Privacy Policy

goosefl.com · Effective date: 25 September 2026 · Version 1.1

1. Introduction

This Privacy Policy explains how Equitable Labs, Inc., doing business as Goose FL ("Goose FL", "we", "us"), collects, uses, discloses, and protects personal information when you visit goosefl.com (the "Site") and interact with it.

Goose FL is a Delaware Public Benefit Corporation committed to advancing equitable access to the benefits of artificial intelligence. We build shared compliance infrastructure, privacy-preserving federated intelligence that lets institutions learn together while raw data never leaves the institution.

Scope. This policy covers the personal data we process as a controller through the Site: form submissions, correspondence, the document-access cookie, and standard server logs. It does not describe the processing our clients perform on their own customer data using our infrastructure. In those deployments our client is the controller and Goose FL acts as a processor acting only on the client's documented instructions; that relationship is governed by the client agreement and its Data Processing Addendum.

2. Data controller and contact information

The controller is:

Equitable Labs, Inc., doing business as Goose FL
A Delaware Public Benefit Corporation
W310S2614 Cregennan Bae, Wales, WI 53183
United States
Email: contact@goosefl.com

EU/UK queries. If you are in the European Economic Area or the United Kingdom, you may contact our EU/UK representative: Paul Crafer, Chief Product Officer, Stockholm, Sweden, paul.c@goosefl.com.

Nigeria queries. If you are in Nigeria, you may contact us at the address above and may also escalate to the Nigeria Data Protection Commission (section 19).

Data Protection Officer. Our current scale and processing do not require the appointment of a Data Protection Officer. Privacy questions are handled directly by company leadership at the contact address above.

3. What personal data we collect

3.1 Information you provide directly

• Form submissions. When you complete a form on the Site (for example, "Start a Conversation" or the document access forms), we receive the fields you fill in: typically your name, work email address, company or institution, sector, and the content of your message.
• Correspondence. If you contact us by email or other channels, we keep a record of that correspondence, including any personal information you choose to include.
• Document access. To unlock certain documents (the KYComm white paper and the Oncology HealthFL presentation) we ask for your name, work email, and organization. Your answers are recorded so we can respond to follow-up enquiries and understand interest in our materials.

3.2 Information collected automatically

• Server logs. Our hosting provider records standard technical request data for every visit: IP address, browser and operating system type, referring page, and the pages and files requested. This is ordinary connection data, used for security and troubleshooting.
• Fonts. The Site loads typefaces from Google Fonts. When your browser fetches a font, Google receives your IP address and standard request headers under Google's own terms. We do not send Google any information about you beyond that technical request.
• Embedded videos. Some pages embed YouTube videos. When a video loads, YouTube/Google may set its own cookies and collect your IP address under Google's policies. If you do not play the video, the embedded player does not set these cookies.
• Google Analytics 4. We measure site usage with Google Analytics 4 (GA4), a service operated by Google LLC. GA4 records pages viewed, the referring page, a coarse geographic region derived from your IP address, and device and browser type. Standard GA4 does not log or store your IP address in Google's systems. GA4 is used only to understand aggregate site usage: the data is not used for advertising, is not sold, and is not used to profile you. GA4 sets its cookies only after you accept analytics cookies in the banner (sections 9 and 10).

3.3 What we do NOT collect

• Analytics is aggregate and optional. Our only measurement is Google Analytics 4 for aggregate site usage (section 3.2). Its cookies are set only after you accept them in the cookie banner, and the measurement contains no advertising identifiers.
• No advertising or cross-site tracking. No advertising pixels, no data brokers, no sale or sharing of personal information as those terms are defined by US state privacy laws.
• No profiling. We build no profiles of visitors and make no automated decisions about you (section 6).
• Assessment answers. The FL Readiness Assessment runs entirely in your browser. Your answers and results never leave your device and are not transmitted to us.
• Special category data. We do not ask for and do not intend to collect special category personal data (health, biometric, racial or ethnic origin, religion, political opinions, sexual orientation, and similar) through the Site. Please do not volunteer such information in forms or messages.

4. How we collect your personal data

• Direct interactions. You provide data when you fill in forms, request documents, or correspond with us.
• Automatic technologies. Server logs and standard browser connections, and (with your consent) Google Analytics 4 (section 3.2).
• We do not acquire personal data from third parties for marketing or enrichment purposes, and we do not purchase contact lists.

