This notice explains how we handle your information when you use ComplyRx: the Trial Tracker, the free pipeline tools, and the waitlist. Plain English throughout; your rights are in sections 9 and 10.
1. Who we are
Oliver Rymond, operating as “ComplyRx” (“we”, “our”, or “us”), is the data controller for personal information collected through complyrx.io.
Contact: support@complyrx.io
A postal contact address is available on request.
2. What we collect
- Account details: the email address you sign in with. Sign-in is passwordless, so there is no password to store.
- Your watchlist: the drugs and trials you choose to track, and settings connected to them.
- Billing status: whether you have a trial or paid membership and its dates. Payments are processed by Stripe; we never see or store your card details.
- Email records: which service emails we sent you and your email preferences, including unsubscribe choices.
- Support messages: what you send us when you get in touch.
- Waitlist: the email address you submit if you join a waitlist.
- Usage analytics: privacy-friendly product analytics, only if you accept analytics cookies. See section 10.
- Technical logs: standard request data (such as IP address) used for security and rate-limiting, kept briefly.
The clinical trial information shown in the product comes from public registries (such as ClinicalTrials.gov). It is information about trials, not personal information about you.
3. Why we use it, and our lawful bases
- Running the service (accounts, sign-in emails, your watchlist, daily briefs and change alerts, billing): performance of a contract.
- Service updates after your trial ends (what changed on your saved watchlist) and occasional ComplyRx product updates: legitimate interests. We tell you about this when you sign up, every such email has a working unsubscribe, and watchlist updates stop automatically 30 days after your access ends.
- Payments and tax records: performance of a contract and legal obligation.
- Analytics: consent, via the cookie banner.
- Security and abuse prevention: legitimate interests.
4. Emails we send
Sign-in and account emails are service messages. Product emails (welcome, the daily brief, trial notices, watchlist updates) each carry a one-click unsubscribe, and you can switch streams off independently. We do not send third-party advertising, and we do not sell your data.
We send from the domain info.complyrx.io; replies go to support@complyrx.io, which we read.
5. Who we share it with
Service providers (processors) under data-processing agreements:
- Supabase – database and sign-in (hosted in the EU, London region)
- Vercel – website hosting and delivery
- Fly.io – runs the nightly registry checks and email scheduling
- Upstash – background job queue
- Stripe – payments and billing
- Resend – email delivery
- PostHog – product analytics (EU-hosted), loaded only if you accept analytics cookies
- Anthropic – generates AI summaries from public clinical-registry content shown in the product; we do not send it your account details
6. International data transfers
Your core account data is stored in the EU (Supabase, London) and analytics stay in the EU (PostHog). Some providers (such as Stripe, Resend, Vercel, Fly.io and Upstash) may process limited data outside the UK and EU; where that happens it is covered by appropriate safeguards under those providers’ standard data-protection terms (such as Standard Contractual Clauses and the UK Addendum).
7. How long we keep it
- Account and watchlist data: while your account exists. You can request deletion at any time.
- Billing records: as long as tax law requires (typically 6 years).
- Email preferences and unsubscribe records: kept so we can honour them.
- Waitlist emails: until you ask to be removed or the waitlist is no longer needed.
8. AI-generated content
Some summaries and insights in the product are generated with AI from public registry content and our recorded change history. This processing is about trials, not about you; AI output is a regenerable layer on top of the source data, never a replacement for it.
9. Your rights
Under the UK and EU GDPR you have the right to:
- Access: request a copy of your personal data
- Correction: ask us to correct inaccurate data
- Deletion: ask us to delete your data
- Restriction: ask us to limit how we use it
- Portability: receive your data in a machine-readable format
- Objection: object to our processing based on legitimate interests, including any direct marketing
To exercise any of these, email support@complyrx.io.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk (or your local EU supervisory authority).
10. US state privacy rights
If you live in California or another US state with a consumer privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and a growing list of others), you have rights over your personal information. Because we run the same privacy-respecting way for everyone, the most important protections are already how we operate:
- We do not sell your personal information, and we do not “share” it for cross-context behavioural advertising (as those terms are defined under US state privacy laws). We run no advertising networks and no advertising cookies.
- We do not use your data for targeted advertising.
- We do not carry out profiling that produces legal or similarly significant effects about you.
Depending on your state, you may also have the right to:
- Know / access the personal information we hold about you
- Correct inaccurate personal information
- Delete your personal information
- Opt out of any sale, sharing for cross-context advertising, or targeted advertising (as noted above, we do none of these)
- Not be discriminated against for exercising these rights
To exercise any of these, email support@complyrx.io. We verify the request against your account and respond within the timeframe your state law requires. Where your state allows, you may use an authorised agent; we may ask them to prove their authority.
The clinical trial information shown in the product is public registry data about trials, not personal information about you, so it is not covered by these rights.
11. Cookies
We use essential cookies needed to run the site (including sign-in and remembering your cookie choice). Non-essential analytics cookies (PostHog) load only if you accept them via our cookie banner.
You can change your choice at any time. For details, see our Cookie Policy.
12. Changes to this notice
We may update this notice from time to time. The “Last updated” date at the top shows the latest version; for material changes we will tell account holders by email.
13. Contact
For any privacy questions or requests, contact us at:
Email: support@complyrx.io