Version 1.1 - August 6, 2026

1. Overview

This Privacy Policy explains how Durandal Labs collects, uses, stores, and shares personal data in connection with Trialant, including our website, application, and related services.

We process personal data in accordance with applicable Swiss data protection law and, where applicable, the EU General Data Protection Regulation ("GDPR"). This Privacy Policy does not apply to third-party websites, products, or services that are not operated by us, even if they are linked from our service.

2. Controller

The controller responsible for processing personal data under this Privacy Policy is Durandal Labs.

You can contact us about privacy matters at Trialant Privacy.

3. Personal Data We Collect

We may collect the following categories of personal data:

  • Account and profile information: such as your name, work email address, organisation, password hash, role, and account preferences.
  • Service usage data: such as searches, filters, saved views, alerts, watchlists, exports, clicks, page views, navigation paths, login events, feature usage, and related timestamps.
  • Product analytics and diagnostics data: such as events and interactions captured to understand how the product is used, error and exception details, and performance signals.
  • Communications: such as information you provide when you contact us, request a demo, ask for support, or otherwise correspond with us.
  • Technical data: such as IP address, browser type, device information, operating system, referring pages, URLs visited within the service, approximate location derived from network information where collected, and log data generated when you access our website or application.
  • Billing and commercial data: such as subscription plan, invoices, payment status, and business contact details when you purchase paid services.
  • Customer content: such as notes, labels, saved records, team workspace content, and other information submitted to or generated within Trialant.

4. How We Collect Personal Data

We collect personal data in several ways:

  • directly from you when you register, log in, or contact us;
  • automatically through your use of Trialant, including logs, necessary cookies or similar technologies used to operate the service, and our cookieless product analytics tooling;
  • from your organisation or teammates, for example when an account is provisioned for you under a team subscription; and
  • from third-party service providers involved in authentication, payments, analytics, hosting, support, or communications.

We may also ingest and structure publicly available study data from sources such as ClinicalTrials.gov. While those datasets may contain information relating to investigators, sponsors, or other identified persons, we do not control the original source records.

5. Why We Process Personal Data

We process personal data only where we have a valid legal basis, including performance of a contract, compliance with legal obligations, legitimate interests, or your consent where required.

In particular, we use personal data to:

  • provide, operate, secure, and maintain Trialant;
  • authenticate users, manage accounts, and administer team access;
  • enable features such as saved searches, alerts, exports, and collaboration workflows;
  • respond to requests, provide customer support, and communicate about the service;
  • process billing, invoicing, and related administration;
  • analyse product usage, diagnose errors, investigate abuse, detect fraud, and improve reliability, performance, and product quality;
  • comply with legal, regulatory, accounting, and contractual obligations; and
  • send product updates or marketing communications where permitted by law or based on your consent.

6. Cookies and Similar Technologies

We may use cookies and similar technologies (including local storage) that are necessary to keep you signed in, remember preferences, protect the service, and ensure the website or application functions properly.

Our product analytics tooling is configured in a cookieless mode and does not set analytics cookies or use local or session storage to recognise returning browsers, maintain analytics sessions, or link analytics events to your account.

You can also control cookies through your browser settings. Blocking necessary cookies may affect the availability or functionality of parts of the service, such as remaining signed in.

7. Product Analytics

We use PostHog, operated by PostHog Inc., as a product analytics and error-tracking provider. We use PostHog Cloud EU, with processing in the European Economic Area. Analytics requests from the browser may be routed through our own domain as a first-party proxy before they reach PostHog.

PostHog is configured for cookieless tracking. In this mode, PostHog does not store analytics identifiers in cookies or browser storage, and we do not associate analytics events with your account identifiers (such as user ID, email address, or name). PostHog may process usage events, page views, clicks and other interface interactions, technical and device information, and error details. To support privacy-preserving audience measurement, PostHog may briefly use technical information such as IP address and user agent on its servers to generate a temporary hash that is not stored as a cookie in your browser.

We do not currently use session replay. If we enable session replay or other cookie-based analytics features in the future, we will update this Privacy Policy and, where required by applicable law, provide appropriate notice and controls.

If you object to analytics processing, contact us at Trialant Privacy. Where processing relies on consent, you may withdraw that consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8. Disclosure of Personal Data

We may share personal data with the following categories of recipients:

  • service providers who help us deliver the service, such as hosting, infrastructure, authentication, analytics, communications, and payment providers;
  • PostHog Inc., which processes product analytics and error-tracking data on our behalf as a processor, using PostHog Cloud EU;
  • professional advisers such as lawyers, auditors, insurers, and accountants, where necessary;
  • competent authorities, courts, regulators, or counterparties where disclosure is required by law or reasonably necessary to protect rights, safety, or the integrity of the service; and
  • a purchaser, successor, or affiliate in connection with a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate confidentiality measures.

We do not sell your personal data.

9. International Transfers

Our service providers or affiliates may process personal data in countries outside Switzerland or the European Economic Area. Where required, we take appropriate steps to ensure an adequate level of protection, for example by relying on contractual safeguards or another recognised transfer mechanism.

Product analytics and related processing through PostHog Cloud EU is carried out in the European Economic Area. Other providers we use for hosting, authentication, payments, or communications may process data in additional jurisdictions, subject to the safeguards described above.

10. Data Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access. These measures may include access controls, encryption in transit, logging, backups, and environment-level security safeguards.

No system is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your credentials and for using the service in a secure manner.

11. Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the service, maintain business and financial records, resolve disputes, enforce agreements, and comply with legal obligations.

Retention periods vary depending on the type of data and context. For example, account data is generally retained while your account is active, service logs and analytics data are typically retained for a limited period needed for security, operational, and product improvement purposes, and billing records may be retained longer to satisfy legal or tax requirements.

12. Your Rights

Subject to applicable law, you may have the right to request access to your personal data, request correction of inaccurate data, request deletion, request restriction of processing, object to certain processing, withdraw consent where processing is based on consent, and request data portability.

To exercise these rights, contact us at Trialant Privacy. We may request information necessary to verify your identity before responding. You may also have the right to lodge a complaint with the competent supervisory authority, including the Swiss Federal Data Protection and Information Commissioner where applicable.

13. Children

Trialant is intended for business and professional use and is not directed to children. We do not knowingly collect personal data from children in connection with the service.

14. Third-Party Links and Source Data

The service may link to third-party websites or reference data from external sources, including ClinicalTrials.gov. We are not responsible for the privacy practices, content, or data handling of those third parties. We encourage you to review their applicable terms and privacy notices.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will post the updated version on this page and revise the version date above. The updated Privacy Policy will apply from its effective date, and we will provide additional notice where required by applicable law.

16. Related Terms

Your use of Trialant is also governed by our Terms of Service.