Thanks, Elaine, for the fast and very thorough reply! I appreciate it and will pass it on to our security folks. Thanks, Brian From: Elaine Meng <meng@cgl.ucsf.edu> Sent: Friday, August 23, 2024 11:41 AM To: Frumolt, Brian <bfrumolt@wsgr.com> Cc: chimerax-users@cgl.ucsf.edu Subject: Re: [chimerax-users] Data handling / privacy policy information? EXT - meng@cgl.ucsf.edu<mailto:meng@cgl.ucsf.edu> Hi Brian, We don't have a document on the website but yes, some of the ChimeraX tools do use web services and this is clearly documented in their individual help pages. There are also a few other situations in which ChimeraX will contact our website, but they can be turned off. In more detail, here is a semitechnical description of what information would be shared if you used the ChimeraX software: =-=-=-= All the files you create are yours and simply reside on your own system. We would have no knowledge of that. When you download the program, we record the IP address of the download. You don't need to be on the internet to actually use the program, but It is definitely more convenient to have internet connectivity, for fetching data from databases (protein data bank, EM data bank, UniProt, etc.) and using any tools that rely on web services (multiple sequence alignment, Modeller comparative modeling, etc.). You would also need internet connectivity to register to get rid of the "registration reminder" that will start popping up after a certain number of uses. Of course we would get any information you choose to share when registering. However, network connectivity is not required to run the program. One can even keep using it without ever registering. I'm told that the only autonomous (non-user-initiated) communications via network are: (1) to check with the ChimeraX toolshed at our own website for the existence of newer versions of ChimeraX and any third-party ChimeraX plugin bundles the user has installed. However, if network is not available it will not do the checks. Also, there is an option in the user preferences dialog to make the frequency of checking "never." <https://rbvi.ucsf.edu/chimerax/docs/user/preferences.html<https://rbvi.ucsf.edu/chimerax/docs/user/preferences.html>> <https://rbvi.ucsf.edu/chimerax/docs/user/preferences.html#toolshed<https://rbvi.ucsf.edu/chimerax/docs/user/preferences.html#toolshed>> (2) to look up the connectivity (bonding pattern) of any nonstandard residues encountered when opening an mmCIF file. However, if network is not available the connectivity will be guessed. A little more detail on using web services: if the user runs ChimeraX tools that depend on web services, that will send any data needed for that calculation over the network, e.g. the sequences will be sent to the web server running the multiple sequence alignment program. One of the services (AlphaFold Predict) will send data to Google Colab, and using it requires that user to sign in to Google first. Here is a list of web services potentially used by ChimeraX, depending on what tools/features are invoked by the user: <https://rbvi.ucsf.edu/chimerax/docs/webservices.html<https://rbvi.ucsf.edu/chimerax/docs/webservices.html>> =-=-=-= I hope this clarifies the situation. If you do want to pursue a commercial license, please see this page for information and a link to a webform to fill out. <https://www.rbvi.ucsf.edu/chimera/commercial_license.html<https://www.rbvi.ucsf.edu/chimera/commercial_license.html>> Thanks for your interest, Elaine ----- Elaine C. Meng, Ph.D. UCSF Chimera(X) team Resource for Biocomputing, Visualization, and Informatics Department of Pharmaceutical Chemistry University of California, San Francisco
On Aug 23, 2024, at 7:23 AM, Frumolt, Brian via ChimeraX-users <chimerax-users@cgl.ucsf.edu<mailto:chimerax-users@cgl.ucsf.edu>> wrote:
Hi, We are looking at ChimeraX for commercial use. I was looking on the site for information related to data use and privacy policies. I understand the app runs locally, but was wondering whether it leverages any web services, or passes any data outside the local installation? We have strict data handling policies in place for our clients, so would need to be aware. If there is a policy document I missed, that would be ideal.
Thanks! Brian
This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.