Privacy Policy

Byrock Technologies Limited is the data controller responsible for your personal data when you visit this website or use our portals. We are registered in Ireland.

You may contact our Data Protection Officer / privacy team at the email above with “Privacy” in the subject line. You also have the right to lodge a complaint with the supervisory authority — in Ireland, the Data Protection Commission (dataprotection.ie).

We rely on the following lawful bases under Article 6 of the GDPR:

• • Identity & contact: name, email address, phone number, organisation.
• • Account & credentials: username, hashed password, role, access logs.
• • Professional data: professional qualifications, regulator/GMC/RCVS numbers, site affiliations (for investigators).
• • Inquiry & correspondence: content of messages you send us and our replies.
• • Usage & device: IP address, browser type, pages visited, referral URLs, approximate location.
• • Portal content: documents and data you upload to the licensing or clinical trial portal.
• • AI inputs: text or files you submit to AI-assisted features.

We do not process special-category data (Article 9) beyond what you voluntarily provide in correspondence. Where clinical trial data is processed, it is handled under the applicable clinical trial regulatory framework.

We do not use solely automated decision-making that produces legal or similarly significant effects about you (Article 22 GDPR). Any decision that could affect you — for example access to a clinical trial portal — is reviewed by a person. Where profiling is used for analytics, it does not produce such effects and is based on consent or legitimate interests.

To the extent the EU AI Act or member-state transparency obligations apply, we provide this disclosure and ensure that AI-assisted outputs are subject to human oversight. We do not represent that any AI system we use is free from error, and you should not rely solely on AI-generated output for decisions affecting health or legal rights.

You may object to profiling for analytics, request human review of any automated processing that concerns you, and request information about the logic involved. We apply governance proportionate to the risk of each AI use and review our AI practices as the legal landscape evolves. We avoid claiming compliance beyond what can be supported by our practices and records.

We keep personal data only as long as necessary for the purposes set out above:

• • Account & portal access: for the duration of your relationship with us, then deleted or anonymised.
• • Inquiry correspondence: up to 24 months.
• • Analytics & cookie data: up to 26 months.
• • Clinical trial portal records: for the period required by the applicable clinical trial regulations and sponsor agreements.
• • Legal & tax records: for the statutory retention period (typically 6–7 years).

When data is no longer needed, we delete it or render it anonymous so it can no longer identify you.

We implement appropriate technical and organisational measures to protect your data, including:

• • Encryption in transit (TLS) and at rest
• • Role-based access controls & least-privilege
• • Regular security reviews & monitoring
• • Staff confidentiality & training
• • Vendor due diligence & DPAs
• • Backups & incident response procedures

No system is completely secure. If a breach occurs we will act in line with our breach notification obligations (see below).

Our infrastructure and some subprocessors are located outside the European Economic Area (EEA), for example in the United Kingdom, Switzerland or the United States. Where personal data is transferred outside the EEA, we rely on:

• • Adequacy decisions recognised by the European Commission.
• • Standard Contractual Clauses (SCCs) with transfer impact assessments where required.
• • UK International Data Transfer Agreement (IDTA) for UK transfers.
• • Binding Corporate Rules, where applicable to a group entity.

You may request a copy of the safeguards used for a specific transfer by contacting us at the email above.

Under the GDPR and UK GDPR you have the right to:

We may contact you through our app (for example in-product messages or account notifications) and, where you have agreed, through third-party apps or services such as email providers or messaging platforms. We will only contact you for the purposes described in this policy, and you can opt out of non-essential communications at any time by following the unsubscribe link or contacting us.

Marketing communications require your consent and are sent only where you have opted in. You can withdraw consent at any time.

We use cookies and similar technologies (pixels, local storage) to operate the site and, with your consent, to measure usage and improve services.

For more on how Google Analytics handles data, see the Google Privacy Policy.

We work with trusted third-party processors who handle personal data on our behalf. Categories include:

• • Cloud hosting & infrastructure: application hosting and storage.
• • Analytics: usage measurement (e.g. Google Analytics).
• • Communications: email and notification delivery.
• • AI service providers: models used for AI-assisted features.
• • Support & customer service tools.

A current list of subprocessors is maintained and available on request. We engage new processors only after due diligence and require appropriate data protection terms.

We maintain written data processing agreements (Article 28 GDPR) with each subprocessor, defining the subject matter, duration, nature and purpose of processing, the type of data, and the obligations of the processor — including confidentiality, security, sub-processor controls, assistance with data subject requests, breach notification, and return/deletion of data on termination.

We maintain an incident response process to detect, assess and contain personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will also notify you directly with information about the breach and the steps you can take.

Our services are not directed at children. We do not knowingly collect personal data from individuals under the age of digital consent applicable in their country of residence (16 in Ireland, unless a lower age applies locally). If you believe we have collected data from a minor, please contact us and we will delete it.

We may update this policy to reflect changes in our practices, technologies, or legal requirements. The “Effective date” at the top reflects the latest version. Where changes materially affect your rights, we will provide notice through our app or by email. This policy is version-controlled and prior versions are available on request.

Current version effective: 7 August 2026.