5. How we use your personal data and our legal bases

Purpose	Data used	Legal basis (GDPR Art. 6)
Respond to your enquiries and take steps toward a possible engagement with you	Identity and contact data; message content	Steps at your request prior to entering a contract (Art. 6(1)(b)); legitimate interests in managing our business relationships (Art. 6(1)(f))
Provide gated documents you request and follow up on them	Name, work email, organization	Consent (Art. 6(1)(a)), you choose to submit the access form; you may withdraw it at any time
Operate, secure, and troubleshoot the Site	Server logs (IP address, technical data)	Legitimate interests in network and information security (Art. 6(1)(f))
Measure aggregate site usage so we can see which content is useful and keep the structure of the Site useful	GA4 analytics events (pages viewed, referring page, device/browser type, coarse region); no name, email, or other direct identifiers	Consent (Art. 6(1)(a)), given through the cookie banner; you may withdraw it at any time through the banner or your browser
Comply with legal obligations (e.g., tax, regulatory, defense of legal claims)	As required by the obligation	Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f))

Marketing. We do not send marketing email and maintain no marketing database. If that changes, we will seek consent where required and update this policy.

Legitimate interests. Where we rely on legitimate interests, those interests are: responding to organisations that approach us, keeping the Site secure, and operating our business. We have weighed these interests against your rights and freedoms and consider them proportionate given the minimal, business-context data involved.

6. AI, automated decision-making, and human oversight

This website. We do not use artificial intelligence, algorithmic decision-making, or profiling to evaluate visitors or process personal data collected through the Site. No decision with legal or similarly significant effect for you is made solely by automated means. Because there is no automated decision-making on this Site, no human-in-the-loop or human-on-the-loop review step applies to website data.

Our infrastructure (separate service). Goose FL's federated learning products are used by client institutions, such as banks and hospitals, to train models on data that remains within each institution's own environment. In every such deployment the client institution is the controller of that data and decides the purposes and means of processing; Goose FL processes only on the client's documented instructions. Decisions that affect individuals (for example, fraud referrals or clinical support) are made by the client institution under its own policies, not by Goose FL. Those deployments are described in the client agreement, the Data Processing Addendum, and supporting documentation we provide to clients.

If you have questions about how a client institution uses our infrastructure, please raise them with that institution in the first instance; we will support them and you as required by our agreements and applicable law.

7. Privacy by design and privacy-enhancing technologies

Data protection by design and by default (GDPR Art. 25) is the foundation of what we build, and it also shapes this website:

• Minimal collection. The Site collects no advertising and no behavioral-profiling data. The only measurement is aggregate usage analytics, which runs only after consent where required. We ask only for what a specific purpose requires.
• On-device processing. The readiness assessment computes all results locally in your browser; nothing is transmitted.
• Local-only state. Our first-party cookies store only your cookie-banner choice and a document-access confirmation (section 10); analytics cookies are set only with your consent.

In our infrastructure service, privacy-enhancing technologies are applied to high-sensitivity processing as a matter of policy: federated learning (raw data never leaves the participating institution), secure aggregation (no participant, including us, can inspect another participant's contribution), differential privacy (formal privacy budgets applied to model updates where deployed), and personalization (each institution receives a model improved by the federation without any exchange of raw records). These technical safeguards are the mechanism by which the federated processing we enable for clients is designed to satisfy data-minimization, storage-limitation, and integrity-and-confidentiality requirements across jurisdictions.

8. How we share your personal data

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined by US state privacy laws. We disclose personal data only to:

• Service providers (processors). Companies that host the Site and handle email on our behalf, under contract, on our instructions, and only for the purposes described in this policy. Current providers: Netlify, Inc. (website hosting, including server logs) and Google LLC (Workspace, which delivers our goosefl.com email).
• Embedded third parties. Google (Analytics under sections 3.2 and 10, fonts, and YouTube) and Pexels (stock images on the white paper page); those interactions happen through your browser and are governed by each company's own policies.
• Legal and safety disclosures. Where required by law, court order, or regulation, or where necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Goose FL, our clients, or others.
• Business transfer. In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity, subject to this policy or notice to you where required by law.

Any third party processing personal data on our instructions does so under contract, with confidentiality obligations, and may not use it for its own purposes.

