Recursion Website Privacy Notice

Last Updated: February 24, 2025

Recursion Pharmaceuticals and its affiliates and subsidiaries (“Recursion”, “we”, “our”, and “us”) is committed to protecting and maintaining your privacy. This Privacy Notice (“Notice”) is designed to help you understand how we collect, use, and share your Personal Data. Recursion processes Personal Data in accordance with applicable national, provincial/state, and local laws and regulations.

This Notice applies to the processing of your Personal Data when:

  • you visit www.recursion.com or any other Recursion website or application (the “Website”) or we process your Personal Data to receive and respond to communications you make with us either online (such as by email or via our social media platforms) or offline to our physical address;
  • you are a principal, employee, agent, or contractor of our business partners;
  • you are a clinical investigator, member of an investigator team, or other study site personnel;
  • you are a clinical study candidate; or
  • you are a candidate for employment or apprenticeship at Recursion.

Within the scope of this Notice, Recursion generally acts as a data controller for the Personal Data we process. This means that we decide how and why Personal Data is collected and further processed.

Recursion may have other unique privacy policies or notices that apply to certain specific situations. To the extent you were provided with a different privacy policy or notice and that policy or notice applies, those policies or notices will govern our interactions with you, not this one.  For example, if you are a participant in a clinical study, clinical trial, or other health-related research, you should receive a separate privacy notice regarding the Personal Data we process for those purposes.

Please review this Notice carefully. To the extent permitted by applicable law, by providing us your Personal Data or otherwise interacting with us, you are agreeing to this Notice.

Information Collected.
  • Personal Data” is any information—as electronically or otherwise recorded—that can be used to identify a person or that we can link directly to an individual. Personal Data in some jurisdictions can include information that indirectly identifies a person, such as a unique display name, even absent other identifying information. Personal Data may include information considered sensitive in some jurisdictions, such as financial account information, geolocation, and other information. Data that could be considered Sensitive Personal Data in some jurisdictions is highlighted with an asterisk (*) in the summary charts below.
  • In some circumstances, if you do not provide us with your Personal Data, the Website or our services may be unavailable to you.
  • Below is a summary of how we collect, process, and use Personal Data and the potential recipients of your Personal Data, and how we have done so in the preceding 12 months. Some jurisdictions require us to state the legal bases for processing your Personal Data, which are included below, but please note that not all jurisdictions may recognize all legal bases.

Website Visitors and Persons Who Communicate with Us

|
|

We may process your Personal Data when you visit our Website or communicate with us either online (such as by email or via our social media platform) or offline (such as by phone or to our physical address).

What types of data may we process?

Identity and contact information, such as:

  • first and last name
  • email address
  • postal address
  • phone number

Other personal information, such as:

  • areas of interest in medical research
  • user activity

Technical Information, such as:

  • Internet Protocol (IP) addresses (which may identify your general geographic location or company)
  • browser type, version and language
  • device type
  • advertising IDs associated with your device (such as Apple’s Identifier for Advertising (IDFA) or Android’s Advertising ID (AAID))
  • date and time you visit and use the Website
  • Uniform Resource Locators, or URLs (i.e., website addresses) visited prior to arriving and after leaving our Website
  • activity on the Website and referring websites or applications
  • data collected from cookies or other similar technologies
  • geolocation information

Anonymized / Deidentified Data

Anonymized Data / De-identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.**

What types of data may we process?

  • you directly
  • your devices
  • third parties

What types of data may we process?

  • to communicate with you
  • to administer our relationship with you
  • to send you updates
  • to identify and authenticate you
  • to customize content for you
  • to detect security incidents
  • to protect against malicious or illegal activity
  • to ensure the appropriate use of the Website
  • to improve the Website
  • for short-term, transient use
  • for administrative purposes
  • for marketing, internal research, and development
  • for quality assurance

What types of data may we process?

  • for the purposes of our legitimate interests
  • in preparation for or to perform a contract with you
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law***

What types of data may we process?

  • Recursion and our parents, affiliates, subsidiaries, and related companies
  • professional advisors, such as lawyers, insurers and auditors
  • partners that assist us, including in providing the Website or helping  us improve our marketing or administration****

Business Partners and Their Employees, Agents, and Contractors

|
|

We may process your Personal Data when you act as a business partner, such as a vendor, supplier, distributor, retailer, or service provider, or are an employee, agent, or contractor of a business partner.

What types of data may we process?

Identity and contact information, such as:

  • first and last name
  • company/employer
  • email address
  • postal address
  • phone number

Other personal information, such as:

  • age
  • gender
  • marital status
  • disability
  • social security number*
  • date of birth

Commercial and financial information, such as:

  • products and services purchased, obtained, or considered
  • request documentation
  • customer service records
  • financial transaction history
  • credit card number, expiration date, and CVV*
  • financial account number*

Anonymized / Deidentified Data

Anonymized Data / De-identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.**

What types of data may we process?

  • you directly
  • our business partners and other third parties
  • your employer or principal

What types of data may we process?

  • to communicate with you
  • to administer our relationship with your organization
  • to send you updates
  • to identify and authenticate you
  • to detect security incidents
  • to protect against malicious or illegal activity
  • for short-term, transient use
  • for administrative purposes
  • for marketing, internal research, and development
  • to communicate with you

What types of data may we process?

  • for the purposes of our legitimate interests
  • to comply with a legal obligation
  • in preparation for or to perform a contract
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law***

What types of data may we process?

  • Recursion and our parents, affiliates, subsidiaries, and related companies
  • professional advisors, such as lawyers, insurers and auditors
  • partners that assist us including in helping us improve our marketing or administration****

Clinical Investigators and Members of Investigator Teams

|
|

We may process your Personal Data when you act as an existing or prospective clinical investigator or member of an investigation for a clinical study sponsored by us or conducted by us on behalf of a third party.

What types of data may we process?

Identity and contact information, such as:

  • first and last name
  • company/employer
  • business and personal email address
  • business and personal postal address
  • phone number

Other personal information, such as:

  • age
  • gender
  • disability
  • social security number*
  • date of birth

Professional and educational information, such as:

  • job title or position
  • employer and address
  • medical specialty
  • professional qualifications and experience
  • medical license
  • training
  • publications
  • awards
  • affiliations
  • other information included in your CV

Commercial and financial information, such as:

  • request documentation
  • financial transaction history
  • credit card number, expiration date, and CVV*
  • financial account number*

Interaction data, such as:

  • your participation in our training sessions
  • details of our meetings/calls
  • details of our agreements with you

Anonymized / Deidentified Data

Anonymized Data/De-identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.**

What types of data may we process?

  • you directly
  • institution conducting the clinical trial
  • principal investigator
  • contract research organization (the CRO)
  • our business partners or other third parties
  • your employer or principal

What types of data may we process?

  • to assess your suitability to participate in conducting trials
  • to communicate with you
  • to manage the conduct of the trial and your role
  • to carry out other trial activities as required or permitted by laws, regulations and/or guidelines governing clinical trials
  • to communicate with regulatory bodies and prepare and submit regulatory filings
  • to publicly disclose payments or benefits in kind made to you in connection with the trial and/or our agreement with you, in accordance with applicable law and pharmaceutical industry codes
  • to comply with requests from regulators, courts, law enforcement authorities, government investigators, or in connection with litigation

What types of data may we process?

  • for the purposes of our legitimate interests
  • to comply with a legal obligation
  • in preparation for or to perform a contract
  • for the purposes of public health interests
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law***

What types of data may we process?

  • Recursion and our parents, affiliates, subsidiaries, and related companies
  • clinical trial sponsors, CROs, and their agents, and affiliates and collaborators
  • professional advisors, such as lawyers, insurers and auditors
  • partners that assist us (e.g., data storage and archiving software service providers, logistics and transport service providers, quality assurance and pharmacovigilance software providers), including helping  us improve our marketing or administration****

Clinical Study Candidates

|
|

We may process your Personal Data when you have been identified as a potential candidate for clinical studies sponsored by us or conducted by us on behalf of a third party.

What types of data may we process?

