This Privacy Policy explains how Lungfish collects, uses, and protects information obtained through this website.
Our Collection and Use of Personal Information
Our Usage of Cookies and Related Technology
Categories of Personal Information Disclosed or Sold
Retention, Confidentiality, and Security of Personal Information
Privacy Policy
This Privacy Policy describes how Lungfish, an Inkfish LLC project (“Lungfish” or “we” or “our” or “us”) treats certain information collected or provided in connection with an end user’s (“you” or “your” or “user”) use of Lungfish’s websites and platforms, including https://lung.fish (public website), https://datahub.lung.fish (data hub), our mobile application, and https://opendata.lung.fish (open data portal) (collectively, the “Site“). This Privacy Policy also applies to any Personal Information (defined below) collected, stored, or used by us, such as information you provide us through the above media, by email, mail, or telephonic communications in connection with our Site and any and all products or services provided to you by Lungfish (“Services”). The information provided in this Privacy Policy is designed to inform you of the categories of Personal Information we collect and the sources from which we obtain it; how and why we use your Personal Information; when and with whom we share or disclose your Personal Information; how we use cookies, pixels, and similar technology; how we retain, secure, and protect your Personal Information; your privacy rights and choices, including how to access, correct, delete, or port your data (as applicable) and how to opt out of certain collection; and how to contact us with questions or requests. By accessing or using our Site, you agree to the Terms and Conditions and acknowledge this Privacy Policy, including our collection, use, and disclosure of your Personal Information, as described below. This Privacy Policy is not a contract and does not create any legal rights. Please read this Privacy Policy carefully.
Our Collection and Use of Personal Information
Definition of Personal Information
“Personal Information” is typically understood to mean any information that can be used to identify you, but may be more narrowly defined by applicable law or statute. This Privacy Policy does not cover data we, or our authorized third-party vendors or partners, separately collect lawfully, information that does not or cannot be used to identify a particular individual, or to deidentified, aggregate, or pseudonymous data.
Sources of Personal Information, Generally
We get most Personal Information directly from you, through the Site, or from your use of our Services. We might also obtain Personal Information about you from your institution or organization, or from our Academic Partners (as defined in our Terms and Conditions). If you are sharing information with us about any other individual, you must obtain their consent.
Categories of Personal Information Collected
The categories of Personal Information we may collect from you include:
- Your name (first and last).
- Contact information, including your email address and institutional affiliation.
- Account credentials, including SSO credentials (Google/Microsoft) and/or username and password used to access the website, mobile application, data hub, or portal.
- Information related to your role, site, location, and activity on the website, mobile application, data hub, or portal, including sample metadata, barcode scans, communications, and similar information submitted by you or by individuals working under your direction or on your behalf in connection with your Account.
- Website analytics information, including when, how often, and for how long you use the Site; information related to your geographic location; the content you submit and view; the name of the domain and host from which you access the Internet; the browser and operating system used; URLs requested or referred; response status codes; and the IP address of the computer or device you are using.
- For users of the data hub (https://datahub.lung.fish) or portal (https://opendata.lung.fish), we may collect basic registration information if registration is required, as well as information collected through user interaction with those sites.
- Abstracted location data for sample datasets.
- Information collected through the public website (https://lung.fish) does not include Personal Information, as the public website does not require login or registration.
- GPS position data and time/date stamps collected through the mobile application.
General Reasons for Collection and Use
We collect Personal Information to help identify you; to perform contractual obligations, including providing our Services and facilitating environmental pathogen surveillance activities; to communicate with you; to properly administer our Site and to maintain records; to research and analyze the use of our Site and Services so we can improve our Services; to support academic research in collaboration with our Academic Partners; to detect and prevent fraud; to exercise and defend legal claims; to comply with legal obligations; and for other purposes as described in this Privacy Policy.
