Privacy Policy

This Privacy Policy explains how Tile River LLC, a Florida limited liability company ("TileRiver," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information when you visit tileriver.com or use TileRiver Studio, TileRiver Explore, and related self-service features (collectively, the "Services"). It also describes the rights and choices available to you under applicable privacy laws.

TileRiver is responsible for determining how personal information collected for our own account administration, website operations, billing, customer support, and analytics is processed. Where a workspace owner or organization independently determines the purposes and permissions for materials submitted to Studio, that person or organization also has responsibilities under applicable privacy law.

Studio is intended only for properly de-identified research, education, and non-clinical collaboration materials. It is not intended to receive protected health information (PHI), identifiable patient data, or other information that identifies a patient. The TileRiver Studio Terms of Service prohibit such submissions and describe suspension, removal, and other protective measures.

1. Information we collect

Depending on how you interact with the Services, we collect the following categories of information.

Account and profile information

When you register or maintain an account, we collect information such as your name, email address, login credentials or authentication identifiers, organization or affiliation if provided, account preferences, and workspace memberships and roles. We may collect information necessary to verify or protect access to your account.

Workspace content

We process de-identified pathology images, slides, documents, associated metadata, collections, annotations, comments, discussions, shared links, research or teaching materials, model settings, and other content submitted or created through the Services ("Studio Content"). Some Studio Content may contain personal information about an uploader, researcher, contributor, or collaborator, such as a display name or authored comment, even when no patient information is present.

You must not upload or disclose patient-identifying information through Studio. Studio's automated controls may assist with selected identifying fields but cannot guarantee that pixels, labels, PDFs, or other unstructured material have been adequately de-identified.

Payments and transactions

Our payment processor, Stripe, processes payment-card and related payment information. We receive information needed to manage purchases and subscriptions, such as billing contact information, transaction and subscription identifiers, plan status, payment status, invoices, amounts charged, and limited payment-method details. We do not need to store your full payment-card number to provide the Services.

Usage, device, and diagnostic information

We automatically receive technical information such as IP address, approximate location inferred from IP address, browser and device type, operating system, referral information, timestamps, pages viewed, features used, login and security events, uploads and job status, errors, performance information, and other operational logs. These details help us operate, troubleshoot, measure, and protect the Services.

We use PostHog for website and product analytics. Depending on the implemented configuration and your consent choices where applicable, PostHog may process usage events, navigation and interaction information, device or browser identifiers, and related technical data for analytics and product improvement.

Communications and support

We collect information you provide through our contact form, billing requests, support correspondence, complaints, surveys, and other communications, including your contact details, the substance of your request, and records of our responses. Do not submit PHI or patient-identifying information in a support or contact message.

Cookies and similar technologies

We use cookies and similar browser technologies for authentication, session continuity, security, remembering preferences, and, as applicable, analytics. More information about these technologies and your choices appears in Section 7.

2. How we obtain information

We collect information directly from you when you register, upload content, configure a workspace, share or publish material, purchase credits or subscriptions, or contact us. We also collect information automatically when you interact with our website or applications and receive relevant subscription or transaction information from Stripe and technical or analytics information from our service providers. Other users may provide information about you when inviting you to a workspace, mentioning you in a discussion, or assigning collaboration permissions.

3. Why we process information

We process information for the following purposes:

• Providing the Services: Creating accounts, authenticating users, hosting and normalizing supported files, displaying content, enabling workspaces, managing sharing permissions, and performing requested AI jobs.
• Payments and subscriptions: Processing purchases through Stripe, issuing billing notices, maintaining account entitlements, preventing payment fraud, and maintaining business records.
• Security and integrity: Protecting accounts and systems, investigating suspicious activity, preventing unauthorized access, detecting abuse, and enforcing the prohibition on patient-identifying information.
• Service operation and improvement: Measuring usage, monitoring performance, diagnosing failures, understanding feature adoption, and improving reliability and user experience.
• Communication: Responding to questions, providing support, sending service or security notices, and communicating relevant account changes.
• Compliance and legal rights: Meeting lawful obligations, responding to valid legal process, addressing infringement or privacy reports, and establishing, exercising, or defending legal claims.
• Optional communications and activities: Sending marketing communications or undertaking other optional processing where you have made the required choice or where applicable law otherwise permits it.

Where the European Economic Area, United Kingdom, or similar privacy laws require a legal basis, our bases include: performance of a contract for account access and service delivery; compliance with legal obligations for required records and legal requests; legitimate interests in securing, operating, understanding, and improving the Services, balanced against your rights; and consent for processing that requires it, such as certain optional cookies, marketing, or content-based AI training. You may withdraw consent at any time for future consent-based processing, without affecting processing lawfully performed before withdrawal.

