Privacy Policy

Last updated 6 September 2026

The Pan-Cancer Spatial Atlas (PCSA) at pcsa.stomics.io is operated by The Allman Institute for Personalized Medicine ("the Institute", "we", "us"). This page explains what the platform records about you, what happens to the slides you upload, and how to have any of it removed. Questions about it go to support@stomics.io.

1. Information you give us

When you register we hold your email address and a bcrypt hash of your password. The password itself is never stored in readable form. If you turn on two-factor authentication, the TOTP secret is encrypted in the database and your backup codes are kept only as SHA-256 digests, so nobody at the Institute can read either of them back. API tokens you generate for pipeline access are held so that requests carrying them can be matched to your account.

Everything else you give us comes from uploads: the whole-slide image files themselves, their filenames, and any metadata you attach to them such as cancer type, cohort or free-text notes.

2. Information the platform generates

Running an analysis produces TLS counts, maturation classifications and region coordinates, all of which are stored against the slide. Tiling produces a pyramid of image tiles derived from your file so the viewer can pan and zoom. Alongside these we keep job status and error messages, and ordinary web server logs containing IP address, browser user agent, request path and timestamp. Logs are used to debug failures and to deal with abuse, and are kept for 30 days before AWS CloudWatch expires them.

Your account record also stores sign-in metadata: how many times you have signed in, when you last did, and the network you signed in from. The network is all we keep — the address is truncated before it is written, to the first three groups for IPv4 and the routing prefix for IPv6, so it identifies a network rather than a connection. It lets us and you spot a sign-in from somewhere your account has never been used. Sign-in networks are cleared once an account has gone 90 days without a sign-in; the counts and dates remain.

3. Patient information

PCSA is a research platform and was not built to hold identifiable patient information. The Institute has not entered into a Business Associate Agreement covering this service, and you should not treat it as HIPAA-compliant storage. Remove direct identifiers from filenames and from embedded slide metadata before you upload. If you realise that something identifiable has been uploaded, delete the slide from your dashboard — that removes the file and its tile images — and write to support@stomics.io so the copies held in backups can be dealt with too.

4. How the information is used

• Running the analyses you request and showing the results back to you.
• Sending account mail: confirmation, password reset, account unlock, and analysis completion notices if you have those switched on.
• Keeping the service secure. That covers rate limiting, blocking scanner traffic, and locking an account after repeated failed sign-in attempts.
• Improving the models and checking their quality, which section 5 covers in detail.

We do not sell personal information. The site carries no advertising and no third-party analytics trackers.

5. Anonymized slide data

Slide images, the tiles and features derived from them, and the analysis results produced from them may be retained in anonymized form and used to train, evaluate and quality-check the models behind PCSA. Anonymized means identifiers are removed from the file, its name and its embedded metadata before the material is used this way, and that results of such use are reported in aggregate or in a form that identifies neither a patient, nor a submitting account, nor a contributing institution. Section 6 of the Terms of Service sets out the licence this rests on.

Write to support@stomics.io if you would rather your material was left out. Exclusion applies to future training and evaluation sets: a model that has already been trained cannot be untrained, so tell us early if this matters to you.

6. Where the data is held

The platform runs in Amazon Web Services, in the US East (Northern Virginia) region. Slide files and tiles are stored in Amazon S3 with server-side encryption; accounts, slide records and analysis results are stored in Amazon RDS PostgreSQL. Traffic to the site is HTTPS only. Analysis runs on GPU instances inside the same AWS account, so your slides are not sent to any external model provider.

7. Who can see your data

Your slides and their results are visible to your own account. Institute staff holding administrator rights can see slide records and analysis status, and use that access to answer support requests and investigate failures. Amazon Web Services provides the hosting, storage and email delivery underneath all of this, acting on our instructions and holding no independent right to your material.

One integration sends data outside the platform, and only when you ask it to. If you trigger a Benchling sync, PCSA posts that analysis’s results to the Benchling tenant you configured — your own laboratory’s, not ours. What happens to it there is governed by your agreement with Benchling. No slide image is sent, and nothing is sent unless you make the request. Nobody else is given access.

8. Retention and deletion

A slide stays until you delete it or close your account. Deleting a slide removes the original file, any converted copy, its tile pyramid and its analysis records, including every detected region. Closing your account deletes the account row and does the same for every slide on it. Tile pyramids are removed by a background job queued at the moment of deletion, so they can lag the record by a few minutes.

Some things outlive the delete, and this is the complete list. Encrypted backups of the database and of storage can still contain a copy until those backups reach the end of their normal cycle and expire. Server logs are kept for 30 days. Sign-in networks are cleared after 90 days of dormancy, as section 2 describes. Anonymized material already folded into a training set cannot reliably be traced back and pulled out, which is why section 5 asks you to opt out in advance if you intend to.

9. Cookies

PCSA sets a session cookie to keep you signed in and a CSRF token to protect form submissions. There are no advertising cookies and no cross-site trackers. Clearing cookies signs you out.

10. Why we are allowed to hold it

For people in the UK and the European Economic Area, the UK GDPR and the EU GDPR require us to name a legal basis for each use. Ours are:

• Performance of a contract. Holding your account, running the analyses you request, storing your slides and their results, and sending the account mail that makes those possible.
• Legitimate interests. Keeping the service secure and available — rate limiting, account lockout, sign-in metadata, server logs — and answering support requests. Our interest is in running a platform that is not trivially abused; we have weighed it against your interests and kept the data involved to a network and a timestamp.
• Legitimate interests. Improving and quality-checking the models, on anonymized material only, as section 5 describes and section 6 of the Terms of Service licenses. You can opt out at any time by writing to support@stomics.io.
• Legal obligation. Retaining or producing information where the law requires it.

11. Your rights and how to use them

Two of these are self-service, and you do not need to ask us:

• Access and portability. Download my data on the Account settings page returns everything we hold about your account as a JSON file: your profile, your sign-in history, and every slide with its clinical metadata and analysis results. Per-slide results are also available as CSV and as QuPath-compatible GeoJSON from each slide, and through the REST API.
• Erasure. Delete my account in the danger zone of the same page closes the account and deletes the slides on it, as section 8 describes. Accounts that sign in through Okta cannot be closed there, because the next sign-in would recreate them; Allman Institute staff should ask IT to deprovision the account instead.

You also have the right to correct information that is wrong (you can edit your email and slide metadata directly, or write to us), to ask us to restrict or object to a use that rests on legitimate interests, and to withdraw consent where we have relied on it. Those requests, and anything the two buttons above do not cover, go to support@stomics.io. We answer within one month.

If you think we have handled your data badly, you can complain to a supervisory authority — in the UK the Information Commissioner’s Office, and in the EEA the authority for the country you live or work in. We would rather you told us first, but you are not obliged to.

Statutory privacy rights vary by where you live. We handle these requests the same way for everyone rather than sorting accounts by jurisdiction, so you do not need to establish that the GDPR covers you before asking.

12. International transfers

The platform runs only in the United States, as section 6 says. If you are in the UK or the EEA, using PCSA means your account details and your uploads are transferred there and processed there. Amazon Web Services, the sole processor involved, offers standard contractual clauses for such transfers and we rely on those. Write to support@stomics.io if you want the details.

13. Children

PCSA is built for researchers and clinicians. It is not directed at children, and accounts are not offered to anyone under 16.

14. Changes to this policy

When our practices change we update this page and move the date at the top. If a change materially affects how your data is handled, registered account holders are emailed before it takes effect.

15. Contact

The Allman Institute for Personalized Medicine, support@stomics.io.