Data Processing Agreement

Version 2026-10-12 · Part of the Terms of Service

This agreement applies when Helper Software LLC (“we”, the “Processor”) processes personal data in the content of an organization using Clinwright (the “Customer”) on the Customer’s behalf. It forms part of the Terms of Service, or of an Enterprise agreement that refers to it. It is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR) and its UK equivalent. A signed copy is available on request at support@clinwright.com.

1. Roles and instructions

• The Customer is the controller of the personal data in its content (“Customer Personal Data”), or a processor acting for its own client, the controller. We are the Customer’s processor (or subprocessor).
• We process Customer Personal Data only on the Customer’s documented instructions: these terms, the Customer’s use and configuration of the Service, and other written instructions we agree to. We tell the Customer if we believe an instruction breaks data protection law. We process otherwise only where the law requires us to, telling the Customer first unless that law forbids it.
• The Customer is responsible for having a lawful basis and the necessary consents and approvals for the data, and for uploading clinical trial data only in de-identified or pseudonymized form.

2. Confidentiality and security

• Everyone we authorize to process Customer Personal Data is bound by confidentiality.
• We maintain the technical and organizational measures in Annex 2, which we may improve but not reduce materially.

3. Subprocessors

• The Customer authorizes the subprocessors listed on our subprocessors page. Each is bound by written terms that protect the data at least as well as this agreement, and we remain responsible for them.
• We announce a new subprocessor at least 30 days before it processes Customer Personal Data, on that page and by email to the organization’s owners. If the Customer objects on reasonable data protection grounds and we cannot resolve the objection, the Customer may stop using the Service and receive a refund of its unused credits and the unused part of archive fees.

4. Assistance

• We help the Customer answer requests from data subjects, using the Service’s own functions (export, correction, deletion) where possible, and pass on to the Customer any request we receive directly about its data.
• We help with data protection impact assessments and consultations with authorities, as far as they concern the Service, with the information we have.

5. Personal data breaches

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer Personal Data, with what we know about its nature, the data and people concerned, its likely consequences and the measures taken, and we keep the Customer informed as we learn more. Notifying authorities and data subjects is the Customer’s decision; we help.

6. Return and deletion

The Customer can export its content at any time, in common formats. When the Customer deletes its organization, we keep it restorable for 30 days, then erase it from the Service; copies in our backups expire within a further 30 days. Records that the law requires us to keep are kept only for that purpose.

7. Audits

We make available the information needed to show compliance with this agreement, and answer the Customer’s reasonable security questionnaires once a year. Where that is not enough, or an authority requires it, the Customer (or an independent auditor bound by confidentiality) may audit us on 30 days’ notice, during business hours, at the Customer’s cost, without access to other customers’ data.

8. International transfers

The Service runs in the United States, with backups in the European Union. For transfers of Customer Personal Data from the European Economic Area to us, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply and are incorporated by reference: Module Two (controller to processor), or Module Three (processor to processor) where the Customer is a processor. In them: Clause 7 does not apply; under Clause 9(a), option 2 applies, with the notice period of section 3 above; the optional wording in Clause 11 does not apply; Clauses 17 and 18 choose the law and courts of Ireland; Annexes I, II and III are Annexes 1, 2 and 3 below. For the United Kingdom, the UK International Data Transfer Addendum applies to those clauses; for Switzerland, they apply with references to the Swiss Federal Act on Data Protection. The clauses prevail over this agreement where they differ.

9. Liability and term

Liability under this agreement is subject to the limits in the Terms of Service, except where the Standard Contractual Clauses or the law do not allow it. This agreement lasts as long as we process Customer Personal Data.

Annex 1: Details of the processing

• Data subjects: the Customer’s users of the Service; people whose data appears in the Customer’s content, chiefly clinical trial participants in pseudonymized form.
• Categories of data: users’ names and email addresses; pseudonymized clinical trial data, such as subject identifiers, demographics, dates, treatments, adverse events, laboratory results and other assessments.
• Special categories: data concerning health, and possibly racial or ethnic origin, in pseudonymized clinical trial data. Safeguards: the measures in Annex 2, access limited to running and supporting the Service, no use for training AI models.
• Nature and purpose: hosting and storing the content; generating and running programs on it, with the help of AI models; producing data sets, outputs and documents; showing, exporting and deleting them; all to provide the Service to the Customer.
• Frequency and duration: continuous, for as long as the Customer uses the Service, then section 6.

Annex 2: Technical and organizational measures

Access to the Service

• Connections are encrypted with TLS; browsers are told to use HTTPS only (HSTS).
• Passwords are stored as salted hashes; repeated failures lock the account for a while. Two-step verification with an authenticator app is available, and organizations can require it. Its secrets are encrypted, recovery codes hashed.
• Access within an organization follows its members’ roles. Removing a member or changing a password ends other sessions within a minute.
• Sessions use HTTP-only, host-bound, same-site cookies; the app sets a strict content security policy.

Separation and isolation

• Every organization’s rows carry its identifier and are separated by PostgreSQL row-level security; the application connects with a role that cannot bypass it, which is checked at start-up. Each organization’s files are stored under its own prefix.
• Programs (generated or written) run in a separate service without any outbound network, each in its own sandbox (nsjail): no network, a read-only system, a temporary working directory holding only that run’s inputs, an unprivileged user, and limits on CPU time, memory, file size, processes and wall-clock time. The runner has no access to the database or file storage.

Records

• Append-only audit trails record changes to data (who, when, before and after) and access (sign-ins, memberships, roles); the application cannot change or delete them.
• Each program run records the code, the hash of its inputs, the version of the runner and its engine, so results can be reproduced.

Infrastructure and operations

• Servers accept connections only for HTTPS and for SSH with keys (no passwords); a firewall blocks everything else, and repeated failed SSH attempts are blocked. Security updates install automatically.
• The database and files are backed up every day to object storage in another region, kept for 30 days; a restore is tested automatically every week. The host also keeps whole-machine backups.
• Changes to the Service are tested automatically before they are deployed; deployments are recorded.
• The content of each email we send is deleted once it is sent; only the address, kind and time are kept.

People and subprocessors

• Only the people who run the Service can reach its servers or data, and only to run, secure and support it.
• Subprocessors are chosen for their security and bound by data protection terms; AI providers may not train on the data.

Annex 3: Subprocessors

The current list, with each subprocessor’s purpose and location, is on our subprocessors page.