Privacy Policy

1. Who We Are

TrialConnect is a trading name of Clinical Vendor Compare Limited (company number 17135935), registered in England. Our registered office is 17 Central Avenue, Herne Bay, Kent, CT6 8RX.

We are the data controller for the personal data you provide through the TrialConnect platform. Our ICO registration number is ZC155240 (registered in the name of Clinical Vendor Compare Limited, which also trades as Clinical Vendor Compare and TrialConnect).

For any privacy queries, contact us at admin@trialconnect.co.uk.

2. What Data We Collect

We may collect or process the following data depending on how you use TrialConnect:

• Email address — if you subscribe to trial alerts, join the waitlist, submit a contact form enquiry, or optionally provide your email when expressing interest in a trial.
• Name — only collected if you submit a contact form enquiry. We do not ask for your name when subscribing to alerts or using the matching wizard.
• Health condition(s) — the conditions you select so we can match relevant clinical trials and send you trial alerts.
• Matching questionnaire answers — if you use the matching wizard, you may choose to answer questions about your condition, demographics, location, travel preferences or other eligibility-related factors. These answers are processed by our servers only to run the matching calculation and return results to you. We do not store questionnaire answers on our servers after the matching request is complete.
• Trial interest and referral data — if you click to express interest in a trial, we record the trial identifier, your selected condition, the match score, the date, and (if you choose to provide it) your email address for follow-up. This data is stored to track your trial journey and send you referral information.
• Usage and analytics data — we collect two types of analytics:
  • Aggregate counters (page views, matching requests per condition, trial detail views) that contain no user identifiers whatsoever.
  • Consented product analytics (events such as pages visited, match journeys started/completed, trial contact clicks) linked to an anonymous session identifier. If you have granted analytics consent, these events may include the condition slug and trial identifiers you viewed. We never include raw questionnaire answers, email addresses, names, or postcodes in analytics events.
• Contact form submissions — if you use our contact form, we store your name, email address, subject line, and the message you provide.

We do not collect NHS medical records, NHS numbers or dates of birth. However, condition names, matching answers (during processing), trial interest records, and some analytics events may relate to your health and are treated as special category data under UK GDPR.

3. How We Use Your Data

We use your data to:

• send trial alerts based on your selected condition(s) when you subscribe;
• run the matching wizard and return potentially relevant trial results;
• provide trial referral information and track your trial journey if you express interest in a trial;
• respond to enquiries you submit via our contact form;
• maintain a waitlist and notify you when new features or trials become available;
• understand how the platform is used and improve TrialConnect;
• produce aggregated, privacy-preserving insights about trial search behaviour and engagement.

We do not sell identifiable patient data. Any sponsor or partner reporting is aggregated and designed so that individuals cannot be identified.

If you separately opt in, we may send information about sponsored or featured trials. This is optional, separate from core trial alerts, and you can opt out at any time.

AI-powered matching

TrialConnect uses software and AI-assisted matching to help identify potentially relevant public clinical trials based on information you provide and publicly available trial criteria. TrialConnect does not confirm eligibility, make clinical decisions, provide medical advice, or determine whether you can join a trial. Formal eligibility and participation are always confirmed by the relevant trial team.

4. Legal Basis for Processing (UK GDPR)

We process your data under the following legal bases:

• Explicit consent (Article 6(1)(a) UK GDPR) — you actively tick the consent checkbox before we store your email and send alerts. You also provide consent when optionally sharing your email for trial interest follow-up.
• Explicit consent for health data (Article 9(2)(a) UK GDPR) — health condition names, matching answers (during processing), and trial interest records are special category data. We only process these with your explicit, informed consent.

You can withdraw consent at any time by unsubscribing, using the manage-alerts link in any email, or contacting us.

5. Data Sharing

Anonymised statistics. We may share aggregated, anonymised statistics that cannot identify you (for example, how many people searched for trials in a condition area) with research partners, sponsors, and healthcare organisations. All anonymised data is processed in line with current ICO anonymisation guidance so that you cannot be re-identified.

Your personal data. We will never share information that identifies you — including your health information — with any third party without your explicit consent, asked for at the time, for a specific stated purpose. We will never sell your personal data.

Service providers — we use the following third-party providers to operate the platform, each bound by data processing agreements that prevent them from using your data for any other purpose:

• Vercel Inc. (United States) — website hosting and application runtime. Certified under the UK-US Data Bridge.
• Resend (United States) — email delivery service. Certified under the UK-US Data Bridge.
• Cloudflare — database hosting (D1) for trial alert subscriptions and analytics events, plus DNS and content delivery network services. Cloudflare operates within the UK/EU and has established data protection safeguards.
• Upstash (United States) — managed Redis (Vercel KV) used to store trial interest records, contact submissions, waitlist entries, and aggregate analytics counters.

