Privacy Policy

Who this policy comes from

Trial Path runs the screening questionnaires on trialpath.app and decides what happens to the answers submitted through them.

What it covers, and what it does not

It covers this website, the four screening questionnaires on it, and the email we send you about an application.

It stops where the trial begins. Once a study team contacts you and you go on to a screening visit or enrol, that study’s own consent forms and privacy notices take over, and you will be given them to read and sign. A screening form on this site is not a consent form.

What you give us

Every questionnaire asks for the same three things:

• Contact details — an email address and a phone number.
• Basic details — age, sex, height and weight. We calculate a BMI from the last two and store that alongside them.
• Health answers for the trial you are applying to — these differ by trial, and are listed below.

Weight Loss Trials

History of pancreatitis, gall bladder stones, hypertension and diabetes; and a set of mental health questions — history of mental illness, major depressive disorder, bipolar disorder, schizophrenia, serious anxiety and attention disorders.

Alzheimer’s Trials

Whether you are 65 or older, and any history of dementia.

HSV 1&2 Vaccines Trials

Your HSV status, how often you get outbreaks, whether you take antivirals, whether you are immunosuppressed, whether you have taken part in a previous trial, and whether you are pregnant.

Flu Vaccine

Asthma and recent exacerbations, COPD, oxygen therapy, smoking status, cardiovascular disease, heart attack, heart failure, previous flu vaccination, anaphylaxis, Guillain-Barré syndrome, and whether you are immunosuppressed.

These answers are health information, and we treat them as confidential throughout.

The forms never ask for your name, your home address, a Social Security or other government ID number, insurance details, or any payment information. There is no field on this site that could collect them.

What the website records on its own

When a form is submitted, the server also writes down:

• A keyed hash of your IP address — not the address itself. The address is put through a one-way function with a secret key and only the result is stored, so anyone reading our database cannot tell which address an application came from. We use it to count submissions from the same source and shut down automated abuse.
• Your browser’s user-agent string — the short line a browser sends identifying itself and its operating system, cut off at 250 characters.
• The date and time the application arrived.

Cookies and tracking

The public pages of this site set no cookies at all, and carry no analytics, advertising or social-media tracking scripts. Nothing on them loads from a third-party server: the fonts, images and code are all served from trialpath.app itself, so no other company learns that you visited.

The one cookie this site is capable of setting is a sign-in session cookie for Trial Path staff using the private dashboard. If you are not a coordinator signing in, you will never receive it.

What we use your answers for

• Working out whether you may be a fit for the trial you applied to.
• Contacting you about that application.
• Sending the confirmation email carrying your application code.
• Keeping the site working, and limiting spam and automated submissions.

We do not sell your information, we do not share it with advertisers or data brokers, and we do not use it to target you with advertising anywhere.

The automated screening result

When your answers arrive they are scored automatically against the criteria for that trial, producing one of three results: passes screening, needs review or likely excluded. Three things are worth stating plainly about that score:

• It decides nothing. Every application goes into the queue for a person to read.
• Nobody is rejected automatically, whatever the score says.
• It is a sorting aid for the study team. It is not a medical opinion, not a diagnosis, and it is never sent to you.

Who can see it

• Trial Path study coordinators, each with their own named account on a password-protected dashboard. Sign-ins, status changes, exports and deletions are recorded in an activity log, so there is a record of who looked at what.
• Our hosting provider, Namecheap, which stores the website, the database and the mailbox on servers in the United States.

Beyond that we disclose an application only where the law requires it of us, or where you have asked us to.

Email we send you

• A confirmation when your form arrives, carrying your application code. It contains no health answers and no screening result.
• Messages from the study team about your application.

If you would rather hear nothing further, reply to any message and say so, or write to info@trialpath.app. We keep a suppression list, and an address on it is skipped by everything we send.

How long we keep it

• Applications — kept while the trial they relate to is recruiting and running, and deleted once that study closes.
• The activity log — 365 days. It records that something happened and who did it, never the screening answers themselves or the content of coordinator notes.
• Failed sign-in attempts — 7 days.
• Staff session files — 1 day.

You can ask us to delete your application sooner, at any point.

How it is protected

• Every page and every form is served over HTTPS. Because this is a .app domain, browsers refuse to load it over an unencrypted connection at all.
• Dashboard accounts are individual and role-based, passwords are stored hashed rather than in readable form, and sessions time out.
• Your IP address is never written to the database — only the keyed hash of it.
• Every database query uses prepared statements, so something you type into a form can never be run as a command against our data.
• Screening answers are deliberately kept out of the activity log and out of notification email.

No system is perfectly secure and we will not pretend otherwise, but these are the measures in place.

What you can ask us to do

Write to info@trialpath.app and you can ask us to send you a copy of what we hold about you, correct something that is wrong, or delete your application altogether.

Depending on which state you live in, you may have additional rights over your information. Write to us and we will tell you how we can help.

Children

These trials are for adults. This site is not intended for anyone under 18 and we do not knowingly keep applications from them. If you believe a child has submitted one, write to info@trialpath.app and we will delete it.

Where this applies

Trial Path’s trials and this website are intended for people in the United States, and the information you submit is stored on servers there.

Changes to this policy

When what we do changes, this page changes with it and the date at the top is updated. If a change materially affects applications already submitted, we will say so on the site rather than leave you to notice.