9. International transfers of personal data

We are based in the United States, with team members in the United States and Sweden. When you use the Site from the EEA, the UK, Nigeria, or elsewhere, your personal data will be processed in the United States and, for support purposes, may be accessed from other countries where our team works.

• EEA/UK to US transfers. Where personal data is transferred out of the EEA or UK, we rely on an adequacy framework where the recipient is certified under the EU–US Data Privacy Framework, and on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) otherwise. Our current providers, Google LLC and Netlify, Inc., are each certified under the EU–US Data Privacy Framework, including its UK and Swiss extensions. You may request a copy of the relevant safeguards at contact@goosefl.com.
• Transfers from Nigeria. Transfers of personal data out of Nigeria under the Nigeria Data Protection Act are made only where the recipient is subject to appropriate safeguards or a lawful basis for the transfer applies, consistent with NDPA requirements. You may request details of the safeguards applied to your data at the contact address above.

10. Cookies

The Site uses two categories of cookies:

Name	Type	Purpose	Duration
gf_consent	Strictly necessary	Stores your cookie-banner choice so you are not asked again on every visit	12 months
gf_doc_access	Strictly necessary / functional	Records that you have completed the document access form, so that gated documents (white paper, HealthFL presentation) open directly on later visits instead of asking you again	12 months
_ga and _ga_QXM7EEVS8J (set by Google Analytics 4)	Analytics — set only after you accept analytics cookies in the banner	Distinguishes visitors and sessions so GA4 can count page views and returning visits. These cookies contain a random identifier, not your identity.	Up to 2 years

The two first-party cookies are strictly necessary to provide features the Site offers (remembering your consent choice and your document access). They contain no advertising identifiers and are not used for tracking or profiling. The GA4 cookies are set only if you accept analytics cookies in the banner; if you decline, GA4 does not load and none of its cookies are set. You can change your choice at any time by deleting cookies in your browser settings, which makes the banner appear again on your next visit.

You can block or delete cookies through your browser settings at any time; the Site remains fully usable. When played, embedded YouTube videos may set their own cookies under Google's policies (section 3.2). We do not respond to Do Not Track signals; analytics here is governed by the banner choice instead.

11. Data security

We use technical and organizational measures appropriate to the risk: encrypted connections (HTTPS with HSTS), hosting with professional security practices, least-privilege access to our systems and mailbox, minimal collection, and a small, reviewed set of third-party scripts (fonts, consent-gated analytics, and embedded media). Access to correspondence is limited to team members who need it for their work, under confidentiality obligations.

No system is perfectly secure. We maintain procedures for responding to suspected personal data breaches and will notify the competent supervisory authority and affected individuals within the timelines required by applicable law (including, for EU processing, without undue delay and where feasible within 72 hours of becoming aware of a breach).

12. Data retention

We keep personal data only as long as necessary for the purpose collected and any legal, accounting, or claim-related requirements:

• Enquiries and correspondence: retained for up to 24 months after our last contact with you, then deleted or anonymized, unless a contract, dispute, or legal requirement calls for longer retention.
• Server logs: retained by our hosting provider for a short security window (typically 30 days or less), then automatically deleted.
• GA4 analytics events: retained by Google for 14 months, then automatically deleted. GA4 cookies persist in your browser for up to 2 years, or until you clear them.
• Document access cookie: 12 months, or until you clear it.
• Assessment answers: never retained by us, they never leave your device.

When determining retention we consider the sensitivity of the data, the risk of harm from unauthorized disclosure, the purposes of processing, and what we can achieve through other means.

13. Your rights

Subject to applicable law, you have the following rights over your personal data:

• Access, obtain confirmation that we process your data and a copy of it, with the information listed in Art. 15 GDPR.
• Rectification, correct inaccurate or incomplete data.
• Erasure, request deletion where no overriding legal basis requires retention.
• Restriction, request that we pause processing in the circumstances set out in Art. 18 GDPR.
• Portability, receive data you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another controller.
• Objection, object to processing based on legitimate interests, and object at any time to any processing for direct marketing (we currently send none).
• Withdraw consent, where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• No solely automated decisions, we make no decisions about you based solely on automated processing (section 6); if that ever changes, you would have the rights in Art. 22 GDPR.

To exercise any right, email contact@goosefl.com. We may ask for information to verify your identity before responding, a safeguard against disclosure to the wrong person. We respond within one month of a verified request, extending only where legally permitted and with notice to you. We do not discriminate against you for exercising any right.

