Privacy Policy

Effective date: May 14, 2026
Version: 2.0

This Privacy Policy explains how Trialytics ("Trialytics," "we," "our," or "us") collects, uses, discloses, and protects information when you use our clinical trial matching platform at trialytics.ai (the "Service"). Trialytics is a trade name registered in the State of Maryland.

If you do not agree with this policy, do not use the Service.

1. Summary (in plain English)

We collect health information from you, including diagnoses, biomarkers, and treatment history. We need this to match you with appropriate clinical trials.
We protect this information with encryption, HIPAA-aligned safeguards, and strict access controls.
We do not sell your information to anyone.
We use Google Cloud Vertex AI (Gemini models) to analyze trial eligibility criteria. Your information is processed under a Business Associate Agreement with Google.
You can delete your account and your data at any time.
This policy is governed by Maryland law.

The rest of this document is the formal version.

2. Information we collect

2.1 Account information

When you create an account, we collect:

Name, email address, and authentication credentials (managed via Google Cloud Identity Platform / Firebase Authentication)
Optional profile information (date of birth, ZIP code, contact preferences)

2.2 Health information

To match you to clinical trials, we collect health information that may be considered Protected Health Information ("PHI") or "consumer health data" under applicable laws. This may include:

Medical conditions, diagnoses, and disease stage
Biomarkers, genetic markers, and laboratory values
Prior and current medications and treatments
Performance status and functional measurements
Demographic information relevant to eligibility (age, sex, pregnancy status)
Clinical trial match results and your interactions with them
Documents you upload, such as pathology reports or medication lists

You decide what to share. Some matching features require certain information to function — we will tell you what is needed and why before you provide it.

2.3 Automatically collected information

Usage data (pages visited, features used, search queries)
Device information (browser, operating system, device type)
Log data (IP address, access times, referring URLs)
Cookies and similar technologies (see Section 5)

2.4 Information from third parties

We do not currently obtain your information from third-party data brokers, advertisers, or health information exchanges. If this changes, we will update this policy and notify you.

3. How we use information

3.1 To provide the Service

Match your profile against clinical trial eligibility criteria
Surface trials that may be relevant to you
Maintain your account and saved trials
Communicate with you about your account and matches you have requested

3.2 AI processing

We use Google Cloud Vertex AI (specifically Gemini language models) and our own AI infrastructure to:

Parse clinical trial eligibility criteria into structured data
Compare your profile against those criteria
Generate plain-language explanations of trial requirements

When we send your information to Vertex AI for processing, it is processed under our Business Associate Agreement with Google Cloud, which restricts Google's use of the data. We do not use your health information to train or fine-tune AI models — ours or our providers'. "Train" here means using data to build or adjust a model's learned parameters. Measuring and improving the quality of the Service (Section 3.3) is not training and modifies no model. Google has agreed under our BAA not to use our customer data to train or improve its models.

3.3 To improve the Service

Analyze aggregate, de-identified usage patterns
Diagnose and fix technical issues
Develop new features

Wherever possible we improve the Service using data that has been aggregated or de-identified in accordance with the HIPAA de-identification standard (45 C.F.R. § 164.514) and applicable state law, so it can no longer reasonably be linked to you. This includes reviewing de-identified cases to check whether our eligibility assessments were correct.

We do not review your identifiable health information to improve the Service unless you give us specific, separate permission. If we ask for that permission, we will tell you exactly what we want to review and why, and you can decline without losing access to matching.

3.4 For security and fraud prevention

Protect against bot abuse and automated attacks
Detect and prevent fraudulent or malicious activity
Enforce our Terms of Use
Comply with legal obligations

If you sign a HIPAA Authorization (see Section 4), we use your health information to communicate on your behalf with trial sites, sponsors, or research coordinators about specific trials you have expressed interest in.

4. HIPAA and your health information

Trialytics handles health information using safeguards aligned with the HIPAA Privacy and Security Rules. The technical safeguards are documented separately in our HIPAA Compliance Statement, available on request.

A note on HIPAA scope. When you submit your own health information directly to Trialytics, this is generally not a "covered" transaction under HIPAA, because HIPAA primarily regulates covered entities (healthcare providers, health plans, clearinghouses) and their business associates. We still apply HIPAA-grade protections to your information as a matter of policy, and we comply with state laws that may apply more broadly.

HIPAA Authorization for use and disclosure. Before we share your health information with any clinical trial site, sponsor, or research coordinator, we require you to sign a HIPAA Authorization. This document is available at HIPAA Authorization. You may revoke this authorization at any time in your account settings.

5. Cookies and tracking

5.1 Categories

Category	Purpose	Consent required
Strictly necessary	Authentication, security, core functionality	No (always active)
Analytics	Usage analytics for product improvement	Yes (opt-in)
Functional	Remember your preferences	Yes (opt-in)

5.2 Third-party analytics

With your consent, we use:

Vercel Analytics — privacy-friendly web analytics (cookieless). Privacy policy.