Accounts, Profiles, and Preferences
For some aspects of our Site, you may need to register an account with us (“Account”) by providing certain Personal Information, such as through SSO (Google or Microsoft), API or similar verification, or by creating a username and password. In doing so, or in connection with our Services generally, you may need to represent that you are authorized by your institution or organization to access and use the platform. All information that you provide to Lungfish is subject to this Privacy Policy. You may be able to update, correct, or delete information about you by logging into your Account and updating or requesting updates to your profile information or by emailing us at info@lung.fish. If you wish to delete your Account or, under appropriate circumstances, any Personal Information that may have been collected, please email us at info@lung.fish, but note that we may require further verification procedures and necessarily retain certain information about you for legitimate business purposes or as required by law. Please note that previously aggregated or de-identified data cannot be retroactively redacted, and data deletion/removal requests do not require deletion of specimens, research records, analyses, deidentified or aggregated datasets, publications, or scientific records retained under separate agreements with us. We may also collect and maintain Personal Information about you to create a user profile containing preferences and other information that you voluntarily provide to us. This information is used for improved functionality of and your interaction with our Services, to support pathogen surveillance activities, and to facilitate collaboration with our Academic Partners. It is not used for third-party commercial advertising purposes. Examples of the types of information we may collect for this purpose include your first and last name, a valid email address, institutional affiliation, role, site, and geographic location. We may use your email address to send platform notifications and, if necessary, to contact you regarding your use of the Services. You can choose not to provide certain information to us, but it may delay or prevent us from providing our Services to you, including your ability to fully access our Site, participate in our Services, receive our communications, or similar features.
Information Collected Automatically
We may also automatically receive and store certain types of Personal Information whenever you visit the Site, such as information from Google Analytics (see https://policies.google.com/privacy) on when, how often, and for how long you use the Site, information related to your geographic location, and the content you submit and view. Google Analytics is used on our public website (https://lung.fish), data hub (https://datahub.lung.fish), and open data portal (https://opendata.lung.fish), but is not used on the mobile application. This information may include the name of the domain and host from which you access the Internet and the IP address of the computer or device you are using. We may log and use your IP address to administer the Site, to help diagnose problems with our server, to analyze trends, to track users’ webpage movements, to help identify you and/or verify your use, and to gather broad demographic information for aggregate use. We use only strictly necessary cookies for platform functionality. You should be able to control the use of cookies with respect to your own devices by changing your own browser settings.
Pixels, Tags, and Advertising Technologies
Lungfish does not use advertising pixels, tags, or similar advertising technologies. Only strictly necessary cookies and Google Analytics are used on applicable platforms. As appropriate, a cookie consent banner will be implemented to provide relevant users with required notice of cookie usage. Where required by law, we will obtain your consent before using tracking technologies, and you can withdraw your consent or change or request changes to your preferences at any time through your browser settings or by contacting us at info@lung.fish. Lungfish does not sell or share Personal Information for cross-context behavioral advertising.
Log Data
Our web servers may collect log data, which provides aggregate and/or non-aggregate information about the number of visits to different pages on the Site. We use such log data to improve access to the Site based on visitors’ web browsers and operating system types to make the Site available to as many users as possible. We do not link the log data collected to Personal Information except as necessary to provide and/or manage our Services. Third party providers may also collect log data independently from us.
IRB and Research Data
Research data and scientific information published through or in connection with the Services are aggregated and deidentified; thus, no individuals are identified. Environmental pathogen surveillance research as being performed by Lungfish generally does not constitute human subject research requiring approval from an Institutional Review Board (“IRB”) or is exempt research as determined by a relevant IRB. IRB interpretation and regulatory guidance may change over time. If applicable, participating sites or participating organizations should refer to the applicable participation agreement, program documentation, IRB determination, or other research documentation for requirements applicable to their participation. Participating sites or participating organizations may withdraw from Pathogen Research Program activities as described in the applicable participation agreement or other applicable research documentation. If you have questions about IRB requirements applicable to your participation with our Site or Services, please contact us at info@lung.fish. Research participants have the right to withdraw from research activities at any time as stated in their applicable participation agreement or other applicable research documentation.
Aggregation and Deidentification
Lungfish aggregates and deidentifies data collected through our Services to prevent individual results from being identifiable to any particular organization or location. Deidentified and aggregated data is not subject to this Privacy Policy. We do not attempt to re-identify deidentified data.
Children and Minors
Our platforms are for use by participating adults with authenticated Accounts with us, and are not directed at minors under the age of eighteen (18). We comply with the US Children’s Online Privacy Protection Act (COPPA) and do not knowingly collect Personal Information directly from children under the age of thirteen (13) without parental consent. The Family Educational Rights and Privacy Act (FERPA) may also apply to data collected in school settings. If you are a parent or guardian and believe that your child under the age of thirteen (13) has provided Personal Information directly to us without your consent, please notify us at info@lung.fish. If we become aware that information is or has been submitted by or collected directly from a child under the age of thirteen (13) without appropriate consent, we will work to promptly delete this information.
Our Usage of Cookies and Related Technology
What are cookies?