4. Strict patient-data prohibition and de-identification

TileRiver Studio is designed for de-identified materials only. Users are responsible for ensuring, before submission, that materials comply with applicable de-identification standards, privacy laws, institutional permissions, professional obligations, and the Terms of Service.

The prohibition covers patient identifiers within image pixels, slide labels, barcodes, gross photographs, filenames, DICOM tags, embedded metadata, PDFs, annotations, descriptions, messages, AI inputs and outputs, and any other element of submitted material. Removal of a visible name or certain structured identifiers alone does not necessarily establish de-identification.

Studio may remove or examine supported metadata, filenames, label images, annotations, and certain free-text fields. These measures provide assistance only. We do not guarantee that all identifiers will be detected, that all image pixels or document contents will be inspected, or that uploaded materials meet any particular legal de-identification standard. An upload succeeding does not mean it has been independently certified as anonymous or safe to disclose.

If patient-identifying material is detected or credibly reported, we may immediately disable access, stop processing, suspend the affected account or workspace, and remove the offending material. Accounts determined to have exposed such information will be suspended and the offending data removed. We may preserve only information reasonably needed or legally required for incident containment, security, investigations, notifications, or other legal obligations. Any legally required notifications will be handled according to applicable law. You may report a concern at tileriver.com/contact, without including patient identifiers in the report.

5. Sharing, collaboration, and public Explore content

Studio provides different ways to make materials available. The visibility of content depends on the settings selected by authorized users.

Private workspaces and restricted content. Studio Content is accessible to users who have permission through the relevant workspace, collection, or feature. Workspace owners and administrators may administer membership and access according to their roles.

Share links. If a user enables link sharing, the linked material may be accessible to anyone who receives a valid link, including people to whom the original recipient forwards it. Restricting or resetting a link does not undo copies already obtained by recipients.

Public Explore. If a user intentionally publishes a collection or material to Explore, it may be accessible to anyone, including people without Studio accounts. Public content may appear in search results, be linked or embedded by others where supported, and be copied or cached outside TileRiver's control. Removing public content from Studio does not necessarily remove independent copies from search engines or third-party sites.

Collaboration. Account names, profile information, discussions, annotations, and activity associated with content may be visible to other permitted collaborators or to the public where included in a publicly shared collection.

Users are responsible for obtaining appropriate permissions before sharing content or information about others, including information that is not patient data but is protected by copyright, contractual confidentiality, or privacy law.

6. AI processing and model training

Studio may process content using AI models selected or supplied by an authorized user. A requested model run may involve transferring the inputs necessary for that run to infrastructure or a model provider involved in carrying out the request. Model publishers and other independent third parties may have additional terms applicable to a selected model or integration.

We do not use Studio Content to train or fine-tune AI models without a separate, explicit, affirmative opt-in from an authorized person. Creating an account, uploading files, agreeing to our Terms, using AI inference, or buying AI credits is not consent to model training. Where a user has separately authorized training, the authorization identifies the applicable use and can be withdrawn for future consent-based processing, subject to applicable law and any processing already lawfully completed.

We may process technical information about AI jobs, including execution status, execution time, logs, consumption, and costs, for requested processing, billing, reliability, security, and troubleshooting. We do not treat permission for this operational processing as permission to train models on uploaded pathology content.

Do not submit patient-identifying information to any model through Studio. Users are responsible for reviewing the rights and suitability of content supplied to third-party or user-installed models.

7. Service providers, disclosures, and cookies

We share information only as reasonably necessary for the purposes described in this Policy and in accordance with applicable law. The service providers currently identified for core Studio operations include:

We may also disclose information to providers supporting communications, authentication, security, customer support, or a model execution that a user requests, to the extent those providers are used for the applicable activity. We require appropriate safeguards and contractual protections when mandated by applicable law. Providers process information according to their applicable roles, contracts, and privacy notices.

Information may also be disclosed to other Studio users according to sharing settings; to parties involved in a lawful corporate transaction with appropriate confidentiality and legal protections; or where reasonably necessary to comply with law, respond to valid legal process, prevent fraud or serious harm, investigate incidents, or enforce legal rights.

We do not sell uploaded pathology content or use it for advertising model training. We do not sell personal information to data brokers or use it for cross-context behavioral advertising. If our practices change in a way that triggers additional consent, disclosure, or opt-out requirements, we will provide the choices and notices required by applicable law.

We use essential cookies or similar storage to keep users authenticated, maintain secure sessions, and save preferences. Analytics technologies, including those associated with PostHog, may be used to understand product and website usage. You can manage browser cookies through your browser settings, although blocking essential cookies may interfere with sign-in or normal operation. Where applicable law requires consent before use of nonessential cookies or analytics, we will obtain that consent; where applicable law provides an opt-out right, we will honor valid requests or signals as required. You may contact us for information about available privacy choices.

