Privacy Policy

Effective as of: August 14, 2026

Last updated: August 14, 2026

Table of contents

This Privacy Policy applies to the websites, applications, platform, and other offerings that link to it (together, the “Services”). It sets out how TrialMatrix, Inc. (“TrialMatrix,” “we,” “our,” or “us”) collects, uses, stores, shares, and safeguards personal data, and what rights you have in relation to that data. Please read it carefully.

1. Scope of This Policy

This policy describes how we handle Personal Data we gather when you visit our website, request a demonstration, correspond with us, attend an event we host or sponsor, or register for and use the Services. “Personal Data” means information that identifies, describes, or can reasonably be linked to a particular individual, and includes what applicable privacy laws call “personal information” or “personally identifiable information.”

By using the Services other than as an authorized user of an existing business customer, you acknowledge the practices described here.

This policy does not describe the practices of organizations we do not own or control, including third-party websites and services that the Services may link to. Those organizations operate under their own policies, and you should review them separately.

2. Customer Data and Our Role as a Processor

Our business customers upload files, records, and other content to the Services and instruct us to process that content on their behalf (“Customer Data”). Where we handle Customer Data we act as a processor (or "service provider") for that customer, who acts as the controller (or “business”).

This Privacy Policy does not govern Customer Data. Our handling of Customer Data is governed instead by our agreement with the relevant customer — typically a Master Service Agreement and an accompanying data processing agreement. We process Customer Data only on that customer’s documented instructions and for the purposes they specify.

If you believe your information is contained in Customer Data and you wish to access, correct, or delete it, please contact the organization that uploaded it, as that organization controls how the information is used and retained. If you contact us directly, we will refer your request to that customer and support them in responding, but we are generally not permitted to act on it ourselves.

Further detail on how we protect Customer Data is available at https://www.trialmatrix.ai/security.

3. Personal Data We Collect

3.1 Categories collected

The table below sets out the categories of Personal Data we may collect, examples of each, and the types of recipients with whom we may share it.

Category	Examples	Types of recipients
Identity and profile data	Name; email address; telephone number; postal address; employer; job title; professional role or credentials; contact preferences; account credentials; information supplied to verify identity	Service providers; parties you authorize; your organization, where you register with a work email address
Commercial and billing data	Subscription and plan details; billing contact; billing address; transaction records; partial payment instrument details held by our payment processor	Payment processors; accounting and tax providers; service providers
Marketing and event data	Lead records; campaign responses; engagement metrics; event registrations; content downloads	Service providers; marketing platforms
Usage and analytics data	Pages viewed; features used; session duration; referral source; search and navigation activity; performance and error telemetry	Service providers
Device and network data	IP address; device and browser type; operating system; device identifiers; approximate location inferred from IP address; language settings	Service providers; content delivery networks; security providers
Cookie and tracking data	Cookie identifiers; session and persistent cookie data; pixel and tag data	Service providers; content delivery networks
Support and correspondence data	Messages you send us; support tickets; survey responses; recordings or notes of calls and meetings where you have been notified	Service providers; parties you authorize
Other data you volunteer	Any information you choose to include in free-text fields, emails, forms, or materials you share with us outside the Services	Service providers; parties you authorize

3.2 Where we obtain it

From you. When you complete a form to request a demonstration or further information; create or administer an account; use the Services; enter information into free-text fields; upload material that is not Customer Data; connect a third-party application; contact us by email or through support channels; or attend one of our events.

Automatically. When you use the Services, through cookies, server logs, and similar technologies described in Section 8.

From your organization. When an administrator at a customer organization creates or configures an account on your behalf.

From third parties. Analytics and marketing vendors that help us understand how the Services are used and manage our outreach; support tooling providers; identity and single sign-on providers you choose to authenticate through; and, where lawful, business contact data providers.

4. Why We Collect Personal Data

To provide and administer the Services. Creating and maintaining accounts; authenticating users; provisioning and configuring access; processing subscriptions and payments; delivering the features you request; and providing support.

To operate, secure, and improve the Services. Monitoring availability and performance; diagnosing and fixing faults; conducting internal analytics and research; developing new features; and detecting, preventing, and investigating fraud, abuse, and security incidents.

To communicate with you. Responding to your inquiries; sending administrative, security, and service messages; and, subject to your preferences and applicable law, sending marketing communications about TrialMatrix and the Services. You may opt out of marketing messages at any time using the unsubscribe link or by contacting us.

To market and grow our business. Promoting the Services; measuring the effectiveness of campaigns; and organizing events.

