01 Who we are
Oliver Rymond, operating as "ComplyRx" ("we", "our", or "us"), is the data controller for personal information collected through complyrx.io.
Contact: support@complyrx.io
A postal contact address is available on request.
02 What we collect
Account details: the email address you sign in with. Sign-in is passwordless, so there is no password to store. If you sign in with Google, Google tells us the email address and name on your Google account and we store those.
Your watchlist: the drugs and trials you choose to track, and settings connected to them.
ComplyRx Agent chats: the requests you type to the Agent, its replies and a record of each run, kept against your account or, if you are not signed in, an anonymous browser id. For visitors who are not signed in we also keep a keyed hash of your IP address to enforce the free limit.
Billing status: whether you have a trial or paid membership and its dates. Payments are processed by Stripe; we never see or store your card details.
Email records: which service emails we sent you and your email preferences, including unsubscribe choices.
Support messages: what you send us when you get in touch.
Waitlist: the email address you submit if you join a waitlist.
Usage analytics: privacy-friendly product analytics, only if you accept analytics cookies. See section 11.
Marketing measurement: if you accept marketing cookies, a Google Ads tag records two events (creating an account and starting a trial) so we can measure our own adverts. See sections 10 and 11.
Technical logs: your IP address is used to rate-limit requests and is not stored as such. For the free search and Agent limits we store a keyed hash of it: for searches it is deleted after about a day, for Agent usage it is kept with the usage record (see section 7).
Error reports: if something breaks, a report of the error is sent to our error-reporting provider so we can fix it. It can include the page you were on, your browser details and technical details of the request. It does not include your name or email address.
The clinical trial information shown in the product comes from public registries (such as ClinicalTrials.gov). It is information about trials, not personal information about you.
03 Why we use it, and our lawful bases
Running the service (accounts, sign-in emails, your watchlist, daily briefs and change alerts, billing): performance of a contract.
The ComplyRx Agent: performance of a contract for members, and our legitimate interests in letting visitors try it before they sign up.
Service updates after your trial ends (what changed on your saved watchlist) and occasional ComplyRx product updates: legitimate interests. We tell you about this when you sign up, every such email has a working unsubscribe, and watchlist updates stop automatically 30 days after your access ends.
Payments and tax records: performance of a contract and legal obligation.
Analytics and marketing measurement: consent, via the cookie banner.
Security, reliability and abuse prevention (including rate limits and error reports): legitimate interests.
04 Emails we send
Sign-in and account emails are service messages. Product emails (welcome, the daily brief, trial notices, watchlist updates) each carry a one-click unsubscribe, and you can switch streams off independently. We do not send third-party advertising, and we do not sell your data.
We send from the domain info.complyrx.io; replies go to support@complyrx.io, which we read.
06 International data transfers
Your core account data is stored in the UK or EU and analytics stay in the EU. Some of our providers may process limited data outside the UK and EU, including in the United States. Where that happens it is covered by appropriate safeguards under those providers' standard data-protection terms (such as Standard Contractual Clauses and the UK Addendum).
07 How long we keep it
Account and watchlist data: while your account exists. You can request deletion at any time.
ComplyRx Agent chats and usage records: kept until you ask us to delete them. They are not yet removed automatically when an account is deleted, and we do not yet apply a fixed deletion period to them. We will update this notice when we do.
Search limit records: about one day.
Billing records: as long as tax law requires (typically 6 years).
Email preferences and unsubscribe records: kept so we can honour them.
Waitlist emails: until you ask to be removed or the waitlist is no longer needed.
Error reports: deleted automatically by the error-reporting provider after a limited period.
08 AI-generated content
Some summaries and insights in the product are generated with AI from public registry content and our recorded change history. That processing is about trials, not about you; AI output is a regenerable layer on top of the source data, never a replacement for it. If you use the ComplyRx Agent, what you type is processed to answer you, as described in sections 2 and 5.
09 Your rights
Under the UK and EU GDPR you have the right to:
- Access: request a copy of your personal data
- Correction: ask us to correct inaccurate data
- Deletion: ask us to delete your data
- Restriction: ask us to limit how we use it
- Portability: receive your data in a machine-readable format
- Objection: object to our processing based on legitimate interests, including any direct marketing
To exercise any of these, email support@complyrx.io.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk (or your local EU supervisory authority).
10 US state privacy rights
If you live in California or another US state with a consumer privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and a growing list of others), you have rights over your personal information. Because we run the same privacy-respecting way for everyone, the most important protections are already how we operate:
We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising (as those terms are defined under US state privacy laws). We run no advertising networks. The only advertising-related tag on the site is a Google Ads conversion tag that loads only if you accept marketing cookies; it records whether an account was created or a trial started so we can measure our own adverts, and we do not use it to build a profile of you.
We do not use your data for targeted advertising.
We do not carry out profiling that produces legal or similarly significant effects about you.
Depending on your state, you may also have the right to:
- Know / access the personal information we hold about you
- Correct inaccurate personal information
- Delete your personal information
- Opt out of any sale, sharing for cross-context advertising, or targeted advertising (as noted above, we do none of these)
- Not be discriminated against for exercising these rights
To exercise any of these, email support@complyrx.io. We verify the request against your account and respond within the timeframe your state law requires. Where your state allows, you may use an authorised agent; we may ask them to prove their authority.
The clinical trial information shown in the product is public registry data about trials, not personal information about you, so it is not covered by these rights.
12 Changes to this notice
We may update this notice from time to time. The "Last updated" date at the top shows the latest version; for material changes we will tell account holders by email.
13 Contact
For any privacy questions or requests, contact us at: