Book a demo

Draft published for transparency. Pending attorney review.

Last updated October 22, 2026

On this page

Kyros Trials Acceptable Use Policy

The short version

  • Only put data into Kyros Trials that you have a legal right to put there (consent, authorization or IRB waiver).
  • Don't break, probe, copy or reverse-engineer the Service.
  • Don't use the Service to get around blinding, or to make automated eligibility decisions.
  • Don't share logins or sign for someone else.
  • Don't use the Service to send spam or unconsented texts.
  • If you break these rules we may suspend the specific access involved, but we won't delete your data, and we'll tell you why.

This Acceptable Use Policy ("AUP") applies to Customer and all Authorized Users, including External Users, and describes the rules for safe and responsible use of Kyros Trials. Customer means the research site; Authorized Users and External Users are people it authorizes to use the Service.

1. Data and legal basis

You will not:

1.1 upload, enter or transmit personal information, PHI or consumer health data without the notices, consents, HIPAA authorizations, IRB or privacy-board waivers, or other legal basis required by law;

1.2 upload data relating to studies or individuals outside the scope of the Customer's account, or data the Customer is contractually prohibited from placing in a third-party system;

1.3 upload records protected by 42 CFR Part 2 (substance use disorder treatment records) unless Customer and Kyros Trials have executed a Part 2 addendum;

1.4 upload data concerning individuals located outside the United States, or export Customer Data in violation of US export-control or sanctions laws;

1.5 enter payment card numbers, bank account numbers or Social Security numbers in free-text fields not designed for them.

2. Research integrity

You will not:

2.1 use the Service, including AI Features, reports, exports or access permissions, to circumvent blinding or masking, to access unblinded treatment assignments, randomization lists or unblinded data without authorization under the protocol and the sponsor's unblinding procedures, or to share unblinded information with blinded personnel;

2.2 use the Service or AI Features to make automated eligibility, enrollment, randomization or withdrawal determinations, or configure any workflow so that a prescreen or AI output is treated as an eligibility determination without review by the investigator or delegated study staff;

2.3 falsify, fabricate, back-date or improperly alter records, audit trails or signatures, or enter data you did not observe or verify in source;

2.4 publish a prescreen, recruitment material or eConsent form that has not been approved by the IRB of record, or alter it after approval without new approval;

2.5 approve AI Output without reviewing it, or present AI Output to participants or sponsors as human-authored where disclosure is required; see the AI Use Policy summary.

3. Accounts and signatures

You will not:

3.1 share credentials or allow anyone else to use your account;

3.2 apply an electronic signature on behalf of another person, or allow another person to sign as you (21 CFR § 11.200(a)(2));

3.3 create generic, shared or role-named accounts for signing;

3.4 grant External Users (e.g., sponsor monitors) access beyond what the protocol, the participant's authorization and the monitoring plan permit.

4. Security and the platform

You will not:

4.1 reverse engineer, decompile, disassemble or attempt to derive source code, models, prompts or underlying algorithms of the Service, except to the extent applicable law expressly permits despite this restriction;

4.2 probe, scan or test the vulnerability of the Service, or breach or circumvent authentication or security measures, except through Kyros Trials's responsible-disclosure program or with Kyros Trials's written authorization;

4.3 access or attempt to access another customer's data;

4.4 introduce malware or interfere with the Service's integrity or performance, including by excessive automated requests beyond documented API limits;

4.5 scrape, frame or mirror the Service, or use it to build a competing product;

4.6 attempt to extract system prompts, jailbreak AI Features, or use them to generate unlawful, harmful or deceptive content;

4.7 resell, sublicense or provide the Service to third parties except as permitted by an Order Form.

5. Communications

You will not use the Service to send messages without required consent, including texts without prior express consent under the Telephone Consumer Protection Act (47 U.S.C. § 227) and our SMS Terms; send marketing unrelated to research participation; or include PHI in SMS or email beyond the minimum necessary.

6. Unlawful and harmful use

You will not use the Service to violate any law or the rights of others, to discriminate unlawfully in recruitment or enrollment, or to harass or deceive any person.

7. Enforcement

7.1 Kyros Trials may investigate suspected violations, accessing Customer Data only for requested support or a legal requirement, with named personnel access logged in the audit trail.

7.2 If a violation creates an imminent risk to the security or integrity of the Service, to other customers, or to individuals, Kyros Trials may suspend the specific users, features or integrations involved, limited to the extent and duration necessary, and will notify Customer promptly (in advance where practicable) with the reason. Suspension will not delete Customer Data, and Kyros Trials will restore access promptly once the risk is resolved.

7.3 For other violations, Kyros Trials will notify Customer and allow a reasonable period to cure before taking action.

8. Reporting

Report suspected violations or vulnerabilities to privacy@kyrostrials.com.

Reader guidance, separate from the document

This section explains how to review responsible use. It does not amend the policy or supply missing contract terms. Read the published document above and request the current full agreement where the page is a summary. Your organization should confirm that the wording addresses the intended use before relying on it.

Begin with a list of account sharing, unauthorized access, harmful content and reporting misuse. Identify who at the site owns each question and what evidence is needed. A general product description cannot answer every contractual or study-specific issue. Keep unanswered questions in the review record rather than treating silence as a favorable term.

Review the workflow and the evidence

The practical responsibility is following site procedures and protecting other users’ records. Ask what record would show that the process was followed and who can review it. A demonstration with sample data can clarify the workflow without disclosing participant information. It does not replace your legal or operational assessment.

For electronic research records, inspect the responsible user, dates, status, record linkage and change history. For public website interactions, review the information requested and the stated purpose. These are different contexts; a business-contact form should not be used to submit source data or confidential study documents.

Keep access and communication specific

Use individual accounts and the access appropriate to the person’s role. A shared login prevents a reliable link between an action and its responsible user. When inviting a reviewer, check the study and access period rather than assuming that a broad organization role is necessary.

For a question about this document, contact legal@kyrostrials.com. For privacy rights or handling concerns, contact privacy@kyrostrials.com. For a technical barrier or service problem, contact support@kyrostrials.com. Include business contact details, the page and the question, but do not paste participant names, health information, credentials or signed study documents into ordinary email.

Plan review before sensitive use

Request the current security summary, provider information and relevant agreement status before transferring sensitive records. Public summaries do not establish BAA execution, a particular vendor arrangement, an uptime guarantee or a certification. If a requirement is unresolved, document it and obtain an answer instead of inferring readiness from a feature being visible.

Your site’s procedures should explain who approves the system’s intended use, how staff are trained and how exceptions are handled. Keep the review proportionate to the study and data involved. A software control supports the procedure; it does not replace investigator responsibility or participant-facing obligations.

Retain context when records move

Before importing or exporting study information, identify the original records, signature evidence and audit histories that must remain available. A spreadsheet can carry values and dates without reproducing the source system’s historical events. Keep source exports and reconcile sample records so a later reviewer can understand the transition.

Review the trust hub for related policies and summaries and the switching guide for a sample migration review plan. Contract-specific archive or exit terms need the full agreement. Customer data is not deleted for non-payment, but your organization still needs to plan record retention and access under the applicable research rules.