Privacy Notice

Last updated 16 October 2025

Background

This Notice applies to the Personal Data Isomorphic Labs Limited (“IsoLabs”, “us”, “we”, or “our”) may collect about you. Our registered office is 280 Bishopsgate, London, United Kingdom, EC2M 4AG and our company number is 13223825. IsoLabs is responsible for ensuring that it uses Personal Data in compliance with UK data protection laws, including (but not limited to) the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018.

At IsoLabs we respect your privacy and are committed to keeping all your Personal Data secure. We will only collect and process your Personal Data for legitimate reasons, in accordance with applicable law and/or regulation and as described in this Notice.

We use this Notice to answer the following questions:

• What types of Personal Data do we collect about you?
• How do we collect your Personal Data?
• Why do we use your Personal Data?
• If we process Special Category Data, what special conditions for processing do we rely on?
• Who may have access to your Personal Data?
• When do we transfer your Personal Data outside of your home country?
• How do we protect your Personal Data?
• How long do we retain your Personal Data?
• What rights do you have in respect of your Personal Data?
• How can we make changes to this Notice?
• How can you contact us?

We use the following definitions in this Notice:

1. “Notice” means this privacy notice. 
2. “Personal Data” means any data which relates to a living individual who can either be identified (i) from that data; or (ii) from that data and other information which is in the possession of, or is likely to come into the possession of IsoLabs (or its representatives or service providers). In addition to factual information, it includes any expression of opinion about an individual and any indication of the intentions of IsoLabs or any other person in respect of an individual.
3. “Special Category Data” means certain types of Personal Data which require more protection because they are sensitive. This includes health, genetic and biometric data, as well as data of racial or ethnic origin.
4. This Notice applies to Personal Data we collect and use if:
   
   • you visit and use our website www.isomorphiclabs.com (“Site”) or any external IsoLabs portal (“Portal”);
   • you communicate with us, for example online via email, an online form or our social media platforms, or offline, in person, such as at an event, or to our physical address; 
   • you work at or otherwise represent one of our third party partners or suppliers;
   • we use data concerning your health or genetics in our scientific research that you participate in (a “Research Study Participant”). This includes (but is not limited to) data we have obtained from: (i) research, biobank or other scientific studies conducted by third parties; and (ii) individuals receiving medical treatment that agree to diagnostic and other information being shared with us; or
   • you have contributed data to a research study or publication as an individual scientist or academic (a “Research Contributor”), that has been shared with or made available to us online or in other public resources.
5. For information about how we collect and use your Personal Data as part of our application and recruitment process, please see our dedicated Privacy Notice for Talent Sourcing & Recruitment. If you work at IsoLabs, please visit your Employee Handbook.
6. As a data controller, we are responsible for determining how and why your Personal Data is collected and used.

What Types of Personal Data we collect

Depending on how you interact with IsoLabs, we may collect the following categories of Personal Data:

If you visit and use our Site or Portal, communicate with us, or represent one of our third party partners or suppliers

1. Identity and contact information, for example your name, address, email address, telephone number or other contact information.
2. Account registration information, for example your user name, password and other profile data required to create or update your account and when interacting with our Portal.
3. Professional or employment-related information, for example your job title, organisation, industry, seniority and any academic or professional credentials that may be relevant to our business relationship with you.
4. Technical and electronic activity information that your browser may send when you visit our Site or Portal, for example your computer’s Internet Protocol (IP) address, browser type and version, computer settings, pages of our Site that you visit, how often you visit those pages, the time and date of your visits, the time spent on those pages and other statistics.
5. Demographic, lifestyle, health and treatment information including Special Category Data, for example information that you voluntarily share with us as part of patient advocacy events relating to your own diagnoses, path to diagnosis, or treatment history.

If you are a Research Study Participant

‍Demographic information, for example information you provide in response to questionnaires conducted for biobanks or other health research databases. This may include information related to your education, employment, household, marital status, current location, birth place and age, and Special Category Data related to your ethnicity or race.‍

Other Special Category Data, for example information derived from:

• biological samples, including your blood;
• physical measurements, such as your height and weight and other baseline data from physical exams, vision and hearing tests and activity monitors;
• body scans, such as magnetic resonance imaging (MRI) and scans or ultrasounds of your bones, organs or arteries;
• your healthcare records, such as information about hospital stays and medical diagnoses;
• your responses to questionnaires, including information about your medical history, mental health, diet, sleep, exercise and substance use.