Cookies are small data files stored on your browser or device, which can be in the form of session cookies (which expire once you close your web browser) or persistent cookies (which stay on your browser for a set period of time or until you delete them). They generally contain information such as website preferences, user settings, and browsing history. This information helps us recognize you as you interact with or revisit our Services. Cookies may be served by the entity that operates the website you are visiting (“first-party cookies”) or by other companies (“third-party cookies”). Our Site integrates Google Analytics on the public website, data hub, and open data portal to help us understand how you are using our Site so that we can make improvements. We do not use advertising cookies. We do not use advertising web beacons, pixels, or similar advertising tracking technologies. We may use non-advertising technologies that function similarly to cookies, such as local storage, solely for platform functionality, security, analytics, or user preferences.
How do we use cookies?
We use cookies for a limited number of reasons. These cookies fall into the following categories:
- Essential Cookies—These cookies are strictly necessary for our Services to function properly. Some of our Services depend on these cookies and may not work properly, or at all, if they are disabled.
- Analytics Cookies—We use Google Analytics on our public website, data hub, and open data portal to better understand how you interact with our Services so that we can improve them. For example, we may use these cookies to determine if you have interacted with certain content or features. We can also use these cookies to learn more about which features are the most popular with our users and where we may need to make improvements. Google Analytics is not used on the mobile application.
- Advertising Cookies—We do not currently use advertising cookies on our Site.
What are your choices concerning cookies?
You have the right to choose whether or not to accept cookies. However, since cookies can be an important part of how our Services work, if you remove or reject cookies, this could affect the availability and functionality of our Services. Here are some options to control or limit how cookies are used on our Services:
- You can usually manage settings to remove or reject browser cookies manually within your browser’s configuration settings. To manage these settings, please follow the instructions given by your browser.
- To prevent your data from being used by Google Analytics, you may be able to install Google’s opt-out browser add-on.
Data Minimization
We collect and process Personal Information only to the extent that it is reasonably necessary and proportionate to the purposes for which it was collected, as described in this Privacy Policy. We periodically review our data collection and processing activities to ensure they remain aligned with applicable data minimization requirements.
Categories of Personal Information Disclosed or Sold
Our Sale and Sharing Practices
We do not sell Personal Information to any third parties. We do not share Personal Information for advertising or cross-context behavioral advertising purposes. We do not knowingly collect or sell Personal Information of consumers under the age of thirteen (13). In the preceding twelve (12) months, we did not sell any categories of Personal Information.
Third Parties with Whom We Share Personal Information
In order to conduct our business and better serve you, we may disclose Personal Information and other information about you or your activities on our Site or while using our Services with:
- Our Academic Partners, subject to applicable consortium and data sharing agreements.
- Our service providers and vendors, such as cloud hosting providers (Amazon Web Services), compliance providers, analytics providers (Google Analytics), legal counsel, and various user/visitor, technology, and operational support.
- Institutional partners and collaborators, as necessary to support environmental pathogen surveillance research.
- Financial institutions, payment processors, legal counsel, auditors, insurers, and other professional advisors, as necessary for business operations, compliance, risk management, or legal purposes.
- Law enforcement agencies, regulatory bodies, courts, or other public authorities, to comply with our legal and regulatory obligations, to respond to requests from governmental authorities, to protect our rights, to defend against legal claims, or as otherwise required by law. Testing data or specimens that identify a specific participating party will be disclosed to law enforcement agencies only as described in the applicable participation agreement.
- Actual or potential buyers (and their agents and advisors) of all or part of our organization in connection with any actual or proposed purchase, merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider. In such situations, we may disclose, transfer, or make available your Personal Information as part of such transaction, but will inform the other party that it must use such Personal Information only for the purposes disclosed in this Privacy Policy.
Categories of Personal Information We May Share
The type of Personal Information we may share with others may include (a) your name and contact information, including your email address and institutional affiliation; (b) information related to your role, site, and location; (c) sample metadata, including sample time, location, sample ID, assay type, target pathogens, and results, to the extent such metadata constitutes Personal Information under applicable law; (d) website and platform analytics information, including when, how often, and for how long you use the Site, information related to your geographic location, the content you submit and view, the name of the domain and host from which you access the Internet, and the IP address of the computer or device you are using; and (e) GPS position data collected through the mobile application. For most users and uses, significant aggregation and deidentification is performed to prevent individual results from being identifiable to any particular organization or location.
Third-Party Independent Collection
Some third-party providers may independently collect Personal Information when you visit our Site. Our authorized third-party vendors and partners have their own privacy policies which govern the use, handling, and disclosure of your Personal Information.
