Privacy Policy
Last updated: [placeholder: publication date]
This policy explains what personal data Eligible 4 collects, why we collect it, and the rights you have over it. Eligible 4 is a platform for clinical trial recruitment and management used by healthcare professionals and institutions.
Data we collect
Account data: your name, email address, professional details such as specialty and role, and the institution you belong to. This is provided by you or by the institution that invited you.
Usage data: records of the actions you take in the platform, such as the studies you create and the referrals you manage. These are stored so the platform can function and so institutions can maintain audit trails.
Health information
Some features send clinical text or images to our servers and to our AI provider ([placeholder: Vertex AI, EU region — after migration]), for the sole purpose of carrying out the task you asked for: filling in the referral form and showing which information is present for each criterion of the study, matching a case against clinical trials, or digitising a photographed clinical record.
Before clinical text is sent, the application tries to remove identifiers on your device (names, dates, health service, record and tax numbers, among others). This on-device de-identification is done by an automated model and is not guaranteed: the text may still contain identifiers.
The de-identified text is therefore shown to you, you can edit it, and it is sent only after you confirm that you have reviewed it and that it contains no identifiers. This review is mandatory and is the responsibility of the professional who sends it.
On the server, an automated filter looks for identifiers in the text and replaces them, as a second layer of protection. This filter is not guaranteed either: it does not recognise every name or every format.
Medical Record Digitisation sends the photo as it was taken: no identifiers are removed from the image automatically. Do not photograph labels, record headers or areas showing the name, health service number or tax number.
At the check-in of a trial appointment, the investigator records the patient's name, date of birth and contact details. These are stored on the platform and are not sent to the AI provider.
We do not store uploaded documents or extracted information unless you choose to save them in the application or you submit the referral. On submission, the form you reviewed and the list of present or missing information are stored with the referral.
Clinical Record Anonymizer
The Clinical Record Anonymizer is a fully on-device tool. Your patient text and images are processed entirely inside your browser tab — they are never transmitted to our servers and we have no way of accessing them.
Removal of identifiers by the Anonymizer is not guaranteed. Always review the result before any further use.
On first use it makes outbound requests to public third-party CDNs to download the model and OCR engine. These never include your patient data: huggingface.co and cdn-lfs.huggingface.co for the open-source Llama 3.2 model weights, and tessdata.projectnaptha.com for the Tesseract OCR language files.
Analytics is disabled entirely on this route. No analytics script is loaded there and the page's Content-Security-Policy does not permit any request to Google, so the guarantee is enforced by your browser rather than only promised by us.
Cookies and analytics
We use Google Analytics 4 to understand how the platform is used — but only if you accept it. Until you accept, no Google script is loaded and no request is made to Google at all.
When enabled, analytics records the page path you visit, which AI tools are run, whether a run succeeded or failed, and a coarse duration band. Paths are stripped of query strings and document identifiers before being sent.
We never send patient data, free text you typed, error messages, file names, your user ID, your role, or your institution to Google. Advertising signals remain disabled at all times.
See the Cookie Policy for the full list of cookies and how to change your choice at any time.
Legal bases
We process account and usage data to perform our contract with you or your institution (GDPR Article 6(1)(b)) and to pursue our legitimate interest in operating and securing the platform (Article 6(1)(f)).
Analytics cookies are processed solely on the basis of your consent (Article 6(1)(a)). You may withdraw that consent at any time without affecting the lawfulness of prior processing.
Health data is processed under [placeholder: legal basis under GDPR Article 9(2) — to be set by the DPO], under the instructions of the healthcare institution responsible for the patient record [placeholder: controller and processor roles].
Your rights
You have the right to access, rectify, or erase your personal data, to restrict or object to processing, and to data portability.
Where processing is based on consent, you have the right to withdraw it at any time. For analytics, this is available on the Cookie Policy page and in your account settings.
You also have the right to lodge a complaint with your national supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD).
Sub-processors and regions
We use the following sub-processors to process personal data:
Google Cloud / Firebase App Hosting — hosting and running the application. Region: [placeholder: region].
Google Cloud Firestore — database (accounts, studies, referrals and appointments). Region: [placeholder: region].
Google Cloud Storage — files uploaded to projects. Region: [placeholder: region].
Firebase Authentication — sign-in. Region: [placeholder: region].
AI provider — [placeholder: Vertex AI, EU region — after migration].
Twilio SendGrid — sending the platform's e-mails. Region: [placeholder: region].
Google Analytics 4 — usage analytics, only with your consent. It may process data outside the European Economic Area under the European Commission's Standard Contractual Clauses.
[placeholder: how changes to this list of sub-processors are announced]
Retention and international transfers
We keep data for the following periods: account data, [placeholder: period]; referrals and their history, [placeholder: period]; patient data recorded at check-in (name, date of birth and contact details), [placeholder: period]; usage and audit records, [placeholder: period]; IP address used to limit the use of AI tools without an account, [placeholder: period].
The AI provider keeps requests and responses for [placeholder: AI provider retention period after the migration].
Analytics data is kept for [placeholder: period configured in Google Analytics]. Transfers outside the European Economic Area and their safeguards are those stated for each sub-processor in the previous section [placeholder: confirm for each sub-processor].
Contact
For any question about this policy or to exercise your rights, contact us at info@reconqueringmed.com.