Where possible, IsoLabs processes anonymised data of Research Study Participants. This means that any information that could reasonably identify you (either directly or indirectly) has been removed to break its linkage to your real-world identity. While we still provide appropriate protection to anonymised data, the processing of that data falls outside the scope of this Notice. 

Please be aware however, that depending on the nature of the Personal Data, it may not always be possible for it to be effectively anonymised. For example, certain types of genetic information are inherently connected to the individuals they came from.

If you are a Research Contributor

1. Identity and contact information, for example your name and institution address or email address.‍
2. Professional or employment-relation information, for example your job title and organisation name.

How we collect your personal data

We may collect your Personal Data in the following ways:

If you visit and use our Site or Portal, communicate with us, or represent one of our third party partners or suppliers

1. Directly from you, for example when you interact with our Site or Portal, or communicate with us.
2. Through cookies and other tracking technologies that are sent to your computer or mobile device when you visit our Site or Portal, including to help us remember your preferences and to understand and improve user experience. For more information on the cookies we use and the purposes for which we use them see our Cookies Notice.‍
3. Through websites, for example when you follow us on social networking sites such as LinkedIn.

If you are a Research Study Participant

1. Through our third party partners, including through access to datasets and other information we obtain through agreements with third party organisations.
2. Through our research partners, including clinical research organisations, laboratories and healthcare providers.
3. From public sources, including public databases and academic papers.

If you are a Research Contributor

1. Through our third party partners, including through access to datasets and other information we obtain through agreements with third party organisations.‍
2. Through public sources, including public databases and academic papers.

Why we use your Personal Data

In accordance with the GDPR, we rely on a number of lawful bases to process your Personal Data, depending on the data we collect about you and how we interact with you:

Legitimate Interests

We may process your Personal Data where this is necessary for our legitimate interests, provided that our interests are not overridden by your interests or fundamental rights and freedoms. In particular, we rely on legitimate interest to use Personal Data for the following purposes:

If you visit and use our Site or Portal, communicate with us, or represent one of our third party partners or suppliers, we have a legitimate interest in processing your Personal Data:

1. To conduct everyday business activities, such as:
   
   • managing and administering our business operations; 
   • monitoring, maintaining, developing and improving the performance and security of our Site and Portal;‍
   • ensuring compliance with our policies and procedures; and
   • providing employee education and engagement.
2. To comply with all legal, regulatory and compliance requirements, such as:
   
   • enforcing compliance with our policies and procedures; and
   • managing and providing all necessary assistance in respect of any legal claims or other compliance, regulatory, auditing, investigatory or disciplinary purposes (including disclosure of such information in connection with legal process or litigation).
3. In connection with a corporate transaction, including where we buy or sell businesses or assets. If IsoLabs becomes involved in a business combination, shares offering, bankruptcy, reorganisation, dissolution, or other similar transaction, we may share or transfer your Personal Data in connection with that transaction.

If you are a Research Study Participant, we have a legitimate interest in processing your Personal Data:

• to conduct scientific research and development activities to ensure our drug designs are effective and safe, and ultimately improve treatment outcomes and/or enhance the quality of life for patients; and
• to train our AI models to ensure they perform effectively and learn from accurate data. Our models assist us in designing safe and effective drugs, and we train them on a wide variety of data, including information derived from people. This process helps our models learn crucial patterns and connections. We will not use this data to contact you, build a profile about you, market to you, make decisions about you, or sell your Personal Data.
• If you are a Research Contributor, we have a legitimate interest in processing your Personal Data to appropriately attribute the source of datasets we process and to contact you where necessary.

Consent

IsoLabs may rely on consent as the lawful basis for processing your Personal Data in specific circumstances, including:

• when we place non-essential cookies or similar technologies on your device while you access our Site or Portal; and
• when we request your consent for a specific purpose, which will be clearly explained to you at the time.