14. Additional information for United States residents

US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA, and similar laws in Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Rhode Island, Indiana, Iowa, Nebraska, and others as they take effect) grant consumers rights regarding their personal information. This section describes our practices under those laws.

• Collection. In the preceding 12 months we have collected: identifiers (name, email address, IP address); professional information (employer/organization, sector); and internet activity (standard server logs of pages requested and, where accepted, aggregate analytics events through Google Analytics 4). We do not collect sensitive personal information and do not knowingly collect personal information from children.
• Purposes. Responding to enquiries, providing requested documents, securing and operating the Site, and complying with law (section 5).
• No sale or sharing. We do not sell personal information for money and do not share it for cross-context behavioral advertising, so no "Do Not Sell or Share My Personal Information" opt-out is required or offered.
• Retention. Section 12.
• Your rights. To know/access, delete, and correct personal information; to opt out of sale or sharing (not applicable, we engage in neither); and to receive equal service regardless of the exercise of rights. You may designate an authorized agent to submit a request on your behalf with written permission or a power of attorney; we may still verify your identity directly.
• Verification. We verify requests by matching details you provide against the correspondence we hold. If we cannot verify you, we will explain what is needed.
• Response time and appeal. We respond within the statutory window (generally 45 days, extendable once). Where your state's law provides an appeal right for denied requests, you may appeal by replying to our response with the subject "Appeal," and we will review and respond within the statutory period. You may also complain to your state Attorney General.

Financial-institution customers should note that privacy obligations for their own customer data under US federal law (such as the Gramm-Leach-Bliley Act) rest with the institution as controller; our role in those deployments is that of a service provider/processor under contract.

15. Additional information for Nigeria residents and other African jurisdictions

Where we engage with organisations and individuals in Nigeria, we apply the Nigeria Data Protection Act 2023 (NDPA) and its regulations, alongside this policy.

• Lawful bases. As listed in section 5 (consent, contract steps, legitimate interests, legal obligation), which correspond to the NDPA's lawful processing grounds.
• Your rights under the NDPA. Access to your personal data; rectification; erasure; objection to processing; the right to withdraw consent; and the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
• Children. We do not knowingly collect personal data from anyone under 18 (the age at which the NDPA requires parental consent). If we learn we have collected such data without the required consent, we will delete it.
• Cross-border transfers. See section 9. We apply appropriate safeguards for transfers of data originating in Nigeria and will provide details on request.
• Registration. Where our scale of processing in Nigeria requires registration as a data controller of major importance, we will register with the NDPC and state so here.

For other African jurisdictions in which we may operate (for example Kenya, Rwanda, or South Africa), we apply the local data protection law's corresponding rights and will honor the strongest right available to you under your local law.

16. Children

The Site is a business website directed at institutions and professionals. It is not directed at children, and we do not knowingly collect personal information from children. In the EEA/UK we treat anyone under 16 (or the lower age set by their member state, not below 13) as a child for consent purposes; in Nigeria the threshold is 18; in the US it is 13 (COPPA). If you believe a child has provided us personal information, contact us and we will delete it.

17. Third-party websites and embeds

The Site links to third-party websites (for example, publication pages and LinkedIn), embeds YouTube videos, and (on the white paper page) loads stock images from Pexels. Those are governed by the third party's own policies, and we encourage you to review them. We are not responsible for the privacy practices of third-party sites.

18. Changes to this policy

We may update this policy to reflect changes in our practices, the Site, or legal requirements. The effective date above will change, and material changes will be highlighted at the top of the policy. The version history is in the document control block below.

19. Complaints and supervisory authorities

Please raise concerns with us first, we will investigate and respond. You also have the right to complain to a supervisory authority:

• EEA: the data protection authority of your country of residence or work, or of the place of the alleged infringement. A directory is maintained by the European Data Protection Board.
• UK: the Information Commissioner's Office (ico.org.uk).
• Nigeria: the Nigeria Data Protection Commission (ndpc.gov.ng).
• United States: your state Attorney General, or the Federal Trade Commission.

20. Contacting us

Equitable Labs, Inc. (dba Goose FL)
W310S2614 Cregennan Bae, Wales, WI 53183, United States
Email: contact@goosefl.com

For rights requests, please use the subject line "Privacy Request" so we can route your message promptly.