8. Storage locations and international transfers

TileRiver Studio uses AWS infrastructure in the United States. Your account information and Studio Content are hosted in the United States. Stripe, PostHog, and other service providers may process information in locations permitted by their applicable service arrangements and laws.

If you access the Services from outside the United States, your information may be transferred to and processed in the United States, where privacy protections may differ from those in your home jurisdiction. Where international privacy laws require additional transfer safeguards or a legally recognized basis for a transfer, those requirements apply to our handling of personal information. You may contact us for information about the safeguards relevant to your data.

The Services are available to adults worldwide where lawful, but cross-border access does not change Studio's prohibition on patient-identifying content or override restrictions imposed by applicable law or your institution.

9. Retention and deletion

We retain account and Studio information while needed to provide the Services and for the purposes described in this Policy, consistent with user instructions and applicable law.

When you delete Studio files or close an eligible account, the Studio data designated for deletion is deleted from our systems within 30 days. This includes associated content maintained for ordinary service operation. If a file or account is removed because it exposes prohibited patient data, we may restrict access immediately while completing deletion and any legally required incident handling.

Certain limited information, including payment and tax records, transaction history, security and abuse records, and information relevant to a dispute, legal hold, or regulatory obligation, may be retained longer where required or permitted by law. We restrict that retention to the relevant purpose and delete or anonymize information when the lawful reason ends. Data still belonging to an independently managed workspace or another account is not automatically deleted when one collaborating user closes an account.

We cannot delete independently retained copies previously downloaded, cached, republished, or received by other users, search engines, model providers, or third parties. Ending a subscription does not necessarily delete an account or its content unless the account is closed or an applicable deletion process is initiated.

10. Security and incident handling

We use administrative, technical, and organizational measures designed to protect personal information, including access restrictions, account controls, encrypted communications, encrypted storage where implemented for the Services, monitoring, and logging. Security measures evolve with the Services, and no technology or transmission method is entirely risk-free.

You are responsible for protecting your own credentials, devices, account access, and workspace sharing settings. Notify us promptly if you suspect account compromise, an unauthorized disclosure, or prohibited patient information in Studio. We investigate credible incidents and provide notifications to affected people or authorities when required by applicable law.

Please do not submit patient identifiers or other unnecessary sensitive information when reporting a security or privacy concern.

11. Privacy rights and choices

Depending on your jurisdiction, you may have rights to:

• Request confirmation of whether we process personal information about you and obtain access to it.
• Correct inaccurate personal information or request completion of incomplete information.
• Request deletion of eligible personal information.
• Obtain a portable copy of certain personal information when required by law.
• Restrict or object to particular processing, including certain processing based on legitimate interests.
• Withdraw consent for future processing when consent is the legal basis.
• Opt out of marketing communications and, where applicable, certain processing involving advertising, sale, profiling, or other legally protected choices.
• Appeal a denial of a privacy request where the law grants an appeal right.
• Lodge a complaint with the data-protection or consumer-protection authority having jurisdiction over your concern.

To exercise available rights, submit a request through tileriver.com/contact. We may verify your identity and authority before responding, including by contacting your registered email address or requesting proportionate additional information. We will respond within the time required by applicable law and provide any available appeal mechanism where required. We do not unlawfully discriminate against anyone for exercising applicable privacy rights.

Some information may be exempt from a particular request, including information we must retain for financial records, security, legal compliance, disputes, or the rights of others. If you participate in a workspace controlled by another individual or institution, certain content or access requests may require coordination with the applicable workspace administrator or controller.

Users in the European Economic Area or United Kingdom may have additional rights under the GDPR or UK GDPR, including rights relating to lawful bases, objection, restriction, portability, and supervisory complaints. Users in U.S. states and other jurisdictions with applicable privacy laws may have additional rights under those laws. No provision in this Policy eliminates a mandatory right provided by law.

12. Marketing and service communications

We may send operational communications relating to your account, security, billing, transactions, or changes to the Services. These messages are part of providing the Services and may continue while you maintain an account when legally permitted.

If we send optional promotional email, you may unsubscribe using the method included in the message or contact us. Unsubscribing from marketing does not prevent necessary service, transaction, or security notices.

13. Age restrictions

Studio is intended for people 18 years of age or older. We do not knowingly provide accounts to or intentionally solicit personal information from people under 18. If we learn that someone under 18 has created an account, we may disable it and delete associated information in accordance with applicable law and our deletion practices. Reports can be submitted through our contact page.

14. Changes to this Policy

We may update this Policy to reflect changes in our products, practices, service providers, or legal obligations. We will publish the revised Policy with an updated effective date. If a change materially affects how we handle personal information, we will provide additional notice or seek consent where required by law. Changes do not authorize uses that require consent unless the required consent has been obtained.

15. Contact

For privacy questions, requests to access, correct, or delete personal information, suspected unauthorized disclosures, or questions about our data practices, contact Tile River LLC through tileriver.com/contact.