To meet legal and contractual obligations. Complying with applicable law, regulation, subpoena, court order, or other legal process; responding to lawful requests from public authorities; establishing, exercising, or defending legal claims; enforcing our terms and other agreements; and protecting the rights, property, and safety of you, TrialMatrix, our customers, and others.

We will not collect additional categories of Personal Data, or use Personal Data for materially different, unrelated, or incompatible purposes, without first giving you notice and, where the law requires it, obtaining your consent.

5. How We Share Personal Data

We do not sell Personal Data for money or other valuable consideration. We disclose Personal Data to the categories of recipients described below. Depending on which state law applies to you, some of these disclosures may count as a “sale” or “sharing” of Personal Data; see Section 11.

Service providers and sub-processors. Organizations that perform functions on our behalf under contract, including hosting and cloud infrastructure; model and inference providers; customer relationship management and marketing automation platforms; payment processors; analytics vendors; email and communications providers; security, logging, and fraud-prevention services; and professional advisers.

Analytics partners. Vendors that help us understand how visitors find and use the Services.

Parties you authorize. Where you connect a third-party application, authenticate through an identity provider, or direct us to share information, we will disclose Personal Data accordingly.

Your organization. If you register with an email address belonging to an organization that holds an account with us, we may disclose your account and usage information to that organization’s administrators.

Legal and safety disclosures. We may disclose Personal Data where we believe in good faith that doing so is necessary for the purposes described under “To meet legal and contractual obligations” in Section 4.

Corporate transactions. If we are involved in a merger, acquisition, financing, reorganization, insolvency, or sale of all or part of our business, Personal Data may be transferred as part of that transaction. We will use reasonable efforts to notify you before your information becomes subject to a materially different privacy policy.

6. Artificial Intelligence and Model Training

The Services use artificial intelligence and machine learning, including large language models supplied by third-party providers, to generate output.

We do not use Customer Data to train or otherwise develop general-purpose machine learning models, except where a customer has expressly agreed to it in a signed agreement. We may use Customer Data to improve the quality of TrialMatrix’s machine learning models if a customer has expressly agreed to it. When we send Customer Data to a third-party model provider in order to generate output, we contract for terms that prohibit that provider from using the data to train its own models and that require zero data retention.

We may use Personal Data described in Section 3, together with de-identified and aggregated data as described in Section 7, to evaluate output quality, measure and improve system performance, and develop new features.

7. De-Identified and Aggregated Data

We may create aggregated, de-identified, or anonymized data from Personal Data, including by removing or obscuring the elements that make it identifiable. We may use and disclose such data for any lawful business purpose, including analyzing and improving the Services and our models, benchmarking, and describing our business.

Where we hold data in de-identified form, we maintain it in that form, publicly commit not to attempt to re-identify it except to test the effectiveness of our de-identification, and contractually require recipients to observe the same restrictions.

8. Cookies and Similar Technologies

The Services use cookies and comparable technologies — including pixel tags, web beacons, clear GIFs, local storage, and scripts (together, “Cookies”) — to recognize your browser, understand how and when the Services are used, analyze trends, and operate and improve the Services. Cookies are small data files placed on your device when you access the Services. Third parties may also place their own Cookies on your device through the Services.

We use the following categories:

Strictly necessary Cookies, which are required to deliver the Services, including to authenticate you and maintain your session. Disabling these will make parts of the Services unavailable.
Functional Cookies, which record your settings and preferences — such as language or region — and recognize you when you return.
Performance and analytics Cookies, which tell us how many people visit the Services, which pages they view, how long they stay, and how our campaigns perform.

You can manage Cookies through your browser settings, which generally allow you to refuse new Cookies, delete existing ones, or be prompted before a Cookie is set. If you block or delete Cookies, some features may stop working and you may need to reset your preferences on each visit.

Analytics providers. We currently use a third-party analytics provider, Datadog, to measure use of the Services. Information on Datadog’s privacy policies and how to remove or reject Cookies associated with Datadog’s products is located here: https://www.datadoghq.com/legal/cookies/.

Browser privacy signals. We honor the Global Privacy Control and comparable opt-out preference signals where applicable law requires it, treating a valid signal as a request to opt out of the sale or sharing of Personal Data for the browser or device concerned. We do not currently respond to “Do Not Track” browser settings, for which no common standard has been adopted.

9. Security and Retention

We maintain physical, technical, organizational, and administrative safeguards designed to protect Personal Data against unauthorized access, use, alteration, disclosure, and loss, calibrated to the sensitivity of the data and the way it is processed. You also play a part: choose a strong and unique password, protect your credentials, restrict access to your devices, and sign out when you have finished. No method of transmitting or storing data is entirely secure, and we cannot guarantee absolute security.

