This policy explains what information Synlayer LLC collects when you visit the synlayer website or use our products, Cense and Grovera; how we use and share it; and the choices you have. Our clinician products are designed so that patient identities never need to reach us.
1. Who we are
The synlayer website, Cense and Grovera are operated by Synlayer LLC, a Wyoming limited liability company ("Synlayer," "we," "us"). Synlayer is an independent company and is not affiliated with any physician platform, health system or pharmaceutical company. Synlayer is responsible for the personal information described in this policy, except where we process information on behalf of an institution, as described in section 4.
2. Scope
This policy covers the synlayer website, the Cense and Grovera web and mobile apps, early-access and contact requests, and related communications (together, the "Service"). Grovera Family, a service for parents planned for 2027, will have its own privacy notice, including the protections the Children's Online Privacy Protection Act requires, before it launches. Where an institution has signed an agreement with us for Cense for Centers, Grovera for Clinics, an API or another edition, that agreement, including any Business Associate Agreement, governs the information processed under it and takes precedence over this policy.
3. Information we collect
Account and verification information. Your name, work email, specialty, institution, country of practice and professional license identifier (for example an NPI or GMC number). We check license identifiers against public registries to confirm that you are a licensed clinician.
Case content. The clinical text you enter or upload, such as history, laboratory values and report text, including text extracted from a photo of a lab sheet. In Grovera, this includes a child's profile and intervention plan and, where you add them, scores on standardized measures. See section 4.
Outputs and feedback. The differentials, plan reviews and other results our products generate for you, the version records needed to reproduce them, and any feedback you give, such as a "this is wrong" report.
Usage and device information. Log data such as IP address, browser and device type, pages and features used, dates and times, and error reports.
Communications. Messages you send us and your email preferences.
We do not ask for, and you should not provide, payment card details on the free clinician editions.
4. Case content and health information
Our clinician products are designed to work on de-identified case content. Before you submit a case, you must remove names, dates of birth, record numbers, contact details and other direct identifiers. The app also screens for common direct identifiers and blocks them before upload. Screening reduces risk but cannot catch everything, so your own de-identification remains essential.
When you use Cense or Grovera as an individual clinician, we treat case content as de-identified and we do not link it to the patient. When you use Cense through an institution that has signed a Business Associate Agreement with us, we may process protected health information as that institution's business associate, only as the agreement permits.
Requests that we send to our foundation-model providers to generate outputs contain case content but not your name, email or license identifier. Our contracts with these providers prohibit them from using our requests to train their models and require them to delete the requests within a defined period.
5. How we use information
- To provide the Service: verify your license, run your cases and return results.
- To keep the Service safe and accurate: review flagged outputs, re-grade samples of live output, and run evaluation sets before each release.
- To improve our products: we use de-identified case content and feedback to improve our disease knowledge packs and evaluation sets. You can opt out in your account settings.
- To produce aggregate statistics, such as the number of suspected cases by disease and region, that cannot identify you or any patient.
- To communicate with you about your account, early access, changes to the Service and, with your consent where required, news about synlayer and its products.
- To secure the Service, prevent misuse and comply with law.
We do not sell personal information, and we do not use or share it for targeted advertising.
6. How we share information
Service providers. Hosting, foundation-model, email, web-form delivery, support and security providers who process information for us under contract and only on our instructions. A current list is available at [subprocessor list URL].
Physicians you choose. When you share a case, the de-identified case and its results go only to the verified physician or center you select.
Your institution. If your account is provided by an institution, it may see account and usage information as set out in its agreement with us.
Disease-program sponsors. Some disease programs are co-funded by pharmaceutical medical-affairs teams. We may share aggregate, de-identified statistics with them, such as case volumes by disease and region. We never share your identity, your case content or individual results with sponsors.
Legal and safety. When required by law or legal process, or to protect the rights, safety or property of users, patients, Synlayer or others.
Business transfers. In a merger, acquisition or sale of assets, subject to this policy's protections.
7. Cookies and similar technologies
We use cookies that are necessary to sign you in and keep the Service secure. We use analytics cookies only with your consent where the law requires it, and you can change that choice at any time in [cookie settings]. We do not use advertising cookies.
8. Retention
We keep account information while your account is active and for 12 months afterwards. We keep case content and results for 24 months unless you delete them sooner, and the version records needed to reproduce a result for 6 years to meet safety and audit obligations. Log data is kept for 90 days. Aggregate statistics may be kept indefinitely.
9. Security
We encrypt data in transit and at rest, restrict access to staff who need it, log access to case content, and test our controls regularly. No system is perfectly secure; if we become aware of a breach affecting your information, we will notify you and authorities as the law requires.
10. International users
The Service is currently hosted in the United States. If you use it from the United Kingdom or elsewhere, your information is transferred to and processed in the United States. For transfers from the United Kingdom we rely on [the UK International Data Transfer Addendum / UK Extension to the EU–US Data Privacy Framework]. For UK users, our lawful bases are the performance of our contract with you, our legitimate interests in operating a safe and accurate service, and your consent where we ask for it. We will publish regional deployments, with in-region storage, as they launch.
11. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can delete individual cases in the app and close your account at any time. To make any other request, email [privacy email]. We will verify your request and respond within the time the law requires. We will not discriminate against you for exercising your rights.
UK users may also complain to the Information Commissioner's Office.
12. Children
The website and our clinician products are for adults and are not directed to children. We do not knowingly collect personal information directly from children under 13, or from anyone under 18 through the clinician products. Case content about children, including in Grovera, must be de-identified like any other case. Parents who request early access should not include information about their child.
13. Changes to this policy
We will post any changes on this page and update the date above. If a change is material, we will tell you by email or in the app before it takes effect.