Privacy Policy

1. Introduction

Trialflow ("Trialflow," "we," "us," or "our") provides a clinical trial recruitment and management platform used by research sites, sponsors, and clinical research organizations (our "Customers"). This Privacy Policy explains how we collect, use, disclose, and protect information in connection with our website at gettrialflow.com, our applications, and related services (collectively, the "Services").

Trialflow acts in two different roles. When we operate our own business and website, we act as a "controller" of information about our Customers and website visitors. When we process information about prospective and enrolled research participants on behalf of a Customer, we act as a "processor" (and, where applicable, a HIPAA "business associate") — the Customer is responsible for that information and its handling is governed by our agreement with them.

2. Information We Collect

We collect the following categories of information:

• Account information: name, work email, phone number, organization, role, and login credentials for users of the Services.
• Information you provide: details submitted through demo requests, contact forms, support requests, and other communications with us.
• Participant and lead information (processed for Customers): contact details, eligibility and screening responses, appointment and visit data, and communications history that our Customers upload or capture through the Services. This may include information relating to health, which is handled on the Customer’s behalf.
• Calendar and integration data: when a Customer connects a third-party service such as Google Calendar, we access the specific data needed to provide scheduling features (for example, free/busy availability and events created through the Services), consistent with the permissions granted.
• Usage and device information: log data, IP address, browser and device type, pages viewed, and similar analytics collected automatically when you use the Services.
• Cookies and similar technologies: used to keep you signed in, remember preferences, and understand how the Services are used.

3. How We Use Information

• To provide, operate, maintain, and secure the Services.
• To authenticate users and manage access and permissions.
• To enable features such as recruitment pipelines, outreach, matching, scheduling, and analytics.
• To respond to inquiries, provide support, and communicate about the Services.
• To send administrative and, where permitted, marketing communications (you can opt out of marketing at any time).
• To monitor, analyze, and improve the performance and safety of the Services.
• To comply with legal obligations and enforce our agreements.

4. Protected Health Information (HIPAA)

When we handle protected health information ("PHI") on behalf of a Customer, we do so as a business associate under the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). In that role, we only use and disclose PHI as permitted by our Business Associate Agreement (BAA) with the Customer and applicable law. Customers are responsible for obtaining any necessary participant consents and for configuring the Services in a compliant manner.

We are happy to enter into a BAA with Customers that require one. Contact us to request a BAA.

5. How We Share Information

We do not sell personal information. We share information only in the following circumstances:

• Service providers / subprocessors: vendors that help us deliver the Services, such as cloud hosting, email delivery, SMS delivery, and calendar and analytics providers. These providers are bound by contractual obligations to protect information and use it only to provide services to us.
• With your organization: information within a Customer workspace is accessible to authorized users of that Customer, according to their assigned roles and permissions.
• Legal and safety: when required by law, subpoena, or legal process, or to protect the rights, property, or safety of Trialflow, our Customers, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

6. Data Retention

We retain information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Participant and lead information processed on behalf of a Customer is retained and deleted according to that Customer’s instructions and our agreement with them.

7. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls, and audit logging of sensitive actions. No method of transmission or storage is completely secure, but we work to protect information consistent with the sensitivity of the data we handle.

8. Your Rights and Choices

Depending on your location and role, you may have rights to access, correct, delete, or restrict the use of your personal information, or to object to certain processing. If your information is managed by a Customer within their workspace, please direct your request to that Customer; we will support them in responding. For information we control, you may contact us using the details below. You can opt out of marketing emails at any time using the unsubscribe link or by contacting us.

9. Cookies and Tracking

We use cookies and similar technologies to operate the Services, remember your preferences, and analyze usage. You can control cookies through your browser settings; disabling some cookies may affect how the Services function.

10. International Data Transfers

We are based in the United States and process information there. If you access the Services from outside the United States, you understand that your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

11. Children’s Privacy

The Services are intended for use by research organizations and their authorized personnel, not by children. We do not knowingly collect personal information directly from children through the Services.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective date" above and, where appropriate, provide additional notice. Your continued use of the Services after an update indicates your acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at privacy@gettrialflow.com.