Clear boundaries around information.

Information you enter

CoClinica accepts de-identified clinical descriptions and professional workflow information. Do not submit names, birth dates, addresses, contact information, record numbers, account credentials, protected health information, or combinations of details that could identify a person.

Automated screening may detect some common identifiers, but it cannot confirm that information is fully de-identified. You are responsible for reviewing information before submission.

Generation services

When you use a generation feature, the information entered for that request is sent through CoClinica's protected server to the OpenAI API so a result can be generated. CoClinica requests that API responses are not stored for later retrieval by the application. OpenAI processes information under its applicable business and API terms. CoClinica is not offered under a Business Associate Agreement and must not receive protected health information.

Hosting and technical information

CoClinica is hosted by Vercel. Vercel may process technical information needed to deliver and secure the website, such as network requests, IP address, browser or device information, timestamps, and error or security logs.

Account and membership information

When you create or use an account, CoClinica processes your email address, authentication identifiers, membership status, and information needed to manage access to the service. Supabase provides account authentication and stores this limited account and membership information according to its privacy practices. Clinical form content, generated results, drafts, and My Library content are not intentionally stored in Supabase.

Cookies and device storage

CoClinica uses essential cookies to keep you signed in and protect account access. It does not use advertising cookies or targeted-ad tracking. Vercel Web Analytics is designed to operate without cookies. Stripe-hosted checkout and billing pages are separate services and may use cookies under Stripe's privacy practices.

Drafts, My Library items, and workflow handoffs are stored locally in this browser. Clearing cookies or browser data may sign you out and may permanently remove locally saved clinical work.

Local browser storage

My Library, unfinished drafts, and cross-tool handoffs are stored in your browser on your device. This clinical workspace content is not synchronized to a CoClinica cloud database. Clearing browser data, changing browsers or devices, using private browsing, or device failure may remove locally stored work.

Library backups are downloaded to the location you choose. Store them securely and do not include identifiable client information.

Email communication

When you select an email link, your email provider opens a new message. CoClinica receives the information you choose to send, including your email address and message. Do not send protected health information or identifiable client details by email.

Site analytics

CoClinica uses Vercel Web Analytics to understand general site traffic, evaluate performance, and improve the user experience. Vercel Web Analytics is designed to store anonymized information without using cookies. CoClinica does not intentionally include clinical form content, generated results, diagnosis selections, service-location ZIP codes, or My Library content in analytics events. Learn more in Vercel's Web Analytics privacy documentation.

Payments

If you purchase a membership, Stripe processes the payment and billing information needed to complete the transaction, manage the subscription, prevent fraud, and handle refunds or disputes. CoClinica does not receive or store complete payment card numbers. Stripe processes information according to its own privacy practices.

Retention and control

Device-local items remain until you remove them, clear browser data, or restore a different local state. You can remove individual library items, clear the complete library, or create a local backup. Technical and service-provider information is retained according to the provider's applicable terms and operational requirements.

Children

CoClinica is intended for clinicians and is not directed to children. Clients and minors should not use the hosted workspace directly.

Security

CoClinica uses reasonable technical safeguards, but no online service can guarantee absolute security. The most important privacy safeguard is to use de-identified information only.

Changes to this policy

This policy may be updated as CoClinica changes. The effective date will be revised when a material update is published.