Privacy Policy

TrialCanopy Ltd is a UK company registered at 20-22 Wenlock Road, London N1 7GU. We are registered with the Information Commissioner's Office under reference ZB633445. We build TrialConX, software that helps clinical trial site networks recruit participants. This policy explains how we handle personal data when you:

• visit our website at trialconx.com;
• contact us by email, phone or web form;
• register on our For Patients page to hear about studies;
• work with us as a customer, prospect or supplier;
• work with us as a director or contractor;
• exercise your data protection rights with us.

It is written in plain English and we keep it short on purpose.

If you have been screened for a clinical trial through a website we operate on behalf of a sponsor or site, your data is processed by the trial sponsor or site, not by TrialCanopy. They are the controller of your information. Their privacy notice applies, not this one, and you will find it linked from the screener you used. If you have reached this page looking for information about how your trial application is handled, please contact the organisation running the trial directly.

This exclusion does not apply to details you give us directly on our For Patients page, which are covered by the section "If you register as a patient to hear about studies" below.

When you visit trialconx.com

We do not use cookies. We collect anonymous, aggregated analytics about page views and traffic sources to understand how our website is used. No personally identifying information is retained from those analytics.

If you submit a contact or product enquiry form, we collect the name, work email, employer and the content of the message you provide so we can respond and assess whether our product is a fit for your organisation.

Lawful basis: Article 6(1)(f) UK GDPR, our legitimate interest in responding to enquiries about our products.

When you sign up on our For Patients page, we collect your name, contact details, location, and the health areas you tell us you are interested in, along with anything else you choose to share. We use this to alert you or arrange for you to be contacted when a study that may fit you becomes available through our partner network, and, with your consent, to share your details with clinical trial sites and recruitment partners in that network so they can contact you about those studies.

Lawful basis: Article 6(1)(a) UK GDPR, your consent; and, for any health information you choose to share, Article 9(2)(a), your explicit consent.

You can withdraw your consent at any time and ask us to delete everything we hold about you (your right to be forgotten). Email hello@trialcanopy.com or use the link in any message we send you. Withdrawing consent stops all sharing and contact from that point on and does not affect the lawfulness of processing before withdrawal.

We keep patient registrations until you withdraw consent, or after 24 months without any interaction from you, whichever comes first; the data is then deleted.

Recipients: clinical trial sites and recruitment partners in the TrialConX network, each bound by written agreements limiting use of your details to contacting you about relevant studies. If you are later screened for a specific study, the site or sponsor running that study becomes the controller of the data they collect from you, and their privacy notice applies.

We collect your name, work role, employer, work email and phone number, professional networking profile, and notes of any conversations or meetings.

Lawful basis: Article 6(1)(f) UK GDPR, our legitimate interest in B2B outreach and account management to organisations in our target market. We may obtain your business contact details from public professional networking platforms, conferences and events, or referrals. You have the right to object to this processing at any time; see "Your rights" below.

We hold the same business contact data plus contract administration and invoicing information.

Lawful basis: Article 6(1)(b) UK GDPR, performance of our contract with your employer; and Article 6(1)(f) for ongoing account management.

We hold your identity (name, date of birth, NI number, nationality, address), contact details, our agreement with you, fees and invoice records, bank or payment details (for sole traders), identity verification documents where required, and any board minutes or records referencing you.

Lawful basis: Article 6(1)(b) UK GDPR (contract); Article 6(1)(c) for statutory obligations under the Companies Act 2006, HMRC tax reporting, and anti-money-laundering law; and Article 6(1)(f) for corporate governance.

We hold your contact details, the content of your request, and our response.

Lawful basis: Article 6(1)(c) UK GDPR, our legal obligations to respond to data subject rights requests.

• Website analytics: de-identified only; no personal-data retention.
• Contact form submissions: until the enquiry is resolved plus 24 months.
• Patient registrations: until consent is withdrawn or 24 months of inactivity.
• Prospect business contacts: 24 months from last interaction.
• Customer contacts: duration of contract plus 6 years for invoicing records.

We delete or anonymise personal data once it is no longer needed for the purpose we collected it.

We share personal data only with the following categories of recipient:

• Service providers that help us operate our infrastructure, communications and business, for example cloud hosting, email delivery and productivity software; each is bound by a written data processing agreement.
• Clinical trial sites and recruitment partners in the TrialConX network, only for patient registrations and only with your consent, as described above.
• Professional advisers: our accountant, legal counsel, and tax advisers, where reasonably necessary.
• Government bodies: HMRC, Companies House, the ICO, and law enforcement where we are required to do so by law.
• Buyers, investors and their advisers: if we are involved in a sale, merger or restructuring, we may share personal data subject to confidentiality undertakings.

A full list of our service providers is available on request via the contact details at the foot of this policy. We do not sell personal data.

Our service providers are based in the United Kingdom, the European Economic Area, and the United States. Where personal data is transferred outside the UK to a country covered by UK adequacy regulations (for example, EEA countries), no additional safeguards are required. Where personal data is transferred outside the UK to a country not covered by UK adequacy regulations (for example, the United States), we rely on the UK Addendum to the EU Standard Contractual Clauses, which is included in our data processing agreements with the relevant providers.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure in certain circumstances ("right to be forgotten").
• Restriction of processing in certain circumstances.
• Portability of data you have given us, in a structured, machine-readable format.
• Object to processing based on legitimate interests, including for marketing.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to automated decision-making that produces legal or similarly significant effects (we do not do this).

To exercise any of these rights, email hello@trialcanopy.com. We will respond within one month.

We use measures including:

• encryption in transit (TLS 1.2+) and at rest;
• multi-factor authentication on administrative access;
• role-based access controls with least privilege;
• a secure software development lifecycle with peer code review;
• encrypted backups;
• confidentiality agreements with all contractors;
• a documented offboarding procedure that revokes all access when an engagement ends.

No system is completely secure, but we work to ensure personal data is appropriately protected.

We may update this policy from time to time. When we do, we will update the version number and effective date at the top. For material changes, we will let you know directly where we have your contact details.

• Data Protection Officer: Alex Garner
• Email: hello@trialcanopy.com
• Post: TrialCanopy Ltd, 20-22 Wenlock Road, London N1 7GU
• ICO registration: ZB633445