Privacy policy
This policy explains what personal data ClinicalEvidence processes, why, on what legal basis, who receives it, how long it is kept and which rights you have. Last updated 2026-10-20.
Who is responsible for your data
The controller of personal data processed through ClinicalEvidence is the administrator of the clinicalevidence.ai service. You can reach the administrator about any privacy matter at [email protected].
Personal data we process
- Account data, your email address and a hash of your password (we never store the password itself)
- The signup code sent to your email address to confirm it, kept only until it is used or expires
- Workspace content, the questions you ask, saved threads, comments, alerts on saved questions and exports you create
- Usage logs, such as the number of cited answers used, the plan you are on and the actions taken in a team workspace (including the audit log on Organization and Enterprise)
- Billing data, such as plan, billing period and payment status; card details are entered directly with our payment processor and we do not store full card numbers
- IP address, browser type and technical logs needed to run, secure and troubleshoot the service
- Demo questions asked on the homepage, together with the answer shown and the IP address used to limit the demo to one question per visitor
- Messages you send to [email protected]
Why we process data and on what legal basis
Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases.
- To create and run your account, deliver cited answers, keep your workspace and threads, send signup codes, alerts and service emails, and process subscriptions, under Article 6(1)(b) GDPR (performance of a contract)
- To keep billing and tax records and to respond to lawful requests from authorities, under Article 6(1)(c) GDPR (legal obligation)
- To secure the service, prevent abuse, limit the one-time demo, keep technical logs, improve reliability and handle disputes, under Article 6(1)(f) GDPR (our legitimate interests in a safe and working service)
We do not use your data for automated decisions that produce legal or similarly significant effects for you.
Who receives personal data
We share personal data only with service providers that help us run ClinicalEvidence, and only to the extent they need it.
- A hosting provider in the EU or US that stores and runs the service
- A payment processor that handles subscriptions and card payments
- An email delivery provider that sends signup codes, alerts and service emails
- A language model provider that processes the text of your question and the retrieved passages to produce your answer, under a data processing agreement, without using this content to train public models
We may also disclose data where the law requires it. We do not sell personal data.
International transfers
Some providers may process data outside the European Economic Area or the United Kingdom, including in the United States. Where that happens, we rely on the European Commission standard contractual clauses or another lawful transfer mechanism, together with supplementary safeguards where needed.
How long we keep data
- Account data and workspace content, for as long as your account is active; after you delete your account, within 30 days, except where we must keep data longer by law
- Signup codes, until they are used or expire
- Demo questions and results, up to 30 days
- Technical and security logs, up to 12 months
- Billing and tax records, for the period required by applicable law
- Support messages, for up to 24 months after the conversation ends
Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you and receive a copy
- Rectify inaccurate or incomplete data
- Erase your data
- Restrict processing
- Data portability in a structured, commonly used format
- Object to processing based on our legitimate interests
- Lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work
To exercise any of these rights, write to [email protected] from the email address linked to your account. We reply within one month.
Notice for residents of US states with privacy laws
If you live in a US state with a consumer privacy law, such as California, Colorado, Connecticut, Virginia or Texas, you may have the right to know, access, correct and delete personal information and to opt out of its sale, sharing for cross-context behavioral advertising or targeted advertising. We do not sell personal information and we do not share it for cross-context behavioral advertising or targeted advertising. We will not discriminate against you for exercising your rights. You can send a request, or appeal a decision on a request, to [email protected].
Children
ClinicalEvidence is a professional service for adults working in healthcare and life sciences. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.
No patient identifiable information
Do not enter patient identifiable information into ClinicalEvidence, including names, record numbers, dates of birth, addresses or any combination of details that could identify a person. The service works on published and registered evidence and does not need patient data. If such information is entered, we delete it once we become aware of it. See our terms of service and medical disclaimer.
How we protect data
Data is encrypted in transit, access is limited to people who need it, and team workspaces support roles, with single sign-on on Enterprise and an audit log on Organization and Enterprise. Read more on our security page.
Changes to this policy
We may update this policy when the service or the law changes. The date at the top shows the latest version, and we notify account holders by email about material changes.
Questions about your data
Write to [email protected] or read the FAQ for answers about workspaces and data.