We also retrieve publicly available clinical trial information from ClinicalTrials.gov (a service of the US National Library of Medicine). No personal data about you is sent to ClinicalTrials.gov.

6. Data Retention

We store your data only for as long as necessary for the purposes described in this policy. Specifically:

• Trial alert subscriptions — retained until you unsubscribe. When you unsubscribe, your record is marked inactive and no further alerts are sent. To request permanent deletion of your subscription data, email us at the address in Section 13.
• Trial interest / referral records — retained while your trial journey is active. To request deletion of your interest records, email us.
• Contact form submissions — retained for as long as needed to respond to your enquiry and for a reasonable period thereafter for record-keeping.
• Waitlist entries — retained until you request removal or we determine the waitlist is no longer needed.
• Aggregate analytics counters (page views, match counts) — retained indefinitely as they contain no personal data.
• Consented analytics events — retained according to the following schedule: system events for 90 days, match validation events for 12 months, trial inventory data for 3 years, consent logs for 7 years, and other event types for 12 months.
• Matching questionnaire answers — not stored on our servers. They exist only in your browser while you use the matching wizard.

If you withdraw consent or request deletion, we will action your request within 30 days of receiving it. Contact us at the email address in Section 13 to exercise this right.

6.1. Data We Do Not Keep (Matching Wizard)

If you use the trial matching wizard, your questionnaire answers are sent to our servers only to run the matching calculation and return results to you. We do not store these answers after the matching request is complete. We cannot retrieve, delete, or port answers from a past matching request because we do not keep them.

Your questionnaire answers are stored locally in your browser until you clear them. Use the Clear All Answers button in the matching wizard to remove them from your device.

7. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct any inaccurate data.
• Erasure — request deletion of all your data ("right to be forgotten").
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent — unsubscribe at any time via email, the manage-alerts link in any alert email, or your dashboard.
• Object to processing — request we stop processing your data.
• Restrict processing — request we limit how we use your data.

To exercise any of these rights, email admin@trialconnect.co.uk. We will respond within 30 days.

8. Cookies & Local Storage

We use a small number of cookies and local storage entries to operate the platform:

• Session cookie (tc_session) — set when you express interest in a trial, this httpOnly cookie allows us to link your trial interest and journey records to your browser. It lasts for 1 year and does not contain personal data directly. It is required for the trial journey tracking feature.
• Essential cookies — necessary for the platform to function (security, theme preference). Cannot be disabled.
• Analytics cookies — help us understand usage patterns (pages visited, features used). These are opt-in only and activated with your consent via the cookie banner. Consented analytics events are linked to an anonymous session identifier but are never linked to your name, email, or raw questionnaire answers.
• No advertising cookies — we do not use advertising or tracking cookies that identify you across third-party sites.

On-device storage: Your questionnaire answers and basic demographics (age, sex) are stored locally in your browser's session and local storage while you use the matching wizard. This data never leaves your device unless you actively submit answers for matching. Use the Clear All Answers button in the wizard, or the Cookie settings link in the site footer, to remove this data at any time.

You can change your cookie preferences at any time using the Cookie settings link in the site footer, which will re-display the consent banner.

9. International Data Transfers

Some of our service providers are based in the United States. Personal data you provide may be processed in the US under the protection of the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework).

• Vercel Inc. and Resend hold active certifications under the UK-US Data Bridge, which means they are bound by UK-equivalent data protection standards.
• Upstash (provider of Vercel KV) is also US-based. Where Upstash does not hold UK-US Data Bridge certification, we rely on the UK International Data Transfer Agreement (IDTA) as the appropriate safeguard for transfers to Upstash.
• Cloudflare D1 databases are accessible from Cloudflare's global edge network, which includes UK and EU data centres. Cloudflare is certified under the EU-US Data Privacy Framework (and UK extension).

We diarise annual re-certification checks to ensure these protections remain in force. If any provider's certification were to lapse, we would implement alternative transfer safeguards before transferring any further data.

10. Security

We implement industry-standard security measures including:

• HTTPS (TLS) encryption for all data in transit between your browser and our servers.
• HttpOnly, Secure, and SameSite cookie attributes to prevent cookie-based attacks.
• Input validation on all API endpoints to prevent injection attacks.
• Server-side validation that blocks raw questionnaire answers, email addresses, and postcodes from being stored in analytics events.
• Separate databases for operational data (trial alert subscriptions) and analytics, so analytics traffic is isolated and can be retention-purged independently.

However, no system is completely secure and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or a prominent notice on the platform.

12. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

13. Contact

Data protection enquiries: admin@trialconnect.co.uk

General support: admin@trialconnect.co.uk

Related documents: Terms of Service · Data Protection