Privacy notice

Who is responsible

CLAI is developed by PHPA Consulting, Unipessoal Lda, Horta, Azores, Portugal, under project 1723 of Portugal’s Recovery and Resilience Plan. For a trial you are enrolled in, the clinic or therapy provider running that trial is the controller of your health data, and PHPA Consulting processes it on their behalf to operate CLAI.

What we process, and why

• Account data. Your name and email address, to sign you in and show you the portal your account belongs to. Authentication is provided by Clerk, Inc., acting as our processor.
• Health record data. Wearable, glucose, body composition, laboratory, patient-reported and therapy data connected to your record, to show you how you are changing during therapy. Legal basis: your explicit consent (Article 9(2)(a) GDPR), which you can withdraw at any time in the permissions centre.
• Ask CLAI questions. When you ask a question, the question and the parts of your record needed to answer it are sent to Anthropic’s API to generate the answer. Anthropic acts as a processor and does not use this data to train models.
• Research contributions. Only if you opt in, and only for the categories you choose, a de-identified copy of your data joins the evidence register. Switching this off stops future contributions the same day.

Cookies

CLAI sets strictly necessary cookies only. None are used for advertising, tracking or third-party analytics.

• Session cookies set by Clerk to keep you signed in. They expire when your session ends or after seven days at most.
• Preference flags stored in your browser: whether you have seen this notice, and whether presenter mode is on.

Where your data goes

Your record is stored with the trial that enrolled you. Sign-in data is processed by Clerk and Ask CLAI questions by Anthropic, both of which may process data outside the European Economic Area under the EU Standard Contractual Clauses. Nobody else receives your data unless you share it yourself, for example by sending a summary to your doctor.

How long we keep it

For the duration of your enrolment and the retention period set by the trial protocol, after which your record is deleted or fully anonymised. You can ask for deletion earlier at any time from the permissions centre.

Your rights

Under the GDPR you can access, correct, export and delete your data, restrict or object to its processing, and withdraw any consent you have given. You can also complain to your supervisory authority; in Portugal that is the CNPD (Comissão Nacional de Proteção de Dados).

Contact

For any request about your data, contact the administrator of the trial you are enrolled in, or PHPA Consulting, Horta, Azores. We answer within one month, as the GDPR requires.