Third-Party Analytics Services
We also may use third-party web analytics services on our Site, such as those of Google Analytics (see https://policies.google.com/privacy). The information collected may be used by Lungfish and/or others in aggregated and anonymized formats to, among other things, evaluate use of the Site and relevant Services, analyze and track data, determine the popularity of certain content, and better understand your online activity. For most users and uses, Lungfish performs significant aggregation and anonymization to prevent individual results from being identifiable to any particular organization or location. Lungfish does not deliver advertising or content targeted to your interests.
Retention, Confidentiality, and Security of Personal Information
Retention Periods and Criteria
We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain business records, comply with legal obligations, resolve disputes, enforce agreements, and satisfy applicable statutes of limitations or preservation obligations. Personal Information is generally held until permission is revoked by the user. Please note that removal of Personal Information is prospective only; previously aggregated or de-identified data cannot be retroactively redacted from aggregated datasets. In deciding how long to retain Personal Information, we may consider many criteria, including the business purposes for which the Personal Information was collected, relevant recordkeeping and personal data privacy laws, applicable statutes of limitations for lawsuits, claims, or disputes to which the Personal Information may be relevant, and legal preservation of evidence obligations. Where we have implemented applicable retention schedules, certain categories of Personal Information may be deleted or deidentified after a set period of time, unless we are legally required or permitted to retain them longer.
Security Measures and Breach Notification
We restrict access to Personal Information to those who need to know in order to provide services to you and to conduct our internal operations. We maintain reasonable physical, electronic, and procedural safeguards to guard your information. All platforms are owned and hosted by Inkfish LLC on Amazon Web Services (AWS). However, the Internet and digital information is not absolutely secure and, thus, we cannot promise guaranteed security. In the unlikely event that we believe that the security of your Personal Information in our possession or control may have been compromised, we may seek to notify you. As applicable, we will comply with notification requirements for a security breach under applicable laws, and may also notify you using the email address you have provided to us.
NO WARRANTY
We make no warranty, express, implied, or otherwise, that we will prevent unauthorized access to or use of your Personal Information. If you do not agree to the collection, processing, storage, and transfer of your Personal Information as described herein, please do not provide your Personal Information or use our Services.
Business Transfers
In the event of a merger, acquisition, corporate change, or bankruptcy, we may share, sell, or transfer your Personal Information as part of a transfer of our assets to the acquiring entity.
Your Rights
Under state or international law, you may have certain rights. Please read below for information or options that may apply to residents of certain jurisdictions.
How to Exercise Your Rights; Verification Process
To exercise any of the rights described in this section (regardless of your jurisdiction), you or your authorized agent may submit a request by contacting us at info@lung.fish or Inkfish LLC, 2303 W Commodore Way Suite 304, Seattle, WA 98199; phone: +1 803 738 5983. We will verify your identity before processing your request by matching information you provide against information we maintain. You or your agent must provide sufficient confirmable identifying information for us to verify your request. In some states, you can designate an authorized agent to make a request on your behalf; if so, we may require written signed permission from you, proof of your identity, and verification of the agent’s identity. We will respond to verifiable requests within the timeframes required by applicable law. We will not discriminate against you for exercising any of your privacy rights. Please note that we are not required to respond to more than the legally permitted number of requests per calendar year, and certain information may be retained for recordkeeping, to complete transactions you began, or as required by law.
Residents of California
As we do not sell your Personal Information, there is no need to submit a request to opt-out. We will not disclose your Personal Information to third parties for them to use for their direct marketing purposes unless you agree to us making that disclosure. “Do not track”: Section 22575 of the California Business & Professions Code requires website and online service operators to disclose whether they honor web browser “Do Not Track” settings. Some browsers incorporate a “Do Not Track” (DNT) feature that, when turned on, signals to websites and online services that you do not wish to be tracked. Because there is not yet an accepted standard for how to respond to browser DNT signals, we do not currently respond to them. We reserve the right to update our practices and Privacy Policy as such standards evolve. For more information about Do Not Track, please visit www.allaboutdnt.org. “Shine the Light” law: Effective January 1, 2005, under California Civil Code Section 1798.83, if an individual who is a California resident has provided Personal Information to a business in connection with a business relationship that is primarily for personal, family, or household purposes, and if that business has within the immediately preceding calendar year disclosed such an individual’s Personal Information to a third party and knows or should have known that such third party used the information for its own direct marketing purposes, then that business is obligated to disclose in writing to such individual upon request, what Personal Information was shared and with whom it was shared. Additionally, certain visitors to our Site may have the following rights:
- The right to correct inaccuracies in your Personal Information in our possession.
