Privacy Policy
Last updated 2026-10-17
Navis Bio operates the Navis Bio Asset Database, a free service that lets AI
assistants such as ChatGPT query drug-development landscape data. This page
explains what we collect when you use it, why, who processes it, and how long
we keep it.
What we collect
- Your email address. You sign in with an email address
and a one-time code. Our authentication provider keeps an account
record for the address (the email address and sign-in metadata). It is
created when a sign-in code is first sent to the address, whether or
not the code is then used. Once you sign in, we keep a record that the
address has access: the address, when access was granted and, if it is,
when it was revoked.
- Sign-in tokens. After you sign in, your AI assistant
holds a signed access token (valid one hour) and refresh token (valid
30 days) that contain your email address. We do not store these tokens;
they expire on their own.
- Client registrations. When an AI assistant connects, it
registers itself with us: an application name, the web addresses it
receives sign-in results at and, for some clients, a client secret. This
describes the application, not you.
- Rate-limit counters. To prevent abuse we count requests
per minute: per signed-in email address for tool requests, and, for the
sign-in pages, per network (IP) address and per email address entered,
stored as one-way hashes.
- Logs. Our hosting provider records each web request to
the service (time, address requested, status, IP address and browser or
client identifier). Our own application logs record the email address
when a sign-in is refused, and error details when a request fails, which
can include the search terms of the failed request.
What we do not collect
We do not store the questions you ask your AI assistant, the search terms it
sends us, or the results we return, except in error logs as described above.
We set no cookies and use no analytics or advertising trackers.
Why
- To sign you in and keep your access working (your email address,
tokens, client registrations).
- To protect the service from abuse and overload (rate-limit counters,
logs).
- To find and fix faults (logs).
Who processes it
- Supabase — authentication (including sending the
sign-in code by email) and the database that holds the records above,
hosted in the United States (AWS us-east-1).
- Google Cloud — hosting (Cloud Run, region us-east4) and
logging.
- Your AI assistant's provider, for example OpenAI for
ChatGPT. Your assistant sends us your requests and receives our answers;
its provider handles that content under its own terms and privacy
policy, not ours.
We do not sell your data or share it with anyone else, and we do not use it
to train AI models.
How long we keep it
- Your account and access record: until you ask us to delete them. This
includes an account record for an address a code was sent to but never
used. If we revoke access, we keep the revoked record so that the
revocation stays in force.
- Access tokens: one hour. Refresh tokens: 30 days.
- Rate-limit counters: deleted by an automatic clean-up once they are
more than ten minutes old; the clean-up runs while the service is in
use, so a counter can outlive that.
- Client registrations: kept until deleted; they do not expire.
- Logs: kept for the retention period of our hosting provider's logging
service.
Your choices
- Disconnect the service in your AI assistant at any time; its tokens stop
working when they expire.
- Ask us what we hold about you, or to correct or delete it, by emailing
support@navis-bio.com from the address you sign in with.
The data we serve
The service returns drug-development landscape data compiled from public
clinical-trial registries and Navis Bio's curation. It is not medical advice,
and it is not personal data about you.
Contact
support@navis-bio.com
Home · Support · Privacy · Terms