Privacy Policy

Last updated: September 1, 2026

Overview

ClinTrialFinder is a clinical trial search tool. We are committed to transparency about how your data is handled. This policy explains what data we collect, what third parties we share it with, how long we keep it, and what you can do about it.

What Data We Collect

When you use ClinTrialFinder, we collect:

• Condition description — the free-text and structured wizard fields describing your medical condition (disease, staging, biomarkers, prior treatments, comorbidities). Used to search and rank clinical trials relevant to your situation.
• Country and state/province (optional) — if you provide them, used to filter trial locations. Country is required to run the search; state is only asked for large countries where it narrows the trial pool.
• Email address (optional) — if you provide it, used solely to notify you when your results are ready. We send one notification email per search. We do not use your email for marketing or any other purpose. You can complete a search without giving us an email.
• Anonymous session cookie — a randomly generated identifier (not linked to your identity) used to associate you with your in-progress task and let you return to your results page.
• Server access logs — IP address, page path, and timestamp, used for security and rate limiting. Kept for 14 days.
• Application logs — operational logs of the matching pipeline (which may include your input length, extracted disease names, processing timings). Kept for 14 days via the system journal.

What Data We Do NOT Collect

We do not use third-party analytics, advertising trackers, or profiling tools. We do not ask for your name, date of birth, address, government ID, or any other direct identifier beyond an optional email.

How Your Data Is Used

Your submission is used to (a) find and rank clinical trials for your search, and (b) help us improve the matching tool through internal quality reviews and analysis. To do (a), your condition description is sent to third-party AI services for processing. To do (b), we keep the de-identified clinical narrative (see "How Long We Keep It" below) so we can inspect matcher performance on real cases and identify defects — for example, checking whether a rare-cancer patient was matched against the right trials, or whether a specific biomarker was correctly parsed.

We do not sell, rent, or trade your data. We do not use your data for advertising or profiling. When your data is inspected for internal quality review, only the clinical narrative is used — direct identifiers like your email are aged out on the schedule below.

Third-Party Processors

To operate the matching pipeline and email notifications, your data is sent to the following third-party services. Each receives different information:

• OpenAI — receives your submitted condition description to extract diseases, evaluate trial eligibility, and generate suitability scores. Retention is governed by OpenAI's Privacy Policy.
• Anthropic (Claude) — receives your submitted condition description for quality-checking, diagnostic analysis, and matching-accuracy improvement. Retention is governed by Anthropic's Privacy Policy.
• Mailgun — receives your email address (if you provided one) and the notification message when your results are ready. Used only for email delivery. Retention is governed by Mailgun's Privacy Policy.

How Long We Keep It

• Clinical narrative and search results — kept indefinitely so we can review real cases to improve the matching tool. Only the narrative (no direct identifiers) is used for these reviews.
• Email address — automatically removed 14 days after the search runs. You cannot request its return once it's removed; enter it again if you want a new notification for a new search.
• Country and state — kept alongside the clinical narrative because they're a load-bearing part of what makes a trial relevant to a patient.
• Server access logs and application logs — 14 days, then permanently deleted.
• Session cookie — 30-day browser expiry. Contains no personal information.

Your Rights

Hide your results page. Every completion email carries a "Hide it here" link, and every results page (for submissions with no captured email) shows a "Hide my results page" affordance. Clicking it makes the results page inaccessible via its URL — anyone visiting /results/<your-id>, including you, will see a "results hidden" message instead of your trial matches. This protects against the results-page URL being shared, forwarded, or screenshot-leaked. Your underlying submission is kept in our records so we can continue improving the tool.

Delete your data fully. "Hide" removes URL access but not the underlying record. If you want your clinical narrative and any linked data actually removed from our records — beyond just hiding the URL — email us at chncwang@gmail.com with the URL of your results page (or the notification email you received), and we'll delete the row from our database. This satisfies your right of erasure under GDPR Article 17 and comparable rights under other privacy regimes.

Ask what we have on you. Same email address. Provide the URL of your results page (or the notification email) and we'll send you what's in the row.

Consent

Before you submit a search, the wizard shows a checkbox asking you to agree to this policy and to the processing of your submission by OpenAI. Ticking the checkbox is required to submit; we record the time you consented alongside your submission.

Cookies

We use a single cookie:

• session_id — an anonymous, randomly generated identifier with a 30-day expiry. Used solely to associate you with your in-progress or completed task so you can return to view results. Contains no personal information.

Data Sharing

We do not sell, share, or distribute your data to any party beyond the third-party processors listed above. No advertising, marketing, or profiling takes place.

Children's Privacy

ClinTrialFinder is not directed at individuals under the age of 18. We do not knowingly collect data from minors. If a caregiver enters a search on behalf of a minor patient, we treat the submission as originating from the caregiver.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected on this page with an updated date. Material changes (new data collection, new third-party processor, expanded retention) will be summarized at the top of this policy for at least 30 days after they take effect.

Contact

If you have questions about this privacy policy, want to exercise your rights, or want to report a concern, contact us at chncwang@gmail.com.