We do not use Google Analytics, Facebook Pixel, or similar ad-tech trackers.

5.3 Do Not Track

We respect "Do Not Track" browser signals — when present, we do not load analytics cookies.

We share information only as described below.

6.1 Service providers

Google Cloud Platform — hosting, database, authentication, AI processing. Covered by a Business Associate Agreement.
Qdrant Cloud — vector search infrastructure. Receives vector embeddings and minimal non-identifying filter attributes used for search. It does not receive your name, contact details, or the documents you upload.
Vercel — frontend hosting. Receives no health information.

We may add or change service providers as the Service evolves. We keep any provider that handles health information under a Business Associate Agreement or equivalent contractual protections, and we will notify you of material changes to this list.

6.2 Clinical trial sites and sponsors

Only with your specific consent via a HIPAA Authorization, we share relevant portions of your information with the clinical trial site or sponsor of a trial you have expressed interest in.

6.3 Legal compliance

We may disclose information when required by law, subpoena, or valid legal process, or to protect rights, safety, or property.

6.4 Business transfers

In a merger, acquisition, or asset sale, your information may transfer to the successor entity, subject to this policy or a successor policy.

6.5 What we do not do

We do not sell your personal information to third parties.
We do not share your health information with advertisers.
We do not use your health information to train or fine-tune AI models (see Section 3.2), and our service providers are contractually prohibited from doing so.
We do not share your account information with trial sponsors without your explicit authorization.

7. Data security

We protect your information with:

TLS 1.2+ encryption in transit
AES-256 encryption at rest
Column-level pgcrypto encryption for protected health information
HIPAA-aligned access controls, audit logging, and incident response
Workforce training and least-privilege service account design

Full technical detail is in our HIPAA Compliance Statement, available on request.

No system is perfectly secure. While we apply industry-standard safeguards, we cannot guarantee absolute security.

8. Data retention

Data	Retention
Account data	While account is active, then 30 days after deletion request
Health information	While account is active, then deleted within 30 days of account deletion or HIPAA Authorization revocation
Audit logs (HIPAA)	6 years, per HIPAA requirements
Cloud Run request logs	30 days
Analytics (de-identified)	24 months

You can request deletion of your account and data at any time. Deletion of audit logs is restricted by HIPAA retention requirements.

9. Your rights

You have the following rights regardless of where you live:

Access — request a copy of your information
Correction — update inaccurate information
Deletion — delete your account and personal data (subject to retention exceptions)
Withdrawal — revoke a HIPAA Authorization or withdraw consent
Export — receive your information in a portable format

9.1 Maryland residents

Maryland's Personal Information Protection Act applies. We maintain reasonable security procedures and will notify you of any data breach affecting your personal information without unreasonable delay.

9.2 California residents

The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply. You have the right to know what information we collect, request deletion, opt out of any "sale" or "sharing" (we do not sell or share your personal information), and not receive discriminatory treatment for exercising your rights. Sensitive personal information (which includes health information) is used only for the purposes described in this policy.

9.3 Washington residents

Washington's My Health My Data Act applies. We obtain your specific consent before collecting consumer health data, do not sell consumer health data, and provide you the right to withdraw consent and request deletion at any time. Contact [email protected] for any consumer health data request.

9.4 EEA / UK residents

If you are in the EEA or UK, GDPR rights apply: access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent. Our legal bases are consent (for health information), contract (for service delivery), legitimate interests (for security and improvement), and legal obligation.

9.5 How to exercise rights

Email [email protected] with the subject line "Privacy Rights Request." We respond within 30 days for GDPR requests and 45 days for CCPA requests.

10. Children

Account holders must be 18 or older. The Service is not intended to be used directly by anyone under 18, and we do not knowingly allow anyone under 18 to create an account. If we learn that a person under 18 has created their own account, we will delete it.

A parent or legal guardian who holds an account may submit health information about a minor in their care in order to search for trials on that minor's behalf, as described in our Terms of Use and HIPAA Authorization. In that case the adult account holder is responsible for the information and for having the authority to provide it.

11. International data transfers

We operate in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. For EEA/UK residents, transfers are made under Standard Contractual Clauses with appropriate safeguards.

12. Medical disclaimer

Trialytics is an informational platform. We are not a healthcare provider. We do not provide medical advice, diagnosis, or treatment. AI-generated summaries are for informational purposes only and may contain errors. Always consult a qualified healthcare professional before making medical decisions. In an emergency, call 911.

13. Changes to this policy

We may update this policy. Material changes will trigger:

An updated "Effective date"
An incremented version number
Email notification to active accounts
A re-acceptance prompt at next login

Your continued use of the Service after the effective date means you accept the revised policy.

14. Contact

Email: [email protected]
Support: [email protected]

Trialytics
Bethesda, Maryland, United States

This Privacy Policy is governed by the laws of the State of Maryland.