Identity and contact information, such as:

  • first and last name
  • email address
  • postal address
  • phone number

Other personal information, such as:

  • age
  • gender
  • marital status
  • disability
  • ethnicity*
  • date of birth
  • written signature on a patient consent form or program enrolment form

Information regarding your treatment, such as:

  • identification of pathologies/diseases*
  • areas of interest in medical research*
  • treatment dates*
  • medical history and treatment information*
  • user activity
  • therapy completion and use details*
  • drug allergies*
  • prescriptions and dosing*
  • health values and sensor readings data, such as steps taken, blood glucose levels, heart rate, and blood pressure*

Anonymized / Deidentified Data

Anonymized Data/De-identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.**

What types of data may we process?

  • you directly
  • your healthcare provider
  • your devices
  • third parties
  • your friends or family
  • those authorized to provide on your behalf such as your caregiver or authorized representative

What types of data may we process?

  • to communicate with you
  • to administer our relationship with you
  • to send you updates
  • to identify and authenticate you
  • to detect security incidents
  • to protect against malicious or illegal activity
  • for short-term, transient use
  • for administrative purposes
  • for marketing, internal research, and development
  • for quality assurance

What types of data may we process?

  • for the purposes of our legitimate interests
  • in preparation for or to perform a contract with you
  • for the purposes of public health interests
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law.***

What types of data may we process?

  • Recursion and our parents, affiliates, subsidiaries, and related companies
  • professional advisors, such as lawyers, insurers and auditors
  • healthcare providers
  • clinical investigators and/or members of investigator team
  • partners that assist us, including in helping us optimize administration of  the clinical trial.****

Candidates for Employment or Apprenticeship

|
|

We may process your Personal Data when you apply or are a candidate for employment or apprenticeship at Recursion.

What types of data may we process?

Identity and contact information, such as:

  • first and last name
  • company/employer
  • email address
  • postal address
  • phone number

Other personal information, such as:

  • age
  • gender
  • marital status
  • disability
  • social security number*
  • date of birth

Professional and educational information, such as:

  • job title or position
  • employer
  • work skills
  • employment history
  • degrees
  • certifications
  • specialized training
  • responses to surveys and questionnaires
  • other information included in your resume.

Anonymized / Deidentified Data

Anonymized Data / De-identified Data is data for which your individual personal characteristics have been removed such that you are not identified and the information is no longer considered Personal Data under data protection laws.**

What types of data may we process?

  • you directly
  • your devices
  • your employer
  • our business partners and other third parties

What types of data may we process?

  • to communicate with you
  • to identify and authenticate you
  • to detect security incidents
  • to protect against malicious or illegal activity
  • for short-term, transient use
  • for administrative purposes
  • for marketing, internal research, and development
  • to comply with legal and regulatory obligations

What types of data may we process?

  • for the purposes of our legitimate interests
  • to comply with a legal obligation
  • in preparation for or to perform a contract
  • in circumstances where we have requested and received consent and for other purposes that may be required or allowed by law***

What types of data may we process?

  • Recursion and our parents, affiliates, subsidiaries, and related companies
  • professional advisors, such as lawyers, insurers and auditors
  • partners that assist us, including in helping us improve our marketing or administration****

**We will not attempt to re-identify you or anyone else from this Anonymized Data / De-identified Data, and if we disclose it to third parties, we will require that they commit to not attempting to re-identify you or anyone else from the Anonymized / De-identified Data. Anonymized Data / De-identified Data includes health information resulting from the removal of identifiers from protected health information required under the Health Insurance Portability and Accountability Act, 45 CFR § 164.514(b)(2). Please note that in the course of research, study doctors and authorized personnel may still have access to named subject records collected for such research.

***The legal bases relied upon by Recursion include those enumerated in Articles 6 and 9 of the GDPR, depending on the type of Personal Data.

****In limited circumstances, recipients may include: (1) in the event of a sale, assignment, or transfer, the buyer, assignee, or transferee; and (2) government or regulatory officials, law enforcement, courts, public authorities, or others when permitted by this Notice or required by law.

Combination of Data

We may combine information we collect, whether Personal Data or not, with Personal Data that we may obtain from third parties

Children’s Data

Recursion does not knowingly collect, maintain, disclose, or otherwise process Personal Data from minors below the age of 16 without the permission of such minor’s parents or legal guardians.

