EN
Contact
Menu

Legal

Privacy notice

Version 1.0. Effective date: 1 September 2026.

  1. Who we are

    This privacy notice explains how Esperity BV, Boulevard Brand Whitlock 108, 1200 Brussels, Belgium ("Esperity", "we") processes personal data when you use the TrialsConnect website (trialsconnect.io), the trial search (search.trialsconnect.io) and the physician application (app.trialsconnect.io).

    For questions about this notice or your data, write to info@trialsconnect.io or to our postal address above.

  2. When we are controller and when we are processor

    Esperity is data controller for this website, the contact form, the public trial search and physician accounts.

    For trial portals run under the name of a medical society or patient organisation, and for hospital workspaces, that organisation or hospital is data controller. Esperity acts as processor on its behalf under a data processing agreement. For those services, please read the privacy notice of the organisation concerned, or contact it directly.

  3. Personal data we process

    • Contact form: first and last name, work email, organisation, role, topic and your message.
    • Physician accounts: name, professional email, specialty, institution, country and region, login data, saved searches and alert preferences.
    • Optional physician profile visibility: if you choose to make your profile visible, the profile details you enter, such as specialty, institution and trial experience.
    • Website use: technical data needed to deliver and secure the site, such as IP address, browser type and time of request.
    • Analytics, only with your consent: pseudonymous usage data collected through Google Analytics, such as pages visited and approximate location at country or city level.

    We do not ask for health data about patients or about you. Please do not include such information in messages or free-text fields.

  4. Why we process your data and on which legal basis

    PurposeLegal basis (GDPR)
    Answering your message and following up on your requestOur legitimate interest in responding to enquiries (Art. 6(1)(f)), or steps before a contract at your request (Art. 6(1)(b))
    Providing your physician account, saved searches and alertsPerformance of the contract for the account (Art. 6(1)(b))
    Making your physician profile visible to sponsors looking for investigatorsYour consent (Art. 6(1)(a)), which you can withdraw at any time in your account settings
    Website analytics with Google AnalyticsYour consent (Art. 6(1)(a)), given in the cookie banner
    Security, preventing misuse and keeping logsOur legitimate interest in protecting the service (Art. 6(1)(f))
    Meeting legal obligations, such as accounting or answering authoritiesLegal obligation (Art. 6(1)(c))

  5. Who receives your data

    We share personal data only with service providers that process it for us under a data processing agreement, and only as far as needed:

    • Hosting: OVHcloud, data centres in the European Union.
    • Content delivery and security: Cloudflare, Inc.
    • Website analytics, only with your consent: Google Ireland Limited (Google Analytics).
    • Email and form handling: Amazon Web Services.
    • Data-protection and compliance support: Chino.io.

    Sponsors see a physician profile only if the physician has chosen to make it visible. Sponsors never receive data from the contact form, from hospital or physician communications, or any patient data. We do not sell personal data.

  6. Transfers outside the European Union

    We host the platform in the European Union. Some providers, such as Google, Cloudflare and Amazon Web Services, may process data in the United States. In that case the transfer is covered by the EU–US Data Privacy Framework and, where needed, the European Commission's standard contractual clauses.

  7. How long we keep your data

    DataRetention
    Contact form messages2 years after our last contact
    Account dataAs long as the account is active, then deleted within 3 months
    Analytics data in Google Analytics14 months
    Security logsUp to 12 months
    Accounting recordsAs required by Belgian law

  8. How we protect your data

    We use technical and organisational measures appropriate to the risk, including access control, role-based permissions, audit logs of changes and encryption in transit and at rest. Only staff who need access for their work can see personal data.

  9. Your rights

    Under the GDPR you have the right to:

    • access your personal data and receive a copy;
    • have inaccurate data corrected;
    • have your data erased, where the law allows;
    • restrict or object to processing based on our legitimate interest;
    • receive data you provided in a portable format;
    • withdraw consent at any time, without affecting processing before the withdrawal.

    To use these rights, write to info@trialsconnect.io. We answer within one month. You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

  10. Data protection contact

    For any question about data protection, email info@trialsconnect.io.

  11. Changes to this notice

    We may update this notice when our services or the law change. The effective date at the top shows the latest version. We will inform account holders of important changes by email.