Kyros Trials Privacy Policy
The short version
- This policy covers information Kyros Trials collects for itself: our website, demo requests, sales and support contacts, and the account details of people who use Kyros Trials at work.
- Information that research sites put into Kyros Trials (including study participants' health information) belongs to the research site. We handle it only on the site's instructions and applicable agreements. Contact us for the current status of our customer agreements. The site's own privacy notice governs it.
- We do not sell personal information, and we do not "share" it for cross-context behavioral advertising. We do not use advertising pixels anywhere, and we use no third-party tracking at all on prescreen, participant portal or consent pages.
- We never use customer data, health information, or AI inputs or outputs to train AI models.
- Depending on where you live, you can ask to access, correct or delete your information, and appeal if we say no. We honor Global Privacy Control signals.
- Kyros Trials is a US-only service. It is not directed to children under 13.
- Questions: privacy@kyrostrials.com.
1. Who we are and what this policy covers
1.1 Kyros Trials. "Kyros Trials," "we," "us" and "our" mean Bordano Tissue, LLC, doing business as Kyros Trials, which operates the Kyros Trials software service (the "Service") and the website at https://kyrostrials.com (the "Site").
1.2 Scope. This Privacy Policy describes how Kyros Trials collects, uses, discloses and protects personal information for which Kyros Trials determines the purposes and means of processing (that is, where Kyros Trials acts as a "business" or "controller" under applicable law). That information is:
| Category of person | Examples of what this policy covers |
|---|---|
| Site visitors | Visits to https://kyrostrials.com, marketing pages, documentation, our status page |
| Prospects | Demo requests, contact forms, webinar sign-ups, sales correspondence |
| Customer contacts | Billing contacts, contract signatories, administrators, in their capacity as our business counterparties |
| Authorized Users (account level) | Name, work email, role and login and security data of site staff and invited sponsor monitors, to the extent we use it to administer accounts, secure the Service, bill, and provide support |
1.3 What this policy does not cover; Customer Data. Kyros Trials is used by independent clinical research sites and site networks (each, a "Customer"). Information that a Customer, its staff, its invited sponsor monitors, its study participants, or members of the public submit to the Service on the Customer's behalf; including clinical, eSource, eCRF, regulatory binder, eConsent, recruiting, prescreen, participant portal, stipend and monitoring data, and any AI inputs and outputs (together, "Customer Data"); is processed by Kyros Trials on behalf of and under the instructions of the Customer. For that information:
- the Customer decides why and how it is used and is responsible for providing the privacy notice;
- where a business associate agreement is required, the Customer must confirm that the appropriate agreement and infrastructure are in place before submitting protected health information; see our Business Associate Agreement summary;
- under state consumer privacy laws, Kyros Trials acts as the Customer's service provider, processor or contractor under our Data Processing Addendum.
If you are a study participant or a person who answered a prescreen questionnaire and you have questions about your information, please contact the research site you interacted with. If you contact us, we will forward your request to that site and assist it in responding. Our Consumer Health Data Privacy Policy explains how prescreen answers are handled before a person enrolls in a study.
2. Information we collect
2.1 Information you give us.
- Contact and professional details: name, work email, phone, organization, job title, site or network size, therapeutic areas, and the content of your messages.
- Demo and sales information: what you tell us about your needs, scheduling preferences, and meeting notes.
- Account information: for Authorized Users, name, work email, role, organization, and credentials. Passwords are stored only as salted hashes by our authentication provider; we cannot read them.
- Billing information: billing contact, billing address, purchase order numbers and tax information. Do not send us payment card details in contact forms or support messages. Payment processing arrangements are described when billing is set up.
- Support information: the content of support requests. Please do not include participant health information in a support ticket unless the Customer has asked us to look at a specific record; see Section 4.3.
2.2 Information collected automatically on our marketing Site.
- Device and log data: IP address, browser type, operating system, referring page, pages viewed, and timestamps, used for security, troubleshooting and aggregate traffic measurement.
- Cookies and similar technologies: see Section 7.
2.3 Information collected automatically in the Service (account level). Login events, IP address, device and browser details, session identifiers, multi-factor authentication events and security alerts. This information is also part of the Customer's audit trail, which belongs to the Customer.
