Privacy Policy

We collect the following categories of information:

• Information you provide directly. Name, work email, company, role, and free-form messages submitted through the demo-request form or other contact channels.
• Customer account information. When you become a customer, account data including authorized-user identities, roles, and audit-relevant metadata.
• Customer trial data. Clinical data submitted to the Service is processed on behalf of our customers (the controllers). We act as a data processor for that data. See Section 6 and our Data Processing Agreement.
• Usage and device data. IP address, browser type and version, pages visited, referrer, and similar technical information recorded in standard server logs. If you accept analytics, comparable data is also collected by Google Analytics, and Microsoft Clarity additionally records a replay of your visit — see Section 8.
• Browser storage. The Site sets no cookies unless you accept analytics. Your consent choice itself is kept in your browser’s local storage and is never sent to us. See Section 8.

We use information for the following purposes:

• To provide, operate, secure, and improve the Site and the Service.
• To respond to demo requests, sales inquiries, and customer support requests.
• To send transactional emails (account, billing, validation pack delivery, etc.).
• To send marketing communications, where lawful and where you have not opted out.
• To detect, investigate, and prevent fraud, abuse, security incidents, and other harmful activity.
• To comply with our legal, regulatory, and contractual obligations.

Where the EU General Data Protection Regulation (“GDPR”) or the UK GDPR applies, we process personal data on the following legal bases: (a) performance of a contract; (b) compliance with a legal obligation; (c) your consent (which you may withdraw at any time); and (d) our legitimate interests in operating, securing, and improving the Site and Service, balanced against your rights.

We share personal data only as described below. We do not sell personal data.

• Subprocessors. We engage vetted subprocessors (cloud hosting, email delivery, analytics, customer support tooling, etc.) under written contracts that require equivalent data-protection commitments. A current list of subprocessors is available on request and in our DPA.
• Customers and authorized users. Information you submit through the Service may be visible to the customer organization on whose behalf the data was submitted.
• Legal, regulatory, and safety. Where required by law, court order, or to protect rights, property, or safety.
• Corporate transactions. In connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

Customer trial data and personal data are stored on infrastructure operating on encryption in transit and at rest, role-based access, and access logging. Enterprise customers may opt in to a dedicated single-tenant environment or regional failover. Our processing of personal data complies with the Digital Personal Data Protection Act, 2023 (“DPDP Act”). The full subprocessor list is published in our Data Processing Agreement at /dpa.

For trials with international filings, transfers of de-identified or submission-grade datasets outside India occur only at the customer’s direction and under appropriate safeguards (CDISC SDTM export controls, contractual confidentiality, and, where required, EU Standard Contractual Clauses).

When customers process clinical or health-related data through the Service, we act as a data processor (and where applicable a HIPAA business associate). Our handling of such data is governed by our Data Processing Agreement and, where required, by a Business Associate Agreement signed with the customer.

We retain personal data for as long as needed to provide the Site and Service, comply with legal obligations (including 21 CFR Part 11 and ICH E6(R3) audit-trail requirements applicable to clinical trials), resolve disputes, and enforce our agreements. Marketing-list contacts are retained until you unsubscribe.

Nothing loads until you accept. The Site sets no cookies of any kind on an ordinary visit. On your first visit a banner asks whether you consent to analytics. Until you choose Accept, no analytics script is requested and no data reaches any analytics provider — declining is not a preference we record and honour later, it is the absence of any request at all.

What runs if you accept. We load Google Analytics 4 to measure page views and understand which parts of the Site are useful. It sets cookies (typically_ga and _ga_<id>) that recognise a returning browser, and records IP address, device and browser characteristics, and the pages you visit. Google acts as our processor for this data. We use no cross-site advertising cookies and we neither sell nor share this data for advertising.

Session replay. We also load Microsoft Clarity, which goes further than page counts: it records your visit — mouse movement, clicks, scrolling and the structure of the pages you saw — so we can replay it and see where the Site is confusing. It sets its own cookies (typically _clck and_clsk) and records IP address and device and browser characteristics. Microsoft acts as our processor for this data and retains it for 30 days. Clarity masks the contents of every input box and drop-down before anything is uploaded, and we mark the demo request form and its confirmation message so that Clarity masks those too — what you type there, and the name shown back to you, never reach Microsoft. We do not use Clarity to identify individuals.

How your choice is stored. Your answer is kept in your browser’s local storage under trialion.analytics-consent. It is not a cookie and is never transmitted to us; it exists only so the banner does not ask again on your next visit. Clearing your browsing data removes it and the banner will ask afresh.

Changing your mind. Select Cookie preferences in the footer of any page to reopen the banner and change your answer. Withdrawing consent stops all further analytics loading immediately, and ends session recording on the page you are on. It does not retroactively erase data Google or Microsoft already holds; to request that, see Section 9.

Declining analytics restricts nothing. Every part of the Site works identically either way.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Indian residents have the right to: access the personal data we hold about you; correct inaccurate data; request erasure; nominate a representative; and withdraw consent. You may also raise grievances directly with our Data Protection Officer and, if unresolved, with the Data Protection Board of India.

EEA, UK, and Swiss residents retain GDPR rights; California residents retain CCPA/CPRA rights, for trials whose personal data they fall within.

To exercise any of these rights, contact us at privacy@trialion.com.

We maintain administrative, technical, and physical safeguards designed to protect personal data against loss, misuse, and unauthorized access — including encryption in transit and at rest, role-based access control, least-privilege permissions, security monitoring, and regular vulnerability and penetration testing. No system is perfectly secure; we encourage you to use strong, unique passwords and notify us promptly of any suspected incident.

The Site and Service are not directed to children under 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. The “Effective” date at the top of this page reflects the current version. Material changes will be notified through the Site or, where applicable, by email to account administrators.

For questions about this Privacy Policy or our data practices, contact:

Trialion
Trialion · Minarch Tower, Sector 44, Gurugram, India
Email: privacy@trialion.com