Privacy policy

Who is responsible for your information

The controller of personal information collected through this website is TailorPath Ltd, an Israeli company (company number 517109104), of 70 Bnei Binyamin Street, Netanya 4202008, Israel. You can contact us about privacy at daniela@tailor-path.com or yochai@tailor-path.com.

What we collect

We collect only what you choose to send us:

Demo requests: your name, work email, organisation and role.
Investor deck requests: your name, firm, email and, if you add one, a short note of up to 500 characters.
Emails you send us: the content of your message and your contact details.

Providing this information is voluntary and you are under no legal obligation to provide it, but without it we can't reply to your request.

Please don't include patient or health information in any form or message. The website is not designed to receive it, and we delete such information if it reaches us.

When you visit the website, our hosting provider processes technical data such as your IP address and browser type to deliver pages and protect the service. To limit abuse of the forms, we keep a salted, one-way hash of the sending IP address for a short time; we do not store the IP address itself.

The website uses no analytics, no advertising tools and no non-essential cookies.

The chat assistant

The website has an AI chat assistant that answers questions about TailorPath using this website's public pages. It is an automated assistant, not a person, and it does not give medical or therapy advice. Please don't type personal, patient or health information into it.

We run the assistant ourselves, on our own Amazon Web Services account in the European Union:

Messages containing an email address or a phone number get a fixed reply and are discarded before they reach the AI model; they are not stored or logged. Other text, including any health details you type, is not filtered: it is processed only to answer you and is never stored. Please leave such details out. For questions about a specific person, email us instead.
What you type is sent to our chat service in Stockholm, Sweden. Answers are generated by Anthropic's Claude model on Amazon Bedrock, processed in EU regions only. To find the relevant pages, your question is turned into a search query by an Amazon model in Stockholm. Amazon Bedrock does not store the messages or use them to train models.
Conversations are not stored or logged. Our service logs only counts and errors, never what you typed and never your IP address, and deletes them after 14 days. To limit abuse, requests from each IP address are counted in memory only.
To tell people from automated bots, the chat window uses the AWS WAF bot check, which processes technical signals from your browser and your IP address. Requests are limited per IP address; the firewall counts them in memory only and keeps no logs.
The assistant stores nothing in your browser on tailor-path.com. The bot check keeps a strictly necessary security token in a cookie (aws-waf-token, which expires after 30 minutes) and in the browser's local storage on chat.tailor-path.com. It holds only the token, never what you type. The conversation is gone when you close the chat.

The assistant software was built for us by MLAIA Data Science (Ultrabot). It runs only on our account, and MLAIA receives no chat data.

Before you can send a message, the chat asks for your agreement. Our legal basis for answering your questions is our legitimate interest in responding to visitors. If you nevertheless include health information, we process it only on the basis of your explicit consent, given when you click “I agree” (GDPR Article 9(2)(a)), only to answer that question, and never store it. Your consent lasts only while the chat is open; you can withdraw it at any time by closing the chat. If you prefer not to use the assistant, email us instead.

Why we use it and on what legal basis

To reply to your request, arrange a demo or send the investor deck. Under the GDPR, the basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to business enquiries.
To keep the website and forms secure. The basis is our legitimate interest in protecting the service.

We do not use your information for automated decision-making or profiling, and we do not send marketing without your consent.

How long we keep it

Form records are deleted automatically after 180 days. The email notification sent to our team is kept in our Microsoft 365 mailbox under our email retention policy. If we start working together, we keep the contact details we need for that relationship for as long as it lasts. Abuse-prevention hashes expire within hours.

Who processes it for us

We use a small number of service providers, each bound by a data processing agreement:

Google (Firebase and Google Cloud): Firebase Hosting serves the website files from its global content delivery network; the form service and the form database run in the European Union (Cloud Functions in europe-west1 and an EU Firestore location).
Microsoft (Microsoft 365): email, used to deliver your request to our team and to reply to you.
Amazon Web Services: runs the chat assistant and its bot check in the European Union, including Amazon Bedrock with Anthropic's Claude model.

We do not sell, rent or share your personal information with anyone else, except where the law requires it.

International transfers

Our team is based in Israel, which the European Commission recognises as providing an adequate level of data protection. Where a service provider processes data outside the European Economic Area or Israel, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Your rights (Israel)

Under the Israeli Protection of Privacy Law, 5741-1981, as amended including by Amendment 13, you can ask to review the information we hold about you and to have it corrected or deleted. You can also contact the Privacy Protection Authority.

Notice for United States residents

In the last 12 months we have collected identifiers (name, email address) and professional information (organisation, firm, role) from the forms on this website, for the purposes described above. We do not sell or share personal information, as those terms are defined in US state privacy laws such as the California Consumer Privacy Act, and we do not use or disclose sensitive personal information except to answer you in the chat assistant, as described below. Depending on where you live, you can ask to know, correct or delete the personal information we hold about you, and we will not discriminate against you for doing so.

If you type health information into the chat assistant despite our request not to, it is sensitive personal information. We use it only to answer your question, with your consent, and we never store, sell or share it.

Children

This website is meant for professionals and organisations. It is not directed at children, and we do not knowingly collect information from them.

Security

The website is static and served over encrypted connections with strict security headers. Form data is stored in a database that the public cannot access, and only our team receives it.

Changes to this policy

We will post any changes on this page and update the date at the top.

Contact us

To exercise your rights or ask about this policy, email daniela@tailor-path.com or yochai@tailor-path.com. We may need to confirm your identity before acting on a request.