Legal

Privacy Policy

Last Updated: November 1, 2025

1. Introduction

MLPipeKit, Inc. ("MLPipeKit," "we," "our," or "us") operates a clinical trial data management platform and related services for pharmaceutical companies, biotechnology companies, contract research organizations (CROs), and other entities engaged in clinical research (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect personal information about:

  • Visitors to our website at mlpipekit.com (the "Site")
  • Registered users of the MLPipeKit platform ("Users")
  • Individuals whose information is submitted to us in connection with our services ("Contacts")

This policy does not govern the handling of clinical trial patient data processed through the MLPipeKit platform on behalf of our customers. Patient-level clinical trial data is processed solely as directed by our customers under the terms of a separate Data Processing Agreement, and our customers are responsible for compliance with applicable health data privacy regulations (including HIPAA, where applicable) with respect to that data.

By using the Site or Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Site or Services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you provide when you:

  • Register for an account: Name, work email address, job title, company name, company address, phone number, and password.
  • Request a demo or contact us: Name, work email address, company name, job title, phone number, and the content of your inquiry.
  • Subscribe to our newsletter or blog updates: Email address and optional preferences.
  • Use the platform: User profile information, configuration data, support tickets, and communications with our team.
  • Participate in surveys or feedback programs: Responses and opinions provided.

2.2 Information Collected Automatically

When you visit our Site or use our platform, we automatically collect:

  • Log data: IP address, browser type and version, operating system, referring URLs, pages visited, time and date of visit, time spent on pages, and other diagnostic data.
  • Device information: Hardware model, unique device identifiers, and mobile network information (when applicable).
  • Usage data: Feature interactions, session duration, error logs, and platform performance metrics.
  • Cookies and similar technologies: Session cookies, persistent cookies, and similar technologies. See Section 7 and our Cookie Policy for details.

2.3 Information from Third Parties

We may receive information about you from:

  • Business partners who refer customers or integrate with our platform
  • Analytics providers who help us understand platform usage
  • Marketing partners who assist with our outreach activities
  • Publicly available sources such as company websites and professional networks when evaluating business relationships

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Improving the Service

  • Creating and managing your account and user profile
  • Processing subscriptions and payments (see Section 3.3)
  • Delivering the features and functionality of the MLPipeKit platform
  • Providing technical support and responding to inquiries
  • Diagnosing and resolving technical problems
  • Improving platform features, performance, and user experience
  • Developing new features and services based on usage patterns and feedback

3.2 Communications

  • Sending service-related notifications (account updates, security alerts, feature releases)
  • Responding to your inquiries and support requests
  • Sending marketing communications, where you have consented or where we have a legitimate interest under applicable law
  • Sending educational content, blog updates, and industry information relevant to clinical data management

You may opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us at team@mlpipekit.com. Service-related notifications cannot be opted out of while you maintain an active account.

3.3 Payment Processing

We process subscription payments through PCI-DSS compliant third-party payment processors. We do not store complete payment card information on our servers. The payment processor's privacy policy governs the use of your financial information provided during payment.

3.4 Legal and Safety

  • Enforcing our Terms of Service and other agreements
  • Complying with applicable laws, regulations, and legal process
  • Investigating and preventing fraud, unauthorized access, and other illegal activities
  • Protecting the rights, property, and safety of MLPipeKit, our users, and the public

3.5 Analytics and Research

  • Understanding how users interact with the Site and platform
  • Measuring the effectiveness of our communications and marketing activities
  • Conducting research to improve our services

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share information in the following circumstances:

4.1 Service Providers

We share information with trusted third-party service providers who assist us in operating our business, including:

  • Cloud infrastructure providers (hosting and storage)
  • Payment processors
  • Email delivery services
  • Analytics and monitoring tools
  • Customer relationship management systems
  • Customer support tools

These providers are contractually required to protect your information and use it only for the purposes for which it was shared.

4.2 Business Transfers

If MLPipeKit is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process (subpoena, court order, or government demand), or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

4.4 With Your Consent

We may share your information in other ways with your explicit consent.

5. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

  • Account data: Retained for the duration of your account and for 3 years after account closure, unless you request deletion earlier (see Section 6).
  • Usage and log data: Retained for 12 months, after which it is aggregated or deleted.
  • Communications: Support communications retained for 3 years; marketing communication records retained for 2 years from last interaction.
  • Payment records: Retained for 7 years as required for tax and accounting compliance.
  • Audit logs: Security and access audit logs retained for 2 years.

Clinical trial data processed on behalf of customers through the platform is retained per the terms of the applicable Data Processing Agreement, which are set by the customer in accordance with their regulatory and contractual obligations.

6. Your Privacy Rights

Depending on your location, you may have the following rights with respect to your personal data:

6.1 Rights for All Users

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request that we correct inaccurate or incomplete personal data.
  • Deletion: Request deletion of your personal data, subject to our legal obligations to retain certain records.
  • Opt-out: Opt out of marketing communications at any time.

6.2 Additional Rights for EEA/UK Residents (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

  • Restriction of Processing: Request that we restrict the processing of your personal data in certain circumstances.
  • Data Portability: Receive a copy of your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
  • Object to Processing: Object to processing of your personal data where we rely on legitimate interests as the legal basis.
  • Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of processing prior to withdrawal.
  • Lodge a Complaint: Lodge a complaint with your local data protection authority.

Our legal bases for processing personal data under GDPR include: performance of a contract (for account-related processing), legitimate interests (for analytics, security, and marketing), compliance with legal obligations, and consent (for optional communications).

6.3 California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know about personal information collected, the right to delete personal information, and the right to opt out of the sale of personal information. MLPipeKit does not sell personal information. To exercise CCPA rights, contact us at team@mlpipekit.com.

6.4 Exercising Your Rights

To exercise any of the above rights, please contact us at:

  • Email: team@mlpipekit.com
  • Mail: MLPipeKit, Inc., 100 Summer Street, Boston, MA 02110, Attention: Privacy

We will respond to your request within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing certain requests.

7. Cookies

We use cookies and similar tracking technologies on our Site and platform. Cookies are small text files stored on your device that help us provide and improve our services. For detailed information about the types of cookies we use, how they work, and how to manage your preferences, please see our Cookie Policy.

Essential cookies required for the platform to function cannot be disabled. Analytics and marketing cookies can be controlled through your cookie preferences or browser settings.

8. Data Security

We implement technical and organizational security measures designed to protect your personal data from unauthorized access, disclosure, alteration, and destruction. Our security measures include:

  • Encryption of data in transit using TLS 1.2 or higher
  • Encryption of data at rest
  • Access controls and authentication requirements for all platform users
  • Regular security assessments and penetration testing
  • Security monitoring and incident response procedures
  • Employee security training and access management policies
  • Physical security controls for data center facilities used by our hosting providers

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

In the event of a data breach that affects your personal data, we will notify you and applicable authorities as required by applicable law.

9. International Data Transfers

MLPipeKit is headquartered in Boston, Massachusetts, USA. If you are located outside the United States, your personal data may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

For transfers from the EEA or UK to the United States, we rely on appropriate transfer mechanisms including Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms as applicable. For information about the safeguards applied to international transfers, contact us at team@mlpipekit.com.

10. Children's Privacy

Our Site and Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without verification of parental consent, we will delete that information promptly. If you believe we may have collected information from a child under 18, please contact us at team@mlpipekit.com.

11. Third-Party Links

Our Site and platform may contain links to third-party websites, services, or applications that are not operated by MLPipeKit. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access through our Site or platform.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

  • Update the "Last Updated" date at the top of this policy
  • Provide notice through our platform or by email to registered users
  • For significant changes, obtain fresh consent where required by applicable law

Your continued use of our Site or Services after the effective date of any changes constitutes your acceptance of the updated policy.

13. Contact Information

If you have questions, concerns, or requests related to this Privacy Policy or our privacy practices, please contact us:

We are committed to resolving privacy-related concerns promptly. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.

Terms of Service · Cookie Policy