Article

Biotech and life sciences labs: get paid for your records

By TrustPast

Updated November 7, 2026

This page is for the owner or the operations lead of a biotech company, a contract research lab, an assay developer or a life sciences services firm. You run studies, method development, quality control or contract work for sponsors. You have a quality system because you had to build one, and it has been growing for years.

Most lab owners count their data as the results: the plates, the curves, the final reports. Those are the part a buyer cares least about. What a lab doesn’t usually know it has is the record of how the science got done as a business: the protocol and its amendments, the deviation and its investigation, the change control form, the email thread where the study director and the sponsor argued about a timeline. A buyer pays to license records like these to train AI models.

We set out the general rule in what data buyers want from a trade business. It was written for roofers and plumbers, and it still fits a lab: the buyer wants the reasoning that was captured while the work happened. This page applies it to a lab, with micro1 as the buyer.

The records a biotech lab keeps

These are our examples, not a buyer’s list. A working lab produces them every week, and a lab that has run for ten years has thousands of each.

The protocol and its amendments. A study starts as a protocol: objective, test system, method, acceptance criteria, schedule. Then reality arrives. Amendment one changes the sampling time points because the first animals cleared the compound faster than predicted. Amendment two adds an assay the sponsor asked for in week six. Each amendment has a reason written beside it, and the reasons are the record.

The deviation report and the investigation. Something went off plan: a freezer alarm overnight, a reagent lot out of specification, a step done out of order. The deviation report says what happened. The investigation says why, what was checked and ruled out, and what the root cause was. The corrective action says what changed so it wouldn’t happen again. That is a diagnosis, written step by step, and a lab has a drawer of them.

Change control. A new instrument, a new software version, a revised SOP. Each goes through a form: what is changing, the risk assessment, who signed, the verification that it works. A lab’s change control log is the history of every decision to do something differently.

The SOP set and its revision history. Hundreds of procedures, each at revision seven or twelve. The revision notes say what was wrong with the old one. Often it was a deviation.

The method development file. How an assay went from a paper method to a validated one. The conditions tried, the ones that failed, the precision and accuracy runs, the final parameters. Most of the work is in the failed runs.

The project tracker. For a contract lab, each sponsor engagement is a project: the quote, the statement of work, the timeline, the change orders, the delivery. Our page on project history goes through which parts of a project record show how the work was run, from the plan to the post-mortem.

The email. The quality system holds the signed forms. The email holds the conversation that led to them. The study director writing to the sponsor that the timeline will slip, and why. The QA manager writing to the lab head that a trend in deviations points at one instrument. The procurement thread about a reagent supplier that kept shipping late. Our page on email archives shows where the useful threads in a company inbox tend to sit.

Put together, those records show how a lab actually decides. How a protocol bent without breaking. How a deviation became a root cause and then a changed SOP. How a sponsor’s request became a change order and a new date. That is the how, not the who, and a lab writes more of it down than almost any other kind of company.

See your estimate

What counts, in the buyer’s own words

micro1 publishes who it is looking for. Its data partnerships page says: “We’re looking for established companies with 30+ full-time employees, mature business operations, and substantial historical operational data.” It then names the kinds of records: “This can include internal communications, SOPs, project histories, CRM records, support tickets, and other business documentation.”

A lab’s SOP set and its project history sit right in that sentence. So does the email, under internal communications.

micro1’s pages don’t name biotech or life sciences labs as a category. Its data partnerships page has a heading that reads “Operational data from every industry can contribute”, and its referral page lists “All industries” in the company requirements. So we apply what its pages do say.

On what micro1 is looking for, the page reads: “We are looking for data that reflects how work is actually performed within an organization.” It lists “standard operating procedures (SOPs), process documentation, internal knowledge bases, workflows, templates, operational frameworks, and other business process artifacts.” A lab’s quality system is almost entirely made of those. The deviation form is a template. The change control process is a workflow. The investigation report is process documentation with the reasoning left in.

Two of micro1’s industry examples fit a lab’s back office as well. Under legal and contracts it lists “Policies, contract workflows, review processes, governance documentation, and compliance procedures.” Under operations and logistics, “Operational SOPs, logistics processes, fulfillment workflows, inventory management, and internal operations.” Sample management, cold chain and reagent inventory are operations in that sense.

One limit to note. micro1 says “Data should be primarily in English.” A lab with a site abroad and notebooks in another language should count the English share before applying.

What is never included

Start with the people. Patient names, study subject identifiers, medical record numbers, donor details, health information of any kind and the personal details of your own staff are not what a buyer is paying for. Payment details aren’t either. Our page on what is never included shows where those hide in a company’s files.

micro1 doesn’t publish a list of records it excludes. As our own advice, a lab has three areas to check before anything moves.

Health information. A clinical lab, a biobank or a company running human studies holds records that sit under their own rules. Our page on health, payment and other regulated data shows where that information hides and how it is kept out.

The sponsor’s work. In a contract lab, the study often belongs to the sponsor: the protocol, the data, the report, sometimes the method. The confidentiality clause may cover the email about the study too. Only the contracts say which is which, and anything a client owns stays out. Our page on client-owned work and NDAs lists what to look for in those clauses.

