Last updated: 1 October 2026.
1. Who we are
Trialight Ltd is the data controller for the processing described here. To ask a question, exercise a right or submit a complaint, contact privacy@trialight.com.
This policy covers customers, users, marketing contacts, and professionals named in public sources used by our clinical-trial and biomedical intelligence service.
2. Customers and service users
| Data categories | Why we use it and lawful basis | How long we keep it |
|---|---|---|
| Name, work email, organisation, role, sign-in, credit purchases, and billing contact | Create, secure, support, meter, and bill your account. Contract; legal obligation for tax records; legitimate interests for security and abuse prevention | Account lifetime plus 90 days. Tax and billing records about 6 years |
| Searches, instructions, saved work, interactions with Trialight Agent, and other workspace content | Provide and improve the Service. Contract and legitimate interests | Workspace lifetime plus 90 days |
| Trialight Agent interactions you allow us to use to improve it, and your ratings of its replies | Improve Trialight Agent. Legitimate interests | While we need them to improve Trialight Agent; deleted sooner if you ask |
| Marketing details and choices | Manage your interest in Trialight. Send marketing only with consent | While your interest or subscription remains active; suppression record after opt-out |
| Internet protocol address, browser, device, access, and security logs | Operate and protect the service, prevent abuse, and check seat use. Legitimate interests | According to operational need; security and incident records up to 7 years |
| Content-free product usage, such as action, time, outcome, count, or latency band | Operate and improve the service. Legitimate interests | Up to 13 months |
| Public pageviews and approved product events under random identifiers | External analytics, only after you consent | Until consent is withdrawn, a rights request applies, or the provider's limit is reached |
| Emails and support messages | Answer you, deliver service messages, and keep evidence of delivery or opt-out. Contract and legitimate interests | While needed for the relationship, dispute, or suppression purpose |
Account details are a contractual requirement; without them we cannot open an account.
Your right to object: Where this table says legitimate interests, you may object at any time by emailing privacy@trialight.com.
Stripe handles card payments; we do not store full card numbers.
We do not sell personal data or disclose one customer's research to another.
3. Public professional data
This section is the UK General Data Protection Regulation Article 14 notice for people whose data we did not collect directly.
| Data categories | Public sources | Purpose and lawful basis | Recipients | Retention |
|---|---|---|---|---|
| Name, professional affiliation, ORCID, authorship, conference presentation, or public trial-sponsor role | PubMed, Europe PMC, conference proceedings, and public trial registries | Link professional activity to source-backed drug and trial intelligence. Legitimate interests | Signed-in Trialight users and the providers needed to run the service | Kept as a historical professional record; reviewed annually; removed if the source is withdrawn or we uphold an objection |
Our legitimate interest is providing source-linked professional intelligence. We do not collect or infer special-category data for this purpose.
We:
- keep structured professional facts and source links, not contact details or whole pages;
- strip trial-investigator and registry-contact details when collecting data;
- do not use the data to contact you;
- do not create artificial-intelligence-written judgements about you; and
- honour valid objections and prevent removed data returning.
We do not contact each person individually because the records concern thousands of professionals with whom we have no relationship. Doing so would involve disproportionate effort. We publish this notice under Article 14(5)(e) and provide it directly to anyone who contacts us.
Your right to object: You may object at any time to our legitimate-interest processing by emailing privacy@trialight.com. We will remove or suppress the data unless we have compelling legal grounds to continue, and we will explain our decision.
4. Cookies and artificial intelligence
We use cookies and similar browser storage to run the product and, with your consent, to understand how it is used. Essential cookies keep you signed in, keep the site secure and remember your cookie choice. Analytics cookies are used to learn how you use the platform to make it better for everyone. Refusing is as easy as accepting. Change your mind any time in the product settings under Privacy, or through Privacy choices at the bottom of the website.
The Service uses model providers to extract facts or act on text you submit. When you ask Trialight Agent a question, we send your question, and the facts or column names on your screen, to a model provider with storage switched off. When you use Data Lookup, we send your question and the name of the record or column to a retrieval provider. Our Subprocessors page identifies these providers. If you allow it in Settings, we use your interactions with Trialight Agent to improve the Trialight Agent experience. Your organisation's administrator can turn this off for everyone.
5. Sharing, transfers, and security
We use providers for hosting, authentication, payments, email, monitoring, analytics, model processing, and retrieval. The Subprocessors register names those providers and explains what they do.
We transfer personal data outside the United Kingdom only under an adequacy regulation, the International Data Transfer Agreement, or the United Kingdom Addendum. Copies are available on request.
We limit access, encrypt data in transit and at rest, keep backups, and follow an incident-response process. Backups are purged on a fixed schedule after deletion.
6. Your rights and complaints
Depending on the law and our reason for processing, you may ask us to:
- give you a copy of your data;
- correct, erase, or restrict it;
- provide eligible data in a portable format;
- object to legitimate-interest processing; or
- withdraw consent at any time.
Email privacy@trialight.com. We normally respond within one month and may need to verify your identity. Rights can have legal limits, which we will explain. Withdrawing consent does not affect earlier lawful processing.
You can complain to us at that address or to the Information Commissioner's Office. If you are in the European Economic Area, you may complain to your local authority.
We update this policy when our processing changes.
Company and contact
Trialight Ltd is registered in England and Wales under company number 17081917. Its registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
Questions about this policy and requests to exercise privacy rights should be sent to privacy@trialight.com.