Privacy Policy

Last updated: January 27, 2026

This policy explains how we handle data in TrialTrack and VendorVigilance (the "Services").

Our Role

For account information (email, organisation), we act as the data controller.

For operational data you enter into Services (studies, tasks, sites, vendors, participants), we act as a data processor on your behalf. You control what data you enter; we process it only to provide the service.

What We Collect

• Account data: Email address, role, organisation name
• Operational data: Studies, tasks, sites, vendors, participants, and related records you create
• Usage data: Audit logs, timestamps, IP addresses for security and compliance purposes

The Services are designed for operational task management. They are not intended for storing patient health records or personally identifiable patient data.

How We Use Your Data

• To provide and maintain the Services
• To authenticate users and enforce permissions
• To generate audit trails for compliance purposes
• To send transactional notifications (e.g., task reminders, system alerts)
• To respond to support requests

Legal Basis (GDPR)

• Contract: Processing necessary to provide the service you signed up for
• Legitimate interest: Security, fraud prevention, service improvement
• Legal obligation: Where required by law

Subprocessors

The following third parties process data on our behalf:

Provider	Purpose	Location
Heroku (Salesforce)	Hosting infrastructure	EU / US
Customer.io	Transactional email	US
HelpScout	Customer support	US

We maintain contracts with each subprocessor requiring them to protect your data. We will notify customers of material changes to this list.

Data Location

The Services are hosted in AWS data centres via Heroku. Your data is stored in either EU (Dublin) or US (Virginia), based on your location. Customers outside these regions are assigned the nearest data centre.

For EU customers whose data may be processed by US-based subprocessors, we rely on Standard Contractual Clauses and equivalent safeguards.

Data Retention

We retain user account data for as long as the organisation's account is active.

Organisation deletion: If you close your organisation's account, all data—including audit trails—will be permanently deleted within 30 days. Prior to deletion, you will receive a complete, uneditable export of your audit trail for your records.

Individual account deletion: Individual user accounts cannot be deleted while the organisation remains active, as user identity (email address, IP address) is embedded in audit trail records required for regulatory compliance. Users can be disabled by an organisation Admin, but their historical actions remain part of the audit record.

Your Rights

Under GDPR, you have the right to:

Note: Individual user data cannot be deleted while your organisation's account is active, as it forms part of the regulatory audit trail. If your organisation closes its account, all data including audit records will be deleted. This retention is necessary for compliance with ICH E6(R3), 21 CFR Part 11, and EU Annex 11, and is exempt from individual erasure requests under GDPR Article 17(3)(b).

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent (where applicable)

To exercise these rights, contact us.

If you believe your rights have been violated, you may lodge a complaint with the Information Commissioner's Office (UK) or your local EU data protection authority.

Security

We implement technical and organisational measures to protect your data, including encryption in transit (TLS 1.2/1.3), encryption at rest (AES-256), role-based access controls, and continuous backups. We are Cyber Essentials Plus certified.

Data Processing Agreement

Business customers requiring a Data Processing Agreement for vendor qualification can contact us to request one.

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification.