Privacy Policy

This policy covers information we collect about you — a visitor to getaccrual.co.uk, someone who requests access, or a named user at a customer institution. It is about business contact data and website analytics.

It is not about patient data. Patient identifiable data that a site makes available to Accrual is handled under an Article 28 data processing agreement and the separate Patient Data notice, and is never governed by this policy. Where the two documents appear to conflict on patient information, the Patient Data notice and the executed DPA control.

Information you give us. When you submit an access request we collect your name, work email address, organisation, role, organisation type, and whatever you write in the free-text field. Where you tell us your EPR system or study volume, we collect that too.

Information we collect automatically. Standard server logs (IP address, user agent, requested path, timestamp) and privacy-preserving page analytics. We do not run advertising trackers, and we do not sell or share data for cross-context behavioural advertising.

Information from your employer. If your institution becomes a customer, we receive the account details needed to provision your login — typically name, work email, role, and site affiliation.

• To evaluate and respond to your access request.
• To provide, secure and support the Accrual service for your institution.
• To meet legal, regulatory and contractual obligations, including audit and record-keeping duties that attach to clinical research infrastructure.
• To understand which parts of this website are useful, in aggregate.

We rely on legitimate interests for business-contact processing, contract performance for service provision, and legal obligation where retention is mandated. Where consent is the basis — non-essential analytics cookies, which the Privacy and Electronic Communications Regulations require us to ask about — you may withdraw it at any time without affecting prior processing.

Service providers who process on our behalf under written terms: hosting, error monitoring, email delivery, and customer relationship management. Each is bound to confidentiality and to processing only on our instructions. The current list is published on the Subprocessors page.

Regulators, auditors and legal counsel where we are compelled or where a customer's own regulatory obligation requires it.

An acquirer, in the event of a merger, acquisition or asset sale — with notice to you, and with this policy continuing to apply until superseded.

We do not sell personal data, and we have not done so at any point.

We are a UK business and the UK is our default place of processing. Where personal data would leave the UK we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy regulation, together with a transfer risk assessment.

Customers with UK-only or EEA-only data-residency obligations should raise them during contracting; regional hosting arrangements are agreed in the order form rather than assumed here.

Access requests that do not become accounts: 24 months, then deleted.

Account and contact records: for the life of the customer relationship, plus the period required by our contractual and statutory retention duties.

Server logs: 90 days in hot storage.

Records relating to clinical research activity may be subject to substantially longer retention under applicable regulation, and those periods override the above.

Under the UK GDPR you have the right to access, rectify, erase, port, restrict or object to our processing of your personal data, and to withdraw consent where consent is the basis. Rights under other regimes apply where their law reaches you.

Write to privacy@getaccrual.co.uk and we will respond within one month, extendable by two further months where the request is complex. We will ask you to verify your identity before we act. If you are not satisfied with our answer, you may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

If your request concerns patient information held on behalf of a site, we will route it to that site, which is the controller of that data. We cannot action it directly.

Encryption in transit and at rest, role-based access control, least-privilege internal access, audit logging, and background checks for personnel with production access. Our current security posture and its limits are described in full on the Security page.

No system is perfectly secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and notify you directly where the risk to you is high.

Accrual uses artificial intelligence, including language models, to read clinical records against trial eligibility criteria. Where that processing touches patient information it is governed by the Patient Data notice and the executed data processing agreement, not by this policy.

No decision producing a legal or similarly significant effect about any individual is made solely by automated means. The system produces a cited shortlist for clinical staff; eligibility is determined by an investigator. Your rights under Article 22 of the UK GDPR apply in any event, and you may contact us to exercise them.

Personal information collected through this website is not used to train any model.

This website is directed at professionals and is not intended for anyone under 18. We do not knowingly collect personal data from children through it. Paediatric trial data reaching the platform is patient information under the data processing agreement, not website data under this policy.

We will post any material change here and update the effective date. Where the change is significant and we hold your contact details, we will tell you directly.

Accrual — privacy@getaccrual.co.uk. Our registered office, company number, ICO registration number and the identity of our data protection officer will be listed here once the entity details are finalised.