Privacy Policy

1. Data we process

• Account data: name, work email address, role, organisation (tenant), language preference, and password hash. Passwords are stored only as salted hashes.
• Audit trail data: the Service keeps an immutable, timestamped record of regulatory work (who created, reviewed, approved, signed or exported what, and when). Audit events record the acting user's identifier and, for security-relevant actions, the IP address of the request.
• Technical and security data: server logs, request identifiers, and browser error reports that the application sends to us when a page fails. Error reports carry the technical error message, the page address and a request identifier; they are not designed to carry document content.
• Support communications: messages you send to hello@runareg.com or through the agreed support channel.
• Customer documents and their contents: processed as a processor on the customer's instructions (see the Data Processing Agreement). Customers should not upload patient-level health data.

2. Cookies

The Service uses a session cookie, scoped to runareg.com, that is strictly necessary to keep you signed in. Language and interface preferences may be stored in your browser. We do not use advertising cookies, and [no third-party analytics are loaded / counsel to confirm the current analytics posture].

3. Purposes and legal bases

• Providing the Service and support to your organisation: performance of a contract (Art. 6(1)(b) GDPR) or our legitimate interest in serving our customer's users (Art. 6(1)(f)).
• Keeping the audit trail: our legitimate interest and our customers' legal obligations to maintain records of regulatory work (Art. 6(1)(c) and (f)).
• Securing the Service, detecting abuse and diagnosing errors: legitimate interest (Art. 6(1)(f)).
• Complying with law and responding to lawful requests: legal obligation (Art. 6(1)(c)).

4. Where data is processed

The Service runs on Google Cloud in the Frankfurt (europe-west3) region, including the application, its databases, secrets and backups. AI features use Google Cloud Vertex AI in the same region; the models are accessed through Google's enterprise terms and are not trained on your data.

5. Processors and other recipients

• Google Cloud EMEA Ltd: hosting, databases, storage, secrets, monitoring and AI model access (EU, Frankfurt).
• Neo4j AuraDB: hosting of the regulatory knowledge graph used for retrieval [confirm region and whether any customer-derived content is projected into it].
• Public regulatory and scientific sources queried by the Service on your instruction (for example EUDAMED, PubMed and NCBI, Europe PMC, ClinicalTrials.gov): queries contain device and literature search terms, not personal data about you.
• [Email or notification provider, if any, to be confirmed.]
• We do not sell personal data. We disclose it to authorities only where legally required.

6. Retention

• Account data: for the life of the account and up to [12] months after closure, unless a longer period is legally required.
• Audit trail: retained for the customer's contract term and thereafter as required by the customer's record-keeping obligations; the audit trail is append-only by design and is not altered on request, because it evidences regulatory due diligence.
• Backups: automated daily database backups are retained for 30 days with point-in-time recovery; deleted data disappears from backups on that cycle.
• Server logs and error reports: [30] days unless needed for an open security investigation.

7. Security

Data is encrypted in transit and at rest. Each customer's data is isolated at the database level by row-level security that applies to the application's own database role, including as the owner of the tables. Database roles that can bypass row-level security (superuser or BYPASSRLS) are not used by the application, and the evidence store refuses to serve such a connection. Access is role-based and default-deny, administrative access is limited to named operators, and security-relevant events are recorded in the audit trail. Signatures inside the Service require re-authentication.

8. Your rights

Under the GDPR you may request access to, rectification or erasure of your personal data, restriction of or objection to its processing, and portability, and you may lodge a complaint with a supervisory authority. Where RunaReg processes your data as a processor for your employer, we will refer your request to your employer, who is the controller. Contact: hello@runareg.com. [Data protection contact or DPO, if appointed, to be named here.]

9. International transfers

Processing takes place in the EU. Where a processor accesses data from outside the EU or the EEA (for example for support), the transfer is covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

10. Changes

We will notify customers of material changes to this policy by email. The version date at the top of this page identifies the current text.