Security and data protection for evidence work
ClinicalEvidence answers questions about published research and registered trials, so it never needs patient data. Your questions, threads and exports stay in your workspace, protected by roles, encryption and, on larger plans, an audit log and single sign-on.
No patient data needed
Everything ClinicalEvidence searches is public: trial registries such as ClinicalTrials.gov, the EU Clinical Trials Register and the WHO ICTRP, and the literature in PubMed and PubMed Central. To ask what trials show for a treatment, you describe a condition, an intervention or an endpoint, not a person.
- Ask about populations and interventions, never about an identifiable patient
- Do not paste names, record numbers, dates of birth or other personal health information into a question
- The product works fully without any patient data
Keeping patient data out of the tool keeps your evidence work outside the scope of patient record systems altogether. Read how AI clinical evidence search works to see exactly what the product processes.
Workspace isolation
Every account and every team works in its own workspace. Questions, saved threads, comments, alerts and exports belong to that workspace and are visible only to its members. One customer can never see another customer's questions or answers.
On Research Team, Organization and Enterprise, workspaces are shared by the team, and access follows the roles you assign.
Roles and access control
Team plans include roles, so each member gets the access their work needs.
- Owners manage the plan, billing, members and settings
- Members ask questions, save threads, comment, set alerts and export
- Viewers read shared threads and tables without using the team's cited answers
Remove a member and their access ends immediately, while the team's shared threads stay in the workspace. See which plans include team features on the pricing page.
Audit log on Organization and Enterprise
Organization and Enterprise include an audit log that records who asked which question, who exported what, who changed members or roles and when. The log gives medical affairs, compliance and quality teams a trail they can review, in the same spirit as the citation trail behind every cited AI answer.
Single sign-on with SAML on Enterprise
Enterprise supports single sign-on through SAML, so your team signs in with your identity provider and your existing password policy and multi-factor rules. When someone leaves your organization, removing them in your identity provider removes their access to ClinicalEvidence.
Encryption and hosting
- All traffic between your browser and ClinicalEvidence is encrypted in transit with TLS
- Stored data, including questions, threads and exports, is encrypted at rest
- The service runs with a hosting provider in the EU or US on infrastructure with physical access control
- Payments are handled by a payment processor, and we never see or store full card numbers
- Account emails such as sign-in codes are sent through an email delivery provider
Access to production systems is limited to the people who run the service and is protected with strong authentication.
Your questions are not used to train public models
Your questions and answers are used to deliver the service to you. They are not used to train public language models, and they are not shared with other customers. The language model that writes answers receives only your question and the passages retrieved from the index for that question.
Data retention and deletion
Your threads, alerts and exports stay in your workspace until you delete them. You can delete a thread or an alert at any time. When you close your account, or when you ask us to delete your data, we delete your workspace content and personal data, except records we must keep by law, such as payment records. To request deletion, write to [email protected] from the email address of your account. Details are in our privacy policy.
How to report a security issue
If you believe you have found a security vulnerability in ClinicalEvidence, write to [email protected] with a description, the steps to reproduce it and any relevant details. Please do not access data that is not yours, do not disrupt the service and give us reasonable time to fix the issue before sharing it publicly. We read every report and reply to the reporter.
Questions about security and data protection
Do I need to enter patient data to use ClinicalEvidence?
No. The product searches public trial registries and the biomedical literature. Questions describe conditions and interventions, not patients, and you should never enter personal health information.
Are my questions used to train AI models?
No. Your questions and answers are used only to deliver the service to you and are not used to train public language models.
Which plans include the audit log and single sign-on?
The audit log is included in Organization and Enterprise. Single sign-on with SAML is included in Enterprise.
Start evidence work your compliance team can follow
Choose the plan with the controls your team needs and create your account.