2.4 Information from others. Your employer or a Customer administrator may give us your name and email to create your account or to invite you as a sponsor monitor. We may receive business contact information from event organizers or professional networking sites where you have made it available.
2.5 Sensitive personal information. The only "sensitive personal information" (as defined in Cal. Civ. Code § 1798.140(ae)) that Kyros Trials collects for its own purposes is account login credentials for Authorized Users. We use it only to authenticate users and secure the Service, which is a permitted purpose under Cal. Code Regs. tit. 11, § 7027(m). We do not use sensitive personal information to infer characteristics about anyone.
3. How we use information
We use the information described in Section 2 to:
- provide, operate, secure and support the Service and the Site;
- create and administer accounts, authenticate users and enforce access controls;
- respond to demo requests, questions and support requests;
- bill, collect payment and manage the contractual relationship;
- detect, prevent and investigate security incidents, fraud and abuse, and maintain the integrity of audit trails;
- send service, security, legal and billing notices (these are not marketing and cannot be opted out of while you have an account);
- send business marketing emails to customer and prospect contacts, with an unsubscribe link in every message (CAN-SPAM Act, 15 U.S.C. § 7701 et seq.);
- measure aggregate Site traffic and Service usage to improve the Service, using aggregated or de-identified information that does not contain protected health information ("PHI");
- comply with law, legal process and regulatory requests, and establish, exercise or defend legal claims.
We do not use Customer Data or any personal information to train artificial-intelligence models, ours or any vendor's. We do not use personal information for targeted advertising, profiling that produces legal or similarly significant effects, or automated decision-making about you.
4. How we disclose information
4.1 We do not sell or share. Kyros Trials does not sell personal information and does not "share" personal information for cross-context behavioral advertising, as those terms are defined in Cal. Civ. Code § 1798.140. We have not done so in the preceding 12 months. We do not sell personal information of consumers under 16. Kyros Trials does not sell or license PHI (see also Tex. Health & Safety Code § 181.153).
4.2 Disclosures we do make. We disclose personal information only:
- To service providers that process it on our behalf under written contracts restricting their use to providing services to us (for example, hosting, email delivery, scheduling, payment processing and customer support tools). A current subprocessor notice is available on request; see our Subprocessors summary.
- To the Customer you work with. If you are an Authorized User, your account information and activity are available to the Customer's administrators.
- For legal reasons: to comply with law, subpoena, court order or a lawful government request; to protect the rights, safety or property of Kyros Trials, our Customers or others; or to investigate fraud or security incidents. Where permitted, we will notify the affected Customer before disclosing Customer Data in response to legal process.
- In a corporate transaction: to a buyer or successor in a merger, acquisition, financing, reorganization or sale of assets, subject to this Policy and to any Business Associate Agreement and Data Processing Addendum in force, which bind the successor.
- With your direction or consent.
4.3 Kyros Trials personnel access. Kyros Trials staff do not access your records except when you ask for support or the law requires it. That access is limited to named people and logged in the audit trail. See our Security Overview.
5. Notice at collection and retention (California and similar laws)
The following table describes the categories of personal information Kyros Trials collects for its own purposes, as enumerated in Cal. Civ. Code § 1798.140(v), and how long we keep them.
| Category | Examples | Source | Business purposes | Disclosed to | Sold / shared? | Retention |
|---|---|---|---|---|---|---|
| Identifiers | Name, work email, phone, IP address, account ID | You; your employer; automatically | §§ 3(1)–(7), (9) | Service providers; the Customer you work with | No / No | For account administration and support while needed; marketing contacts until you unsubscribe or they are no longer needed |
| Professional information | Employer, title, site details | You; your employer; public professional sources | §§ 3(3), (4), (7) | Service providers | No / No | As above |
| Commercial information | Plans purchased, invoices, purchase history | You; our records | § 3(4) | Service providers (incl. Stripe) | No / No | As needed for tax, accounting and legal obligations |
| Internet or network activity | Pages viewed, login and security events | Automatically | §§ 3(1), (2), (5), (8) | Service providers | No / No | For security and troubleshooting while needed; Customer audit records follow applicable retention requirements |
| Sensitive personal information | Account credentials (hashed) | You | § 3(2) only | Authentication service provider | No / No | Life of account |
| Inferences | None | ; | ; | ; | ; | ; |
We do not collect biometric information, precise geolocation, or characteristics of protected classifications for our own purposes.