If you are a Research Study Participant, you may have read and signed an Informed Consent Form (ICF) before agreeing to participate in the study. If your Personal Data is collected solely and directly in connection with a research study conducted by IsoLabs or on our behalf, the ICF will provide further information about how we process your Personal Data for that specific study. While we rely on legitimate interests as our lawful basis under data protection law to process your Personal Data in this context and not on consent (save where you are informed otherwise), our data processing activities will always comply with the terms of the consent you provided in the relevant ICF.

Legal obligation

IsoLabs may rely on its legal and regulatory obligations as the lawful basis for processing your Personal Data in certain situations, including:

• when responding to requests from government or law enforcement authorities as part of an investigation; and
• when complying with applicable reporting requirements or other legal obligations.

Does IsoLabs conduct automated decision-making?

IsoLabs does not conduct any automated decision-making about you using your Personal Data.

What is our special condition for processing Special Category Data?

In addition to having one of the lawful bases identified above, in order to lawfully process Special Category Data, the law requires us to satisfy a special condition for processing.

Where we process Special Category Data, we will only do so where:

• the processing is necessary for scientific research purposes that are in the interests of society as a whole;
• you actively and deliberately made the information public; or
• we have otherwise obtained your explicit consent for our processing.

Where your Personal Data is necessary for scientific research purposes, we will implement appropriate safeguards to protect you, including measures to ensure we are processing the minimum amount of Personal Data necessary to achieve our purpose. This includes:

• where possible, using anonymised, de-identified and pseudonymised data;
• ensuring that the processing is not likely to cause substantial damage or distress to you;
• not using your Personal Data to take any action or make decisions in relation to the individuals concerned (unless we are carrying out approved medical research); and
• implementing other technical and organisational measures that we describe in more detail in section 8 below.

What third parties may have access to your Personal Data?

We may share your Personal Data outside of IsoLabs for the following purposes:

Affiliates: IsoLabs is an Alphabet, Inc. company and an affiliate of Google, LLC. Your Personal Data may be shared with our affiliates and subsidiaries in the US and in other jurisdictions where we utilise shared business operational services. We will take steps to ensure that access to and use of Personal Data is restricted to that which is necessary to achieve the purposes described in this Notice.

Third party service providers: IsoLabs may use third party service providers acting on IsoLabs’ behalf to perform certain activities. They may need Personal Data to perform their specific function for IsoLabs. These service providers may be located outside the country in which you live. We use third party service providers for the following reasons, among others:

• IT, hosting, cookie management, communications functionality and data security;
• business development, marketing and communications; and
• contract and document review and management.‍

Third party clinical organisations: IsoLabs may share Personal Data with clinical research organisations (CROs) as part of the research and development of safe and effective drugs.‍

Professional Advisors: We may share Personal Data with our accountants, auditors, lawyers, and other outside professional advisors to IsoLabs, subject to binding contractual obligations of confidentiality.‍

Courts, regulatory bodies and law enforcement agencies: IsoLabs may sometimes be required to disclose your Personal Data to external third parties such as to local labour authorities, courts and tribunals, regulatory bodies and/or law enforcement agencies for the purpose of complying with applicable laws and regulations, or in response to legal process.‍

Other third parties: We may also share your Personal Data with other third parties if we have your consent, or to detect, prevent or otherwise address fraud, security or technical issues, or to protect against harm to the rights, property or safety of IsoLabs, our employees, the public or as otherwise required by law.

When do we transfer personal data internationally?

IsoLabs and its affiliates operate globally, which means your Personal Data may be stored and processed outside of the country or region where it was originally collected, including in the United States. In some of these countries, you may have fewer rights in respect of your information than you do in your country of residence. Regardless of where your information is processed, we apply the same protections described in this Notice.

