Akoya CRM · Customer agreements
Privacy Notice
3.1 Scope and responsibility
AKOYA, LLC operates Akoya CRM and Sales HQ. This notice explains personal information handled for our website, account administration, support, security, and product use. When a Customer uses a workspace to manage other people’s information, that Customer generally decides why it is used, and Akoya processes it under the Customer’s instructions and applicable processing agreement. Contact the Customer about its own outreach or records; we can assist with requests where appropriate.
3.2 Information we handle
Account information includes your email address, name, workspace details, authentication information, eligibility/guardian-approval records when applicable, and records of accepted agreements. Password-based authentication is handled through our authentication provider. We do not request your Outlook password to establish a supported authorization connection.
Workspace information can include professional names, roles, organizations, email addresses, telephone numbers, locations, contact sources, notes, campaign settings, drafts, messages, attachments, proposals, approvals, and activity. AI conversations, uploads, sources, and proposed changes may be saved in the Akoya workspace. Archiving a conversation is not the same as deleting it. Those conversations are separate from a personal ChatGPT account.
When an authorized mailbox feature is enabled, the permissions screen and feature description explain the mailbox information accessed and the operations performed. This can include relevant messages, recipients, timestamps, replies, and drafts needed for the enabled workflow. We also handle technical and usage information, such as access logs, device/browser information, IP addresses where recorded, security events, and usage totals. Support requests and abuse reports may contain additional information supplied by the requester.
3.3 Why information is used
We use information to create and secure accounts, provide requested CRM and AI features, maintain records and usage limits, communicate about the service, administer billing when enabled, investigate abuse, support users, and meet legal obligations. We use appropriate operational information to diagnose and improve reliability. We do not turn customer contact lists into an advertising audience or sell them as a data product.
We handle personal information only on an applicable legal basis, which can include providing a contracted service, legitimate operational and security interests where permitted, compliance with law, or consent where required. Optional marketing or optional tracking consent is not bundled into mandatory service acceptance.
3.4 AI and public research
When you request an AI feature, the necessary prompt, selected workspace context, relevant conversation history, and chosen attachments may be transmitted to an AI provider. Research features may submit public professional search queries and retrieve public sources. Do not place private customer details into a request intended for public web research.
AI providers handle information under their applicable service agreements and account settings. Providers may retain information for service operation, abuse monitoring, or legal duties. A request configured not to store a generated response is not a promise of zero retention everywhere. Contact us for information about the provider and processing terms applicable to an enabled AI feature before submitting information that requires additional restrictions.
3.5 Service providers and integrations
Providers used for supported features include Supabase for authentication/database services, Vercel for hosting, Resend for transactional account email, OpenAI for enabled AI work, Microsoft for customer-authorized mailbox connections, and Stripe for payment processing when enabled. Availability and activation vary; listing a provider does not mean a feature is already connected. Providers receive the information needed for their role under appropriate agreements. Customer-chosen integrations also operate under their own terms and notices.
3.6 Who can access information
Workspace access depends on ownership, membership, permissions, and the feature involved. A company administrator may control its workspace and business records; private conversations are not automatically visible to all members. Authorized Akoya personnel may access relevant information for support, security, legal compliance, and abuse investigation subject to access controls and confidentiality duties. We do not promise that no human can ever view customer content.
We may disclose information when legally required, to protect rights or safety where lawful, or in a business transfer subject to appropriate protections. We will not describe a business transfer as permission to ignore existing commitments. Personal information is not made public merely because it has been imported into Akoya.
3.7 Storage and retention
Workspace records and saved conversations remain available while the account is active unless deleted through supported controls or removed for a documented reason. After closure, you may request an export within 30 days. Contact info@akoyamedical.com to request deletion; we will explain its scope and timing and meet applicable legal deadlines. Retention depends on the purpose of the information, the account relationship, security and legal requirements, and provider backup cycles. We delete or de-identify information when it is no longer needed. Backup copies are restricted from ordinary use until removed through their normal cycle.
We may keep specific billing records, acceptance evidence, security/abuse evidence, and minimal do-not-contact information longer when necessary for legal compliance, dispute resolution, or honoring an objection. Such records must be limited to the purpose, protected, and reviewed for deletion when no longer needed. Deletion in Akoya does not delete copies in a customer’s Outlook mailbox, exports, or independent third-party systems.
3.8 Security, location, and transfers
We use reasonable technical and organizational measures appropriate to the information, including controlled access and protected connections. No system can guarantee perfect security. We do not represent that the Service is HIPAA-ready, SOC 2 certified, or approved for patient data merely because a provider offers such features.
Information may be processed in the United States and other locations used by approved providers. Before offering a feature or accepting a customer that requires an international transfer mechanism, Akoya must put that mechanism and the required disclosures in place. We do not rely on another company’s certifications or transfer arrangements as our own.
3.9 Your choices and requests
Contact info@akoyamedical.com to ask about access, correction, export, deletion, a privacy complaint, or withdrawal of consent where consent is the applicable basis. We may verify your identity and authority using information proportionate to the request. We will respond within the period required by applicable law and explain any permitted refusal and available appeal route. You may have additional rights depending on your location, including objections, restrictions, portability, and complaints to a regulator.
For records controlled by a workspace Customer, we may direct the request to that Customer or act on its instructions. Essential authentication storage and security functions support account access. Any nonessential analytics, advertising pixels, or tracking introduced later must be described and have appropriate controls before activation. Rejecting optional marketing does not prevent use of a paid service.
3.10 Children and policy changes
Akoya does not offer accounts to children under 13. Eligible minors above that minimum require the guardian process described in the Terms and any additional local permissions. If we learn that an account belongs to an ineligible child, we will restrict processing and address removal or other required steps promptly; we will not rely only on a checkbox previously selected. Report a concern to the privacy contact without sending unnecessary identity documents.
We will publish the current version and date of this notice and communicate material changes as required. Materially new uses of previously collected information will require an appropriate legal basis and additional consent where necessary. A notice update alone does not supply that consent.