- The right to request we delete Personal Information we have collected about you.The right to request that we disclose the specific pieces of Personal Information we have collected about you.
- The right to request the categories of Personal Information we have collected about you; the categories of Personal Information we sold or shared about you; the categories of third parties to whom the Personal Information was sold or shared, by category of Personal Information; the categories of Personal Information we disclosed about you for a business purpose; and the categories of third parties to whom we disclosed Personal Information for a business purpose. If you or your authorized agent would like to submit a verifiable consumer request to correct inaccuracies, to delete, or for information, please contact us at info@lung.fish or Inkfish LLC, 2303 W Commodore Way Suite 304, Seattle, WA 98199; phone: +1 803 738 5983. You or your agent must provide sufficient confirmable identifying information in order for us to verify your request. You have the right to not be discriminated against for exercising any of these rights. Any request for a disclosure required under this California law should be sent to us as indicated below in the Contact Us section. Please note that under this law, we are not required to respond to your request more than once in a calendar year, nor are we required to respond to any request that is not sent to the email or mailing address as noted herein.
Users from Nevada
Relevant consumers may submit a verified request directing Inkfish to not make any sale of any covered information Inkfish has or will collect about the consumer by contacting us at info@lung.fish or Inkfish LLC, 2303 W Commodore Way Suite 304, Seattle, WA 98199; phone: +1 803 738 5983. You or your agent must provide sufficient confirmable and/or identifying information in order for us to verify and process your request.
Other US States
If you are a resident of a US state that has applicable privacy laws, including but not limited to, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to obtain confirmation that we maintain certain Personal Information relating to you, to verify its content, origin, and accuracy, as well as the right to access your Personal Information, request updates or corrections to your Personal Information, request deletion or portability of your Personal Information. You may also have the right to obtain the identities of the third parties to whom we disclose your Personal Information. You may also be able to request restriction of the processing, including for targeted advertising. Additionally, in certain states you may have the right to opt-out of the “sale” of your Personal Information, as the term is defined under applicable law. Your rights may include: (a) the right to confirm whether we process your Personal Information and to access such data; (b) the right to correct inaccuracies in your Personal Information; (c) the right to request deletion of your Personal Information, subject to certain exceptions; (d) the right to obtain a copy of your Personal Information in a portable, machine-readable format (data portability); (e) the right to opt out of targeted advertising, the “sale” of your Personal Information, and profiling in furtherance of decisions that produce legal or similarly significant effects; (f) the right to appeal a denial of your privacy request; and (g) the right not to be discriminated against or retaliated against for exercising these rights. In some states, you can designate an authorized agent to make a request on your behalf. Please note that we may need to retain certain information for recordkeeping purposes, to complete any transactions that you began prior to your request, or for other purposes as required or permitted by applicable law. In any event, should you choose to exercise any of your rights as detailed above, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products, based solely upon this request.You can exercise your rights for any of the jurisdictions listed above by contacting us as detailed under the “Contact Us” heading below.
Users Outside the United States
Our Site is hosted in the United States on Amazon Web Services (AWS), and the Terms are governed as described in the Terms and Conditions. If you are using the Services from outside the United States, please be aware that your Personal Information may be transferred to, stored, and processed in the United States where our servers are located. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. By using the Services, you consent to your Personal Information being transferred to our facilities and/or to the facilities of those third parties with whom we share it as described in this Privacy Policy.
European Economic Area (EEA), Switzerland, and the United Kingdom (UK)
As described in this Privacy Policy, we process Personal Information where we have a lawful basis to do so, which may include consent, performance of a contract, compliance with legal obligations, legitimate interests, or other lawful bases recognized under applicable law. When we transfer your personal information to other countries, we will protect that information as described in this Privacy Policy and in accordance with applicable law. We use contractual protections for the transfer of personal information among various jurisdictions (including, for example, the European Commission’s standard contractual clauses). To deliver Services to you, it may also be necessary for us to transfer your Personal Information to the United States. Under certain circumstances, you may have the following rights:
- The right to request access to your Personal Information in our possession.
- The right to request rectification (correction of inaccuracies) of your Personal Information in our possession.
- The right to erasure (deletion) or of certain restriction of processing of your Personal Information in our possession.
- The right to object to the processing of your Personal Information in our possession.
- The right to data portability (transfer) of your personal data in our possession.In the future, if we process any of your Personal Information by automated means, you may have the right to data portability (transfer) of your Personal Information in our possession. Where you have given us consent to process your Personal Information for a specific purpose, you may withdraw that consent for processing that has not yet occurred.
Last Modified: June 16, 2026.