Marketing Uses, Cookies, and Other Activities

To the extent permitted by applicable law, including in accordance with your consent where required by applicable law, we may engage in the following activities:

  • We may use your contact details to contact you to determine whether you would like to initiate a business relationship with us or to send you marketing emails. If you do not wish to receive such marketing emails, you may opt out by declining to receive such emails when registering or in our subsequent communications by following opt-out instructions included in the email or at other information collection points on the Website.
  • We may display advertisements to you regarding the Website or other of our products and services that we believe are relevant to you based on your activities on the Website or on other web or digital properties. Such advertisements may be shown on our Website or the website of others. We achieve this by using, and allowing third parties (e.g., Facebook, LinkedIn) to use certain cookies, eTags, pixels, web beacons, and other tracking technologies to track your activities on our Website.
  • We may make customer offers to you based on your activities across different websites, including activities on other web or digital properties or your other interactions with Recursion that are not via the Website.
  • We also perform statistical analyses of the users of our Website to improve the functionality, content, design, and navigation of the Website.

Processing Using Website Tracking

We may use different service providers to help us understand how users engage with this and other of our Website. These service providers may track your activity on our Website (i.e., the pages you have seen and the links you have clicked on) and helps us measure how you interact with the content that we provide. This information is used to compile reports and to help us improve the Website. The reports we receive disclose website trends without identifying individual visitors.

Do-Not-Track Signals

Certain web browsers and other programs may transmit “opt-out” signals, also called a Global Privacy Control (or GPC) signal (we refer to these as “GPC Signals”), to websites with which the browser communicates. In most cases you will need to change your web browser’s settings or add an application to your web browser to enable your browser to send a GPC Signal. Recursion’s Website will recognize and apply the GPC Signal to inactivate targeting cookies, but will not apply the GPC Signal to functional, performance or strictly necessary cookies.

Third-Party Service Providers

Third-party service providers acting on our behalf must execute agreements including confidentiality requirements and will only process Personal Data as necessary to perform their functions in a manner consistent with this Notice, other applicable privacy policies, and as explicitly permitted or required by applicable laws, rules, and regulations. Our third-party service providers may be located in the United States and other jurisdictions.

Safeguarding Information

Consistent with applicable laws and requirements, Recursion has put in place physical, technical, and administrative safeguards to protect Personal Data from loss, misuse, alteration, theft, unauthorized access, and unauthorized disclosure consistent with legal obligations and industry practices. However, as is the case with all websites, applications, products, and services, we unfortunately are not able to guarantee security for data collected through our Website.

Your Rights Regarding Your Personal Data

Please note that in many circumstances, we cannot effectively do business with you without processing some Personal Data about you (e.g., your contact information).

Under your jurisdiction’s data protection law, you may have one or more of the following rights with respect to some or all of your Personal Data:

  • To request that we confirm whether we process Personal Data about you and that we provide full details of the Personal Data we hold about you;
  • To request that we provide a copy or representative summary of your Personal Data;
  • To request that we correct your Personal Data;
  • To request that we delete your Personal Data;
  • To request that we stop processing your Personal Data;
  • To request that we limit the processing of your Personal Data;
  • To opt out of the sale or sharing of your Personal Data;
  • To withdraw consent to our processing of your Personal Data, where such processing is based on consent;
  • To appeal the denial of a request; and
  • To lodge a complaint with the data protection authority in your jurisdiction.

To learn if you have the other above rights in the jurisdiction in which you live and to exercise any of these rights with respect to your Personal Data, please contact us at the email or phone number provided below. We will not discriminate against you for exercising any of the rights described above, although we may not be able to continue to provide you products and services and it may otherwise affect the way we are able to interact with you.

We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. We may, after receiving your request, require additional information from you to honor your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.

In the event you wish to make a complaint about how we process your Personal Data, please contact us at the email address below and we will handle your request as soon as possible. Even if you make a complaint to us, you may always lodge a complaint with the relevant authority in your location.

Notice of Right to Opt Out of Sale/Sharing

Certain of Recursion’s practices may be considered the sale or sharing of Personal Data under applicable law. You may have the right to opt-out of the sale of Personal Data or opt-out of sharing of Personal Data for purposes of cross-context behavioral advertising (sometimes referred to as targeted advertising). To exercise these rights, please see the “Your Rights Regarding Your Personal Data” section above.