6. Your privacy rights
6.1 Rights. Depending on your state of residence (including California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia and other states with comprehensive privacy laws), you may have the right to:
- know / access the personal information we hold about you, including the categories, sources, purposes and recipients;
- obtain a copy in a portable format;
- correct inaccurate information;
- delete information, subject to legal exceptions (for example, records we must keep for tax, security or legal-hold purposes);
- opt out of sale, sharing, targeted advertising and significant profiling (we do none of these, so there is nothing to opt out of, but we will confirm this in writing on request);
- limit the use of sensitive personal information (we already use it only for permitted purposes);
- appeal our decision on your request; and
- not be discriminated against for exercising these rights.
6.2 How to make a request. Email privacy@kyrostrials.com. We will verify your identity by matching information you provide to information we already hold. You may use an authorized agent; we may require proof of the agent's authority and ask you to verify your identity directly.
6.3 Timing. We will confirm receipt within 10 business days and respond within 45 days, which we may extend once by up to 45 more days where reasonably necessary, with notice to you.
6.4 Appeals. If we decline your request, you may appeal by emailing privacy@kyrostrials.com with the subject "Privacy Appeal." We will respond in writing within the period required by your state's law (generally 45 or 60 days) and explain our decision. If we deny your appeal, you may contact your state attorney general.
6.5 Requests about Customer Data. If your request concerns information a research site entered into Kyros Trials, we will refer it to that Customer and assist the Customer as required by our agreements with it. We cannot act on such a request on our own without the Customer's instruction, except where law requires.
6.6 Global Privacy Control. We treat a Global Privacy Control signal as a valid request to opt out of sale and sharing for the browser that sends it.
7. Cookies and tracking technologies
7.1 Marketing Site. We use storage and cookies where needed for security and essential site functions. We do not use advertising pixels.
7.2 No advertising pixels. We do not place advertising pixels, social-media pixels, session-replay scripts or third-party advertising cookies on any Kyros Trials page.
7.3 No tracking on sensitive pages. On prescreen pages, the participant portal, eConsent pages and authenticated Service pages, we use no third-party analytics or tracking technologies of any kind, only the strictly necessary cookies and local storage needed to keep you signed in and protect your session.
7.4 Your choices. You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may prevent the Site or Service from working.
8. Security
We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for privileged access, and logging. Our Security Overview describes these measures. No system is perfectly secure; if we learn of a security incident affecting your personal information, we will notify you and regulators as the law requires.
9. Children
The Site and Service are not directed to children under 13, and Kyros Trials does not knowingly collect personal information directly from children under 13. Some studies enroll minors. A prescreen questionnaire for a pediatric study must be completed by a parent or legal guardian on the child's behalf, and the Customer is responsible for configuring the prescreen accordingly and for obtaining parental permission and child assent under 21 CFR Part 50, Subpart D, and 45 CFR Part 46, Subpart D, where applicable. If we learn that we have collected personal information directly from a child under 13 for Kyros Trials's own purposes without verifiable parental consent, we will delete it.
10. Where we process information
Kyros Trials is offered only to Customers in the United States. Contact us for current information about processing locations before submitting sensitive information. We do not intend to collect personal information from individuals outside the United States; this Policy does not address the EU/UK GDPR or other non-US laws.
11. Texas residents
The Texas Medical Records Privacy Act (Tex. Health & Safety Code ch. 181) may apply to health information. We do not sell health information. Texas residents have the rights described in Section 6 under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541), to the extent it applies.
12. Changes to this Policy
We will post any changes here and update the "Last updated" date. If a change is material, we will notify Customers' administrators by email at least 30 days before it takes effect and display a notice on the Site. We will not use personal information in a materially different way from what we described when we collected it without your consent where the law requires consent.
13. Contact us
Bordano Tissue, LLC, doing business as Kyros Trials Attn: Privacy Email: privacy@kyrostrials.com Privacy requests: privacy@kyrostrials.com
Related documents: Consumer Health Data Privacy Policy · Subprocessors · AI Use Policy · Security Overview · Website Terms of Use