| Transactional email | Email address |
| Security, abuse prevention, and fault diagnosis | Logs, authentication events, error reports (page path without query string, browser and operating system; no IP address) |
| Auditing data curation decisions | Staff account identifier and timestamp, append-only |
| Responding to your correspondence | Message contents |
| Understanding which pages are used (product analytics) | Page-visit data; your account identifier, plus your email address and name once signed in (PostHog); a lead identifier and your email address if you requested a gated PDF (PostHog) |
| Sending you a gated PDF you requested, and confirming your address first | Email address, the page and campaign information described in section 4, consent record, Google Ads click identifier if present |
| Sending drip and PDF-update emails about a PDF you requested, and handling replies | Email address, delivery and reply records |
| Reporting an advertising conversion (not yet active) | Google Ads click identifier already present in the referring link, and the fact and approximate timing of a purchase |
7. Who we share your data with #
We do not sell your personal data and we do not share it with third parties for their own marketing, with one exception: if you allow the Advertising category, the LinkedIn Insight Tag (described in section 4 and the table below) sends browsing data to LinkedIn, which is an independent controller under its own terms. We use a small number of service providers who process personal data on our instructions in order to run the service. The ones relevant to your account are:
| Provider | What it does | Personal data involved |
|---|---|---|
| Amazon Web Services | Cloud infrastructure hosting the platform. The production environment runs in the AWS Europe (Frankfurt) region, eu-central-1. |
Everything stored or processed by the service, including account records, logs, and backups |
| Mailgun | Delivery of transactional email, from a Scientist.com sending domain | Your email address, your name where it appears in the message, and the message content |
| Sentry | Error monitoring, so we can detect and fix faults | Error reports: the error, the page path without its query string, your browser and operating system, and for browser errors a short record of recent page navigations. No cookies, no request headers other than browser identification, no form contents or request bodies (an error message may occasionally quote a value involved in the error), and no IP address from you (browser reports are relayed by our server) |
| PostHog | Product analytics (which pages are visited) | Page-visit data; your account identifier, plus your email address and name, once you are signed in; a separate lead identifier and your email address if you requested a gated PDF |
| Resend | Delivery of the confirmation, PDF, and drip emails described in section 4 and section 5, sent from chris@pharmaobservatory.com | Your email address; delivery events (delivered, bounced, or marked as spam); the content of any reply you send to one of these emails. Open and click tracking are currently turned off on our sending domain, so Resend does not tell us whether you opened a message or clicked a link in it |
| Kevel | Ad server for the sponsored cards on the Contract Research Map, called by our server | The browser identification string your browser sent us, a truncated IP address (the full address only if you allow the Advertising category), and which ad was shown or clicked. No cookie, script, or pixel from Kevel runs in your browser |
| Google Ads (Google LLC) | Not yet active. Advertising conversion measurement: if you arrived from a Google ad and later become a paying customer, we plan to report that as a conversion | A Google click identifier already present in the link you followed, and the fact and approximate timing of a conversion. No browsing data. This is done by our server, and no Google advertising script or pixel runs in your browser on the site |
| LinkedIn (LinkedIn Corporation and its affiliates) | LinkedIn Insight Tag, a browser advertising pixel: audience building for our LinkedIn campaigns and campaign measurement. Only after you allow the Advertising category; it loads a script from snap.licdn.com and sends data to px.ads.linkedin.com. LinkedIn is an independent controller of what it collects, under its own privacy policy | The address of the page you are on, the page you came from, your IP address, browser and device details, a timestamp, and LinkedIn’s own cookies and identifiers. No email address or account detail from us |
| WorkOS | Our identity service (sign-in), described in section 3. It, and not the Explore application, is where your account is stored. | Your email address, your name, your credential, your verification status, and your permissions |
Our performance tracing system is self-hosted on our own infrastructure and is not a third party.
If you are a member of Scientist.com staff signing in with your company account, your sign-in is delegated to Scientist.com’s corporate identity provider, Google Workspace. That path does not apply to external customer accounts.
We may also disclose personal data where we are legally required to do so, to establish or defend legal claims, or in connection with a merger, acquisition, or sale of assets.
8. International transfers #
The production environment for this service runs in the AWS Europe (Frankfurt) region. Scientist.com is a United States entity, and staff in the United States and elsewhere may access personal data in order to operate and support the service. Our service providers may also process data outside the country where you are located.
