Privacy Policy

Last updated: July 2026

1. Introduction

The Epigenetic Clock Development Foundation, doing business as the Clock Foundation ("we", "us" or "our"), located at 1124 W. Carson St., MRL Building, 3rd Floor, Torrance, CA 90502, is committed to protecting your privacy. This policy explains how we collect, use, disclose and safeguard information when you use clockfoundation.org, the Projects Portal (projects.clockfoundation.org) and our other online research tools and services, together the "Services".

We are a nonprofit research organization. Our Services are used primarily by researchers, clinicians and institutions rather than by consumers, and this policy reflects that.

2. Information We Collect

2.1 Information you give us

Contact form submissions: name, email address, phone, organization, area of interest and your message.
Newsletter signups: email address and, optionally, name.
Partner, donor and study-feedback enquiries: name, organization, email and the content of your enquiry.
Account registration: email address, name, organization and job title. Email is your login identifier.
Passwords, stored only as a salted cryptographic hash. We never store or have access to your password in readable form.

2.2 Research and project data

If you submit a project or a dataset to us through any of our research tools, we also process the material you submit for analysis. This may include DNA methylation datasets, annotation and sample sheets, project and study metadata, shipping and billing details, purchase orders, and photographs taken when recording the condition of an inbound shipment.

This material is treated as confidential to you and your institution. It is used to deliver the analysis or service you requested and for our internal operations. It is not used for marketing, and it is not sold or licensed to third parties.

As a nonprofit research organization, we also retain and use submitted data in de-identified form to develop, train and validate epigenetic clocks and analysis methods, and to publish aggregate or methodological findings. We do not publish data identifying an individual subject, and we do not name you or your institution without your written permission. We publish with our collaborators and with their direction. The full terms of that licence, including the protection of your right to publish first, are in section 5.3 of our Terms & Conditions. A signed Research Services Agreement takes precedence over both documents.

2.3 Information collected automatically

IP address, browser type and version, and device and operating system details.
Pages visited, referring page, timestamps and time spent.
For form submissions, the page the form was submitted from and the submitting IP address, recorded as evidence of consent and to help identify automated abuse.

3. Cookies and Similar Technologies

Essential cookies. A session cookie keeps you signed in and protects against cross-site request forgery. The Services cannot function without it.
Preference storage. Your choice of light or dark appearance, and whether the portal sidebar is collapsed, are kept in your browser's local storage. They never leave your device.
Analytics cookies. Where analytics are enabled, they measure traffic and page performance in aggregate.

4. Third-Party Service Providers

We use the following providers, each processing only what its function requires:

Google Cloud Platform - hosting, databases and file storage.
Mailchimp - newsletter and audience management, for people who opt in.
Mailchimp Transactional (Mandrill) - service email such as status notifications and password resets.
Stripe - payment processing for optional paid analysis upgrades. Card details are handled by Stripe and never reach our servers.
Google reCAPTCHA - distinguishing people from automated abuse on our public forms. Subject to Google's privacy policy and terms.
Google Analytics and, where enabled, the Meta pixel - aggregate traffic measurement.

5. How We Use Information

To provide, maintain and secure the Services.
To respond to enquiries and provide support.
To deliver the analyses, reports and project services you request.
To send service messages about your account, project or submission.
To send research updates and newsletters, only where you have opted in.
To detect and prevent fraud, abuse and unauthorized access.
To understand aggregate usage and improve the Services.
To meet legal, tax and accounting obligations.

We do not sell personal information.

6. Information Sharing

We share information only:

with the service providers listed in section 4, to perform those functions;
with laboratory and processing partners, where necessary to run the analysis you commissioned;
with collaborators you have explicitly added to your own project;
where you have given us clear permission; and
where required by law, or to protect our rights, safety or property.

7. Data Retention

We keep personal data only as long as needed for the purposes above, or as long as required by law. Research and project records are retained for the life of the project and afterwards as needed for scientific reproducibility, auditing and legal compliance. You may ask us to delete your account and associated personal data at any time; some records must be retained where the law requires it.

8. Your Rights (GDPR)

If you are in the European Economic Area or the United Kingdom, our legal bases for processing are your consent, performance of a contract, compliance with a legal obligation, and our legitimate interests in operating and securing the Services.

You have the right to:

access the personal data we hold about you;
correct inaccurate data;
request erasure;
object to or restrict processing;
receive your data in a portable format;
withdraw consent at any time; and
complain to your data protection authority.

9. Your Rights (California)

California residents have rights under the CCPA and CPRA. The categories of personal information we collect are identifiers (name, email, postal address, IP address), professional information (organization and job title), commercial information (orders and invoices), and internet activity (pages visited).

We do not sell or share personal information for cross-context behavioural advertising. You have the right to know what we collect, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising those rights. To make a request, contact us using section 13.

10. Children's Privacy

The Services are intended for researchers and professionals and are not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Data Security

We use encryption in transit, hashed password storage, role-based access controls, per-record access checks, brute-force protection on sign-in, and private storage with time-limited signed links for uploaded files. No method of internet transmission or electronic storage is completely secure, so while we take these measures seriously we cannot guarantee absolute security.

12. International Transfers

We operate from the United States, and information may be processed there or in other countries where our providers operate. Those countries may have different data protection laws. Where required, we rely on appropriate safeguards for such transfers.

13. Contact Us

Questions about this policy, or requests about your data:

Epigenetic Clock Development Foundation (Clock Foundation)
1124 W. Carson St., MRL Building, 3rd Floor
Torrance, CA 90502
Email: info@clockfoundation.org
Phone: (866) 366-2001

14. Changes to This Policy

We may update this policy from time to time. The "last updated" date above changes when we do. If a change is material we will give notice by email or a prominent notice on the site. Continued use of the Services after a change means you accept the updated policy.