The regulated record itself. Two federal rules shape how a lab keeps its files. The scope section of the FDA’s 21 CFR Part 11, § 11.1, reads: “The regulations in this part set forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.” The good laboratory practice rule in 21 CFR 58.195 says that “documentation records, raw data and specimens pertaining to a nonclinical laboratory study and required to be made by this part shall be retained in the archive(s) for whichever of the following periods is shortest”. One of the periods it lists is “A period of at least 5 years following the date on which the results of the nonclinical laboratory study are submitted to the Food and Drug Administration in support of an application for a research or marketing permit.” Those rules say how records are kept. Whether a licence of copies fits beside them is a question we can’t answer. Ask counsel before any regulated record leaves the archive.

How de-identification works

You don’t redact the files yourself. micro1’s page puts the question as “Does my company need to anonymize its data before transferring it?” and answers: “No, micro1 has processes for de-identifying and transforming sensitive information.”

On its estimate page, micro1 lists four things the two sides confirm before any participation. “U.S. and allied buyers only”: “Your data is licensed exclusively to labs and enterprises based in the U.S. and allied countries.” “Data segregation”: “Your data is kept separate from other companies’ data, with access restricted to authorized personnel.” “De-identified before sharing”: “Personal and identifying information is removed or transformed before your data is shared with third parties.” And “Defined retention periods”: “Raw data is deleted according to an agreed schedule.”

Its contracting step adds “a commitment not to resell or distribute your data until personal and identifying information has been anonymized.” And after data is shared, micro1 says “certain datasets may undergo synthetic rewrites that preserve workflow structure while reducing direct ties to original records.”

For a lab, the useful line is the sample review. micro1 says “companies are given the opportunity to review representative samples before prepared data is used.” That is where your QA manager, who has read more deviation reports than anyone, checks that no sponsor code or subject number survived. Our page on how de-identification works goes through each step.

What decides the price

micro1 publishes its tiers in one block on the data partnerships page, headed “Compensation is based on the quality, uniqueness, and value of the data provided”. The tiers are $100K-500K for “Qualified Enterprise Data Partnerships” (indicative, not an offer). Then $500K-3M for “Large-scale operational datasets or ongoing participation across multiple teams and business functions” (indicative, not an offer). And $3M+ for “Highly unique, proprietary operational data” (indicative, not an offer).

The factors, in micro1’s words: “dataset size and volume, workflow complexity, data quality, domain expertise represented, and the uniqueness of the operational knowledge contained within the dataset.” The estimate page adds that the “Final payout is determined based on data sources, volume, quality, access terms, and due diligence.”

Here is how those read in a lab, as our own reading.

Domain expertise is where a lab is unusual. A deviation investigation written by a PhD scientist, reviewed by QA and signed by a study director carries a depth of reasoning most companies never write down. Workflow complexity is high as well: a single study touches the lab, QA, the archive, procurement and the sponsor.

Quality, in this business, is how complete the trail is. A deviation with an investigation and a corrective action beats a deviation with a one-line note. Years matter too. micro1 says “Companies with several years of records across multiple business systems are generally a stronger fit.” A lab that moved from paper to an electronic quality system in 2018 should count both.

Access terms and due diligence will weigh more in a lab than in most companies, because of the sponsor contracts above. Settle those early. Each factor is explained on what decides the price. micro1 evaluates each partnership individually, so a tier is a published range, not an offer.

Which programme fits

Our rule: companies with 30 or more people, now or at peak, go to micro1, as does a company of any size outside the US. micro1’s own line is “30+ full-time employees”. A lab under that line in the US has a different programme; the estimate asks for your headcount and names the one that fits. Where the line sits is on the programme page for 30 or more people.

Biotech companies close, sometimes after a single failed trial. micro1’s referral page covers that case with a “Defunct Company Data Partnership”: “We are acquiring data from companies that are no longer operating.” It lists “30+ employees”, “10+ Countries”, “English” and “All industries” as the requirements, and company compensation of “$100K-$3M+ for approved data packages” (indicative, not an offer). For a lab that has wound down, the first question is who still controls the archive and the email. Our page on closed companies starts there.

Three other kinds of company keep records in the same spirit. Software companies run change control under another name: the pull request, the review, the release note. Hedge funds and quant firms keep their research the way a lab keeps a method file, every failed test logged beside the one that worked. And chemistry and materials science R&D is the nearest neighbour: notebooks, batch records and safety files, run to a plan that keeps changing.

TrustPast

Questions and answers

Does micro1 want our patient or study subject data?

micro1 says personal and identifying information is removed or transformed before data is shared with third parties. As our own advice, anything about a patient or a study subject stays out of the conversation until counsel has read it.

Our studies were run for sponsors. Can we license those files?

Only the sponsor contracts say who owns a study's files. As our own advice, anything a sponsor or client owns under contract stays out, and counsel reads the contracts first.

Do we have to be a big company?

micro1 publishes that it is looking for established companies with 30 or more full-time employees, mature business operations and substantial historical operational data. A lab under that line in the US has a different programme, and the estimate names it.

Do the FDA's record rules stop us?

We can't answer that. Rules like 21 CFR Part 11 and the GLP retention rule in 21 CFR 58.195 decide how certain records are kept; what you may do with them is a question to ask counsel.

What does micro1 pay?

micro1's data partnerships page lists three tiers: $100K-500K, $500K-3M and $3M+ (indicative, not an offer). It says compensation is based on the quality, uniqueness and value of the data provided.

When is a company paid?

micro1 says it has 30 days to review and approve the data once the company transfers it. After approval it asks for an invoice, and payment is made within 30 days of invoicing.