We retain Personal Data for as long as your account remains open or as needed to provide the Services, and afterwards for as long as necessary to comply with our legal obligations, resolve disputes, recover amounts owed, and enforce our agreements. Notwithstanding the foregoing, if you have a Master Service Agreement with TrialMatrix, we will delete Personal Data in accordance with the terms of your Master Service Agreement.

Once Personal Data is no longer needed for its intended business use or to meet regulatory or contractual requirements, it is securely disposed of. Specific retention periods depend on the category of data and the purpose for which it is held. We may retain de-identified or aggregated data indefinitely.

10. Children’s Data

The Services are intended for business use by adults. Consistent with our Terms of Service, you must be at least 18 years old to use the Services. We do not knowingly collect Personal Data from anyone under 18, and we do not direct the Services to children.

11. Your Privacy Rights

11.1 Rights available under United States state privacy laws

Depending on where you live, you may have the following rights in relation to Personal Data we hold as a controller. These rights do not extend to Customer Data, for which you should contact the relevant customer organization as explained in Section 2.

Access and know. Confirm whether we process your Personal Data and obtain a copy, together with details of the categories collected, the sources, the purposes, and the categories of recipients.
Correct. Ask us to correct inaccurate Personal Data.
Delete. Ask us to delete Personal Data, subject to the exceptions the law allows.
Portability. Receive a copy in a portable and, where technically feasible, readily usable format.
Opt out. Opt out of the sale or sharing of Personal Data and of targeted advertising, and of profiling that produces legal or similarly significant effects.
Limit sensitive data. Where applicable, limit our use and disclosure of sensitive Personal Data to the purposes the law permits.
Non-discrimination. Not be treated less favorably for exercising any of these rights.
Appeal. Where your state provides for it, appeal a decision we make about your request. We will respond to an appeal within the period the law prescribes and tell you how to escalate to your state Attorney General if you remain dissatisfied.

11.2 How to exercise your rights

Submit a request by emailing privacy@trialmatrix.ai. We will need to verify your identity before we act, and may ask for information sufficient to match you to our records; we use that information only to process the request. An authorized agent may submit a request on your behalf with written authorization, and we may still contact you to confirm. We respond within the timeframes set by applicable law.

11.3 California “Shine the Light”

California Civil Code section 1798.83 allows California residents to request, once a year and free of charge, details of the categories of personal information we disclosed to third parties for those parties’ own direct marketing purposes during the preceding calendar year, along with the names and addresses of those third parties. California residents may also ask us not to make such disclosures. Send requests to privacy@trialmatrix.ai.

11.4 Nevada residents

Nevada residents may direct us not to sell certain personal information to third parties who intend to license or resell it. Email privacy@trialmatrix.ai with the subject line “Nevada Do Not Sell Request,” including your name and the email address associated with your account.

11.5 Our commitments when acting as a processor

Where we process Personal Data as a processor or service provider for a customer — including under the California Consumer Privacy Act, Colorado Privacy Act, the Connecticut Data Privacy Act, the Montana Consumer Data Privacy Act, the Oregon Consumer Privacy Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act — we will:

bind each person authorized to process the data to a duty of confidentiality;
process the data only on the customer’s documented instructions, and require the customer to ensure those instructions comply with applicable law;
delete or return the data at the end of the engagement as the customer directs, unless the law requires us to retain it;
on reasonable request, make available the information necessary to demonstrate our compliance with the obligations these laws impose on processors;
permit and cooperate with reasonable assessments by the customer or its designated assessor, or alternatively arrange an independent assessment against a recognized control framework and share the report on request;
engage sub-processors only under a written contract imposing equivalent obligations, implement security measures appropriate to the risk with a clear allocation of responsibility, and give the customer the opportunity to object to a proposed sub-processor;
assist the customer, taking into account the nature of the processing, in responding to data subject requests and in meeting its obligations regarding security, breach notification, and data protection assessments.

12. Changes to This Policy

We may update this Privacy Policy as the Services develop and as legal requirements change. When we do, we will revise the effective date at the top of the page. If the changes are material, we will provide additional notice — by posting a prominent notice on our website, by email, or by other appropriate means — before those changes take effect. If you have chosen not to receive legal notices by email, or have not given us an email address, those changes will still govern your use of the Services and you remain responsible for reading them. Personal Data is handled under the version of this policy in force when it was collected.

13. How to Contact Us

If you have questions or comments about this Privacy Policy, how we handle Personal Data, or your rights, please contact us:

TrialMatrix, Inc.

505 Montgomery St.

San Francisco, CA 94111

United States

Email: privacy@trialmatrix.ai