Automated Individual Decision-Making

If you are a clinical study candidate in a trial we sponsor, you will be assigned a unique patient identification number. This number may be used as part of an automatic process that randomly determines if you will receive the experimental drug product or treatment that is being evaluated in the trial. This type of automated decision-making is required in order to ensure that the trial is conducted in an ethical way, and in accordance with the pharmaceutical industry’s standards. For decisions that may seriously impact you, you have the “right not to be subject to automatic decision-making, including profiling.” But in those cases, we will always explain to you when we might do this, why it is happening, and the potential effect on you.

Transfer of Personal Data Across National Borders

Recursion operates in several countries, including the U.S. We, together with our affiliates, service providers and other third parties with whom we share Personal Data, operate globally. Please be aware that Personal Data we collect and process may be transferred and maintained outside your state, province, country, or other jurisdiction where the privacy laws may not be as protective as those in your location, including the United States. Recursion has put in place lawful transfer mechanisms and adequate safeguards, in accordance with applicable legal requirements, to protect your Personal Data. For example, if you are located in the European Economic Area (“EEA”), these transfer mechanisms include adequacy decisions and standard contractual clauses.

Adequacy Decisions: Some non-EEA countries are recognized by the European Commission as providing an adequate level of data protection under Article 45 GDPR (or equivalent decisions under other laws). We transfer your Personal Information as described under the heading ‘Categories of Personal Information and How We Collect It’ to certain jurisdictions that benefit from adequacy decisions, such as Canada. A list of jurisdictions for which the European Commission has issued an adequacy decision is available here.  

Standard contractual clauses: For transfers from to countries not considered adequate by the European Commission, we have put in place adequate measures such as Standard Contractual Clauses to protect your Personal Information. The European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the EEA to transfer data outside the EEA. These (and their approved equivalent for the UK and Switzerland) are called standard contractual clauses. We rely on standard contractual clauses to transfer Personal Information to certain affiliates and business partners in countries without an adequacy decision.

In certain situations, we rely on derogations provided for under the applicable law to transfer Personal Information to a third country.

How Long Your Personal Data Will Be Retained

We generally retain Personal Data no longer than needed for the specific business purpose or purposes for which it was collected. In some cases, we may be required to retain Personal Data for a longer period of time by law or for other necessary business purposes.

Changes to This Privacy Notice

We reserve the right to change this Notice from time to time. We will alert you when changes have been made by indicating the date this Notice was last updated as the date the Notice became effective or as otherwise may be required by law. It is recommended that you periodically revisit this Notice to learn of any changes.

Contact Us.

If you have any questions or comments about this Notice or feel that we are not abiding by the terms of this Notice, please contact us in any of the following ways:

By e-mail: compliance@recursionpharma.com

By phone: 385-269-0203

By postal mail or courier:

Recursion Corporation

Attn: Compliance Department

41 S. Rio Grande Street

Salt Lake City, Utah 84101

European Union Representative. In the European Union, you can contact our representative VeraSafe using this contact form, https://www.verasafe.com/privacy-services/contact-article-27-representative/, or alternatively via mail or telephone at:

VeraSafe Ireland Ltd.
Unit 3D North Point House
North Point Business Park
New Mallow Road
Cork T23AT2P
Ireland

+420 228 881 031

United Kingdom Representative. In the United Kingdom, you can contact our representative VeraSafe using this contact form, https://www.verasafe.com/privacy-services/contact-article-27-representative/, or alternatively via mail or telephone at:

VeraSafe United Kingdom Ltd.
37 Albert Embankment
London
SE1 7TL
United Kingdom

+44 (20) 4532 2003

Data Protection Officer. We have appointed VeraSafe as our Data Protection Officer (DPO). While you may contact us directly, VeraSafe can also be contacted on matters related to the processing of Personal Data. VeraSafe’s contact details are:

VeraSafe LLC
100 M Street S.E., Suite 600
Washington, D.C. 20003 USA
Email: experts@verasafe.com
Web: https://www.verasafe.com/about-verasafe/contact-us/