GDPR & Data Processing

• Data Controller: ClinStudy determines the purposes and means of processing your account and platform data.
• Data Processors: Vetted service providers (hosting, email, payments, analytics) process data on our documented instructions under data processing agreements.
• Contact: Data Protection questions can be sent to privacy@clinstudy.com.

• Contract: to create your account and provide the services you request.
• Legitimate interests: to operate, secure, and improve the platform, balanced against your rights.
• Consent: for optional communications and any processing that specifically asks for it. Consent can be withdrawn at any time.
• Legal obligation: to meet record-keeping, tax, and compliance requirements.

Subject to applicable law, you may exercise the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. To make a request, email privacy@clinstudy.com. We aim to respond within 30 days and you may lodge a complaint with your local supervisory authority.

Where personal data is transferred outside the EEA or UK, we rely on recognized safeguards such as the European Commission Standard Contractual Clauses and equivalent UK mechanisms.

We apply technical and organizational measures including encryption in transit and at rest, access controls, and audit logging. Personal data is retained only as long as needed for the purposes above or as required by law, then deleted or anonymized.