Website and hosting data
Netlify and related infrastructure may process IP address, browser and device information, requested pages, timestamps, referring page and diagnostic or security logs needed to deliver and protect the service.
Privacy notice · Updated 30 September 2026
Plain-language data practices
This notice explains the information handled by Life Sciences AI Academy, operated by GxP Frame, when you browse the site, use the public readiness assessment, complete curriculum activities or contact us.
Curriculum downloads · Added 5 September 2026
Registration and optional updates
When you request the Compliant AI in GMP documents, GxP Frame stores your first and last name, company, job title, work email, source form, registration time, document version, privacy acknowledgment and optional training-update choice in its Netlify-hosted lead registry. The record includes the wording and version shown to you, link expiry, and the time and count of download responses served across the executive brief and full blueprint. These records do not prove that a person read either document or owns the email address entered. A first download also sends an internal notification to GxP Frame containing the registration details and consent choice, using Netlify’s form notification service. This does not subscribe you to marketing updates.
Registration provides a private link on screen, valid for 24 hours. It does not create a learner account or subscribe you to updates unless you select that optional choice. We use a keyed hash of the connection IP address to limit repeated registrations; the registration service does not store the raw IP address. Hosting logs may still process connection details as described below. Keep your download link private.
Lead records are retained as needed to fulfill the request, administer consent and respond to related inquiries, and are reviewed for deletion or de-identification when no longer needed. Contact bdrapeau@gxpframe.com to request access, correction, deletion or withdrawal from training updates.
Scope and controller
Who is responsible
GxP Frame operates Life Sciences AI Academy and is responsible for the personal information described here unless an organizational agreement assigns responsibilities differently. Questions and requests may be sent to bdrapeau@gxpframe.com or made by telephone at (973) 975-7375.
Information collected
The data depends on how you use the site
Public 30-question assessment
Answers and optional identity fields stay in the browser unless you print or download them. The optional Discuss these results action carries only a score, determination, failed gate references, instrument version and completion time to the inquiry page. That summary is sent only if you choose to include it in your inquiry. Full answers and narratives are not included.
Privacy-conscious funnel events
When enabled, the Academy aggregates allowlisted event names, fixed interface sources and page categories. It does not store raw paths, Advisor questions, form contents, account identifiers, query strings or persistent visitor IDs in analytics. A random per-event identifier prevents duplicate retries and expires after 24 hours; daily aggregate counts are retained for 180 days, with scheduled cleanup. Short-lived address hashes limit abuse separately. Hosting logs may still process connection data.
Curriculum and credential records
When you sign in, the Academy uses your authenticated account to associate persistent curriculum and credential records. These include display name, role, saved experience and learning-goal preferences, readiness result where provided, lesson progress, knowledge-check outcomes, written evidence descriptions, assessment attempts, capstone responses, badge details and timestamps. Guest practice transfers into your account only when you explicitly choose to save it.
Communications and enterprise inquiries
If you email, call or submit an enterprise inquiry, we receive the contact details and information you choose to provide. The enterprise form may include your name, work email, organization, role, approximate learner count, meeting timing and a high-level description of your needs. Organizational engagements may collect roster or identity-assurance information under a separate written arrangement.
Purpose and basis
Why the information is used
- To deliver the site, remember learner state and maintain service security and reliability.
- To assign pathways, evaluate assessment criteria, issue and verify credentials, support remediation and maintain curriculum records.
- To answer inquiries, provide requested services, administer organizational engagements and meet contractual obligations.
- To understand aggregate service performance, prevent abuse, correct errors and meet legal, accounting or regulatory responsibilities.
Depending on location and context, processing may rely on performance of a contract, steps requested before a contract, legitimate interests in operating and securing the service, consent where required, or compliance with law. An organizational sponsor may establish an additional basis for workforce records.
Do not submit sensitive regulated data
Do not enter protected health information, patient or subject data, adverse-event information, trade secrets, passwords, batch records, unredacted deviations or other confidential regulated records into the public assessment, curriculum exercises or ordinary email. An organizational engagement must define approved data, systems and handling controls before such material is used.
Disclosure and sale
Service providers, external links and advertising
Information may be processed by hosting, database, communications, security and professional-service providers that support the Academy; by an organizational sponsor responsible for its learners; or when required by law, necessary to protect rights and security, or connected with a legitimate business reorganization. The Academy does not sell personal information and does not share it for cross-context behavioral advertising. The site does not intentionally use advertising cookies. External publisher, LinkedIn, regulator and standards links are governed by those services' own notices.
Cookies and browser storage
Functional state, not advertising profiles
The public 30-question assessment uses session storage when you choose “Save in browser.” The Academy uses authentication cookies as needed for account sessions, and hosting and security infrastructure may use technically necessary cookies or similar mechanisms for delivery, abuse prevention and session integrity. The Academy does not intentionally place advertising or cross-site behavioral tracking cookies. You can clear browser storage through your browser settings, but doing so may remove browser-only assessment responses. Temporary Stage 1 practice drafts and account-return intent use tab-scoped storage with a 24-hour application expiry. Draft text may remain in memory when browser storage is unavailable; refreshing can then lose it. Do not enter confidential or regulated records in practice fields.
Retention and security
Records are limited by purpose, not an invented universal period
Browser-only readiness responses last for the browser tab session unless you download or print them. Temporary curriculum drafts and readiness inquiry summaries expire after 24 hours when next accessed and can be cleared sooner. Persistent learner and credential records are kept as needed to provide verification, document assessment and meet legal, contractual or dispute requirements; they may be deleted or de-identified when no longer needed.
Reasonable administrative and technical measures are used to protect records, including access controls provided by the hosting and database environment. No internet service or storage method is guaranteed secure. Report a suspected compromise promptly and do not use this site as an emergency reporting channel.
Your choices
Access, correction, deletion and other rights
You may ask to access, correct or delete personal information, object to or restrict certain processing, receive a portable copy where applicable, or withdraw consent without affecting prior processing. Rights vary by jurisdiction and may be limited by identity verification, legal duties, credential-integrity needs and organizational sponsorship. Contact bdrapeau@gxpframe.com with “Privacy request” in the subject. You may also complain to the data-protection authority that applies to you.
International use and minors
United States operation
The service is operated from the United States. Information may be processed in the United States or other locations used by service providers, with transfer measures applied where required. The Academy is intended for adult professionals and is not directed to children under 16. Contact us if you believe a child has supplied personal information.
Changes
Notice revisions
The effective date above changes when this notice is materially revised. Significant changes may also be presented in the service or communicated to affected organizational customers. Continued use after a revision is governed by the updated notice to the extent permitted by law.