Privacy Policy

Last updated: 2026-07-26

This page is maintained by Dysplasia Diagnostics Ltd ("we", "us") to explain how the D-eCRF platform processes personal data on behalf of sponsors, sites and participants.

1. Who we are

Dysplasia Diagnostics Ltd operates D-eCRF as a data processor for the institutions and sponsors who use it ("Customers"). Customers are the controllers of the personal data they enter.

2. Data we process

Account data: name, email, organisation, role.
Operational logs: authentication events, audit trail of record edits.
Research data: pseudonymised participant records, consent metadata, sample tracking, FHIR-imported clinical data — entered by site staff under a Customer's ethics approval.

We do not collect direct identifiers (name, MRN, DOB) of research participants outside of Customer-controlled fields, and we do not sell personal data.

3. Legal basis

Performance of contract with Customers; legitimate interest in operating the platform securely; consent obtained by Customers from research participants under their own ethics/IRB approvals.

4. Security controls

Encryption in transit (TLS) and at rest.
Row-Level Security so each organisation only sees its own records; cross-organisation access is read-only metadata.
Role-based access (Admin / Study Manager / PI / Technician) with audit logging of sensitive actions.
Multi-factor authentication available for Google-federated accounts.

5. Subprocessors

Lovable Cloud / Supabase — hosting, database, authentication.
Resend — transactional email delivery.
Google Analytics — anonymised page-view metrics on marketing pages only.

6. Retention

Account and audit data are retained for the duration of the contract plus 7 years to meet regulatory retention requirements (ICH-GCP §4.9.5). Customers may request earlier deletion of their tenant data subject to study-level legal holds.

7. Your rights

Where we act as controller (account data), you may request access, correction or deletion by emailing privacy@dysplasiadx.com. For research data, please contact the recruiting site identified in your consent form.

8. International transfers

Data is stored in the EU/UK region of our cloud provider. Any transfer outside this region is covered by Standard Contractual Clauses.

9. Contact

Data Protection Officer — privacy@dysplasiadx.com