We comply with certain legal frameworks relating to the transfer of Personal Data, including:‍

1. Data Protection Framework: Google LLC and its wholly-owned US subsidiaries (unless explicitly excluded) (“Google”) comply with the UK Extension to the EU-U.S. Data Privacy Framework as set forth by the US Department of Commerce regarding the collection, use and retention of Personal Data from the UK. This means that where it is necessary to transfer your Personal Data from the UK to our affiliate Google, your Personal Data is protected to a level consistent with UK law. For more information see Google’s Data Privacy Framework certification.‍
2. Adequacy Decisions: Where Personal Data can be transferred from the UK to countries considered to have adequate protection by the UK Government. These countries are set out in The Information Commissioner’s guide to international transfers.‍
3. UK Standard Contractual Clauses (SCCs): We are permitted to transfer Personal Data to a recipient that has signed up to a contract based on the SCCs, obliging them to protect your Personal Data in line with UK data privacy standards We might rely on SCCs in instances where our transfers of Personal Data are not covered by the Data Protection Framework or an adequacy decision. If you would like to obtain a copy of the SCCs, you can contact privacy@isomorphiclabs.com.

How we protect your Personal Data

IsoLabs and its affiliates have extensive controls in place to maintain the security of our information and information systems, which ensures we take appropriate technical and organisational measures to protect your Personal Data. This includes:

• various state of the art security measures like multi-factor authentication, data encryption and vulnerability and security management;
• where appropriate, utilising highly secure computing environments (known as Trusted Research Environments) designed to facilitate research access to sensitive data, that restrict access, prevent data downloads, and monitor all activities within the environment;
• limiting access to your Personal Data to those personnel who have a strict business need to access your data. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality;
• only using the minimum amount of Personal Data necessary to achieve our purposes, including where possible, using anonymised, de-identified and pseudonymised data to make it as difficult as possible to link the personal data back to individuals; and
• organisational measures like staff policies and training and conducting careful assessments of our service providers’ own security measures.

Our retention of your Personal Data

The length of time we hold your Personal Data will vary and is determined by the following cumulative criteria:

• the purpose for which we are using it – IsoLabs will need to keep your Personal Data for as long as is necessary for that purpose;
• legal obligations – laws or regulation may set a minimum period for which IsoLabs has to keep your Personal Data; and
• research purposes - in accordance with the GDPR, where we process your Personal Data only for scientific research purposes, subject to certain safeguards (set out in Section 8), we are permitted to keep your Personal Data indefinitely if it is necessary to fulfill our research purposes.

Your rights in respect of your Personal Data

Under certain circumstances, you have rights under the GDPR in relation to your personal data. These include the right to:

• request access to and receive a copy of your Personal Data;
• request correction of the Personal Data we hold about you if it’s inaccurate or incomplete;
• request erasure of your Personal Data. Please note that there may be circumstances where you ask us to erase your Personal Data, but we are legally entitled to retain it;
• object to the processing of your Personal Data. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your Personal Data but we are legally entitled to refuse that request;
• request the restriction of the processing of your Personal Data;
• request the transfer of your Personal Data to you or to a third party, if you originally provided it to us;
• withdraw your consent, if we are solely relying on your explicit consent to process your Personal Data. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason for doing so. For example, we may need to retain Personal Data to comply with a legal obligation; and
• lodge a complaint with the relevant data protection regulator if you think that any of your rights have been infringed by us.

To make a request please contact us (see How to Contact Us). After we receive a request, we may verify it by asking for additional information to confirm your identity. We may also decline a request if we have a lawful reason to do so

Please be aware that under the GDPR, there are exceptions and limitations to your rights, including if you are a Research Study Participant, when the processing of your Personal Data is necessary for scientific research purposes

Changes to this Notice

We may update this Notice from time to time. We will notify you of any changes by posting the new Notice on this page and updating the "last updated” date at the top of this Notice. Changes to this Notice are effective when they are posted on this page.

How to Contact Us

If you have any questions, comments or requests about how we process your Personal Data, please contact privacy@isomorphiclabs.com. You can also write to us at FAO Legal Team, Isomorphic Labs Limited, 280 Bishopsgate. London, EC2M 4RB.

If you have any concerns about how your Personal Data has been handled by IsoLabs, please first contact us at privacy@isomorphiclabs.com, explaining your concerns. We will acknowledge this within 30 days, investigate these internally and report back to you without undue delay.

If you are dissatisfied with our response regarding our processing, you may also raise any questions or concerns with the UK’s data protection regulator, the Information Commissioner, which can be contacted at www.ico.org.uk.

‍