Legal
Privacy Policy
Effective 14 September 2026 · Quad99 Technologies
1. Scope
This policy explains how Quad99 Technologies ("we", "us") handles personal data when you visit our website, request access, or use Quad99 Research (the "Service"). For personal data inside a customer's workspace, the customer organisation decides how the Service is used and we process that data on its behalf; where a data processing agreement is in place, it governs.
2. Information we collect
You give us
- Account details — name, work email, password (stored only as a salted hash), workspace name and role.
- Access requests — name, work email, company, job title, markets of interest and your message.
- Research activity — the questions you ask, conversation history, notes and feedback ratings. Reports you export are generated in your browser and are not stored by us.
- Billing details — billing contact and plan; payment card details are collected by Stripe, not by us.
Collected automatically
- Audit records — for each answer, the research queries run, their parameters, rows returned, errors and timing, linked to the workspace member who asked.
- Usage and security logs — sign-ins, IP address, request identifiers, browser type and actions such as role changes or key creation.
- Essential cookies — a session cookie that keeps you signed in (see section 12).
3. How we use it
- Provide the Service: authenticate you, run your research questions, show sources and keep your history.
- Keep it secure: prevent abuse, enforce rate limits, investigate incidents and maintain audit trails your workspace administrators can review.
- Operate the business: respond to access requests, run pilots, bill and support customers, and send service notices.
- Improve answer quality: analyse feedback ratings and aggregated usage to find and fix weak answers.
- Meet legal obligations such as tax, accounting and lawful requests.
We do not sell personal data, and we do not use it for third-party advertising.
4. Legal bases
Where data-protection laws require a legal basis, we rely on performance of our contract with you or your organisation; our legitimate interests in securing, supporting and improving the Service and in responding to business enquiries; compliance with legal obligations; and, where required, your consent.
5. AI processing
To answer a question, we send the question, relevant conversation context and the source passages or figures retrieved from the research corpus to an AI model provider. Providers process this data to return the answer and act as our service providers. We use provider services whose terms do not allow API inputs to be used to train their models. Please do not include patient-identifiable health information in questions.
6. The research corpus
The research corpus consists of information about medicines, prices, regulatory and health technology assessment decisions, procurement outcomes and supply, compiled from public sources and licensed data. It is not built from your personal data. Published documents can contain the names of officials, authors or company representatives as they appear in the original publication; we show such content only as part of the cited source.
7. Sharing and service providers
We share personal data only as needed to run the Service:
| Purpose | Provider | What they do |
|---|---|---|
| Application hosting | Render | Runs the Service (Singapore region) |
| Database | Supabase | Stores accounts, workspaces, conversations and the research corpus (Singapore region) |
| AI model providers | Google (Gemini) and/or Anthropic (Claude) | Generate answers from your question and retrieved sources |
| Email delivery | Resend | Verification, invitations, password reset, access notices |
| Payments | Stripe | Checkout and billing for paid plans; card details go directly to Stripe |
Within a customer workspace, owners and administrators can see members, conversations and the audit log for that workspace. We may also disclose data to comply with law, to protect rights and safety, or as part of a merger or acquisition, subject to this policy.
8. International transfers
The Service is hosted in Singapore and our providers may process data in other countries. Where the law requires, we use appropriate safeguards such as standard contractual clauses for these transfers.
9. Retention
- Account and workspace data: for as long as the account is active, then deleted or anonymised within 90 days of closure, unless the customer's agreement says otherwise.
- Conversations, reports and audit records: for the life of the workspace, or the period set in the customer's agreement.
- Access requests that do not become customers: up to 24 months.
- Security logs: typically up to 12 months. Billing records: as long as tax law requires.
10. Security
We protect data with encryption in transit, hashed passwords and API keys, workspace isolation enforced by the database, least-privilege and read-only access for AI-generated queries, and audit logging. No system is perfectly secure; report suspected vulnerabilities to security@quad99.com.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. If your account belongs to an organisation's workspace, we may refer your request to that organisation. Contact privacy@quad99.com; we respond within 30 days. You may also complain to your local data-protection authority.
12. Cookies
We use only cookies that are strictly necessary to run the Service — a secure, HTTP-only session cookie for signed-in users. We do not use advertising or cross-site tracking cookies. Your browser may store interface preferences such as theme locally on your device.
13. Children
The Service is for professionals and is not directed to anyone under 18. We do not knowingly collect their data.
14. Changes
We may update this policy and will post the new version here with its effective date. For material changes we will notify workspace owners by email or in the Service.
15. Contact
Quad99 Technologies — privacy questions and requests: privacy@quad99.com.