Privacy Policy

1. About this policy

This Privacy Policy explains what information To be confirmed: company legal name ("TrialShelf", "we", "us") collects when people use TrialShelf, why, how long we keep it, and the choices and rights people have. Words such as "Customer", "User" and "Customer Data" mean what they mean in our Terms of Service.

TrialShelf is used by organizations for their work. For Customer Data, the organization decides what goes into TrialShelf and why, and we process it on the organization's behalf. For the information we need to run accounts and keep TrialShelf secure, we decide how it is used, as this policy describes.

This is an interim version, published before review by counsel. A reviewed version will replace it, and every User will be asked to accept the new version before continuing.

2. Information we collect

• Account information: your name and work email address. If you sign in with a password, our sign-in provider keeps it, and we never see it. If you sign in with Google, Google tells us your name and email address.
• Signing password: if you set one to sign records electronically, we keep only a one-way hash of it, never the password itself.
• Your organization and roles: the organizations you belong to, your roles, sites and studies, and invitations and requests to join.
• Customer Data: the records your organization keeps in TrialShelf, such as inventory, kits, samples, equipment and studies, and the documents, photos and scans Users add, with what TrialShelf read from them and the corrections Users made.
• Activity: what you do in TrialShelf, in the audit trail of each record, and when you sign in and out, including failed sign-in attempts. We record your browser's description of itself and your time zone with them.
• Technical information: our hosting and sign-in providers process your IP address and similar information to deliver TrialShelf and protect it from abuse.
• Emails: a record of each email TrialShelf sends, such as invitations, account emails and the morning brief.
• Feedback: what you send us with in-app feedback, including any screenshot you attach.
• Acceptance of our terms: which version of the Terms of Service and this policy you accepted, and when.

TrialShelf is designed to store no patient data. Do not enter or upload information that identifies trial participants.

3. Cookies

TrialShelf uses only the cookies it needs to work: to keep you signed in, sign you out after a period without activity, and remember your choices, such as your organization, site and time zone. It may also keep similar information in your browser's storage. We do not use advertising or analytics cookies.

4. How we use information

• To provide TrialShelf: to run your account, show you your organization's records and do what you ask.
• To read documents: documents and photos Users add are sent to Anthropic's Claude to read what they say, and each reading is recorded.
• To keep TrialShelf secure: to keep the audit trail, detect and stop misuse, and investigate problems.
• To communicate: to send invitations, account and security emails, and the morning brief if you turn it on. You can turn the morning brief off at any time.
• To support you: to answer your questions and feedback, and to fix problems with your account.
• To improve TrialShelf: we use Customer Data, including documents, photos and corrections, to train and improve the core capabilities of TrialShelf that every customer uses, so every customer benefits from what is learned. We do not share any customer's data with, reuse it for, or expose it to any other customer.
• To meet legal obligations: and to protect our rights and the rights of others.

We do not sell personal information, and we do not use it for advertising.

5. Who we share information with

• Your organization: the people in your organization can see your name, email address and roles, and what you did in its records, as their roles allow.
• Our subprocessors: Anthropic (reading documents and photos), Supabase (database, file storage and sign-in), Vercel (hosting) and Resend (email). They process information only on our behalf, to provide their services to us.
• Google: only if you choose to sign in with Google.
• TrialShelf staff: who need it to support your organization or keep TrialShelf secure.
• When the law requires it: or to protect the rights, property or safety of TrialShelf, our customers or others.
• If TrialShelf changes hands: to a company that takes over TrialShelf, which must keep protecting it as this policy says.

6. How long we keep information

• Records and their audit trail are kept while your organization uses TrialShelf. Records are never deleted, only marked void, because the regulations that apply to clinical research require them to be kept. When the agreement with your organization ends, we keep and then delete them as our Terms of Service describe.
• Original photos and scans of documents are kept for 5 years from when they were added, by default, and then deleted.
• Your account is kept while you belong to an organization that uses TrialShelf, and while the records you are named in are kept.
• Feedback is kept while it is useful for improving TrialShelf; screenshots can be removed sooner on request.
• Backups keep copies for a limited time until they expire.

7. Security

We protect information with administrative, technical and physical safeguards, described in our Terms of Service. No system is perfectly secure, and we cannot promise that information will never be accessed without authorization.

8. Your rights

Depending on where you live, you may have the right to ask for access to your personal information, to correct it, to delete it, to receive a copy of it, or to object to or limit how it is used.

• For your account information, email us at To be confirmed: privacy contact email.
• For Customer Data, contact your organization, which decides how it is used. We help organizations answer such requests.

Some information cannot be deleted while the law requires it to be kept, such as the audit trail of regulated records. We will not treat you differently for using your rights.

9. Where information is processed

Our subprocessors process information in To be confirmed: countries where data is hosted and processed.

10. Children

TrialShelf is for work and is not meant for children. We do not knowingly collect information from anyone under 18.

11. Changes to this policy

We publish each version of this policy with its own version name and effective date, and we never change a version once it is published. When we publish a new version, every User is asked to accept it before continuing to use TrialShelf.

12. Contact

• Company: To be confirmed: company legal name
• Address: To be confirmed: registered address
• Email: To be confirmed: privacy contact email