9. How long we keep your data #
Different records are kept for different lengths of time:
- Your browser session. The Explore application stores your identity in an encrypted session cookie and keeps no server-side copy. The cookie itself carries no fixed expiry; what actually bounds it is that the sign-in it represents is re-checked with the identity service roughly every five minutes as you use the product, so a change to your account or permissions takes effect within that window rather than waiting for the session to expire on its own. Signing out immediately ends your session with the application. It also asks the identity service to end the corresponding session on its side, and that normally succeeds; if the identity service cannot be reached at that moment, your sign-out here still completes (so a problem on our end never leaves you unable to sign out), but the identity-service session may not end right away in that case. See section 11 for what that means in practice.
- Your account record. Held in the identity service for as long as your account exists.
- Administrative audit records of access approval and withdrawal. Retained so that access decisions remain accountable.
- Staff curation decision records. Retained indefinitely by design, because the record is append-only and forms the audit history of data curation decisions.
- Lead records (gated PDFs), while the programme is active. We keep the record of your request, confirmation, PDFs and emails sent, and any reply, for as long as the programme described in section 4 is active for your address.
- Lead records, once twelve months pass with no activity from you. If twelve months pass with no request, confirmation, reply, or visit back to a page of ours from you, we delete the PDF files themselves. We keep the record of your request, confirmation, and emails sent, and your consent, so we can show what happened if you or a regulator ever asks.
- A minimal record after you unsubscribe, bounce, or complain. We delete your PDF files and the record of your requests and emails sent right away. We keep your email address and the fact that one of these happened, on its own, so that we do not contact that address again by mistake.
- Erasure on request. You can ask us to erase your lead record at any time (see section 10). We will remove your deliveries and files and the lead record itself, keeping only a minimal note that the address asked us to stop and when. We also remove the address from our delivery and bounce history, keeping that history only in a form that no longer names you. As part of handling your request we also delete the matching Resend contact and PostHog person by hand.
10. Your rights #
Depending on where you live, and in particular if you are in the European Economic Area or the United Kingdom, you have rights over your personal data. These include the right to:
- access the personal data we hold about you and get a copy of it;
- rectify personal data that is inaccurate or incomplete;
- erase your personal data in certain circumstances;
- restrict how we process your personal data in certain circumstances;
- portability, meaning to receive personal data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where that is technically feasible;
- object to processing we carry out on the basis of our legitimate interests; and
- withdraw consent at any time, where we rely on consent, without affecting processing carried out before you withdrew it.
You also have the right to complain to your data protection supervisory authority.
To exercise any of these rights, write to support@scientist.com. We will verify your identity before acting, which usually means confirming that you control the email address on the account. We will respond within the period required by applicable law.
11. Security #
- Sign-in uses a hosted sign-in flow through our identity service, WorkOS. The Explore application never sees or stores a password, and holds no password of its own.
- Passwords are stored only in hashed form by the identity service, which also enforces the password policy, email verification, and account recovery.
- Your session cookie is encrypted and signed by the application.
- The application filters sensitive values, including email addresses, passwords, and tokens, out of the request parameters it logs, and it never stores the sign-in token it receives from the identity service.
- Access to the product requires an explicit permission granted by an administrator, and the application denies access by default without it.
- Traffic to the service is encrypted in transit.
Signing out of Pharma Observatory Explore always ends your session with the application immediately. As part of the same action, the application also asks the identity service to end the corresponding session on its side, so that a later sign-in attempt normally has to go through your credentials again rather than silently re-admitting whoever is using the same browser. That second step is best-effort: it depends on reaching the identity service at that moment, and we do not let a problem reaching it turn your own sign-out into a failure. In the uncommon case where that step does not go through, the identity-service session can outlive your local sign-out. If you are on a shared or public computer, closing the browser or clearing its cookies when you finish removes that possibility entirely.
No system is perfectly secure, and we cannot guarantee absolute security.
12. Children #
Pharma Observatory Explore is a business tool intended for professional use and is not directed at children. We do not knowingly collect personal data from children.
13. Changes to this policy #
We may update this policy. If we make a material change we will take reasonable steps to tell you, which may include emailing the address on your account or showing a notice when you next sign in.
14. Contact us #
For any privacy question, or to exercise any right described in section 10, write to support@scientist.com.