Privacy Policy

1. About this policy

OurTrial Pty Ltd (ACN 702 835 854, ABN 58 702 835 854) ("OurTrial", "we", "us", "our") operates an Australian platform for running clinical trials and supporting clinical research. It connects trial teams (coordinators, investigators and site staff), doctors who refer patients, people who take part in research ("participants"), training providers and their trainees, and people a trial team shares reports with.

We handle personal information, including health information, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and applicable state and territory health records laws.

This policy explains what we collect, why, who can see it, how long it is kept, and your rights. Questions: privacy@ourtrial.com.au.

2. Who holds your information

• The trial team (the research site or organisation running a trial) decides what information is collected for their trial and is responsible for their trial records under research ethics and Good Clinical Practice obligations.
• The training provider (the institution whose training space a trainee belongs to) decides what it tracks about its trainees and is responsible for its training records.
• OurTrial operates the platform these organisations use, holds the information on their behalf, and protects it. We also hold the account information we need to run the platform.

If your question is about a specific trial or training programme, that team is the right first contact. We will help route any request that comes to us.

3. What we collect

3.1 Participants

• Name, preferred name, date of birth, sex at birth, gender and pronouns (gender and pronouns optional)
• Email, mobile number and location (suburb, state, postcode)
• Health information you or your care team provide for a trial, which may include: expressions of interest, screening questionnaire answers, eligibility checks, signed consent forms, visit and appointment records, adverse events, pregnancy events, hospital visits you report, and reasons for withdrawal
• Referral information from your doctor (for example a referral letter or clinical summary)
• Messages and text messages between you and the trial team
• Identity checks: in person (a coordinator confirming your date of birth or sighting photo ID) or through our identity provider (Section 6.6). From a provider check we keep only the result, whether your name and date of birth matched your record, the date and the provider's reference number — never the document, its number or any image
• Your notification preferences, including whether you have stopped text messages

3.2 Doctors

• Name, title, AHPRA registration number, workplaces, state of practice, subspecialty interests and optional biography
• Work email and phone number
• The patients you refer and your trial subscriptions
• Further verification details you choose to provide (for example, a health-service email address)

3.3 Trial staff and investigators

• Name, position, organisation, work email, phone and mobile number
• Study roles and responsibilities recorded in a trial's delegation log, including signatures (by account or by emailed code), training records and credentials with their expiry dates
• Actions taken on the platform (see Section 8, the audit trail)
• Billing details for paid plans (card details are held by our payment provider, not by us)

3.4 Training directors, training teams and trainees

• Name, work email, institution and role
• For trainees: training stage, year level, start and finish dates, project title, type and progress, milestones, and survey answers given at project milestones
• Notes between a trainee and their training team or supervisor
• Posts on the institution's research community board

3.5 People a view is shared with (supervisors, sponsors, funders, directors)

• Name as entered by the person sharing, email address, when you viewed, and a remembered-device token if you choose it

3.6 Everyone

• Login details (email and an encrypted password, or sign-in by emailed one-time code) and sign-in activity
• Files you upload and messages you send
• Technical information needed for security and to fix faults (for example, error reports and IP address)
• How trial staff use dashboard features, so we can improve them
• What participants and doctors search for and open on the platform, stored without any link to the person (Section 5)

4. How we collect it

• From you, when you sign up, complete forms, sign documents, send messages or post.
• From your doctor, when they refer you to a trial. Your doctor discusses the referral with you before making it.
• From a trial team, when they add you to their trial directly (for example, if you enrolled in person). If they record your email or mobile, you may receive an invitation to link your record to an OurTrial account.
• From your training provider, when it imports you into its training space, which sends you an invitation.
• From the person sharing with you, when a trial team or trainee shares a view and enters your email.
• From our service providers, such as confirmation that a document was signed, a text was delivered, or an identity check matched.
• Automatically, through security and error monitoring.

5. How we use it

• To run trials: recruitment, screening, consent, scheduling, visits, safety reporting, delegation and communication between you and the trial team
• To run training spaces: tracking project progress, notes, supervisor sharing and the community board
• To send notifications by email, in-app, and (where a trial uses it) SMS
• To verify doctors (AHPRA), identities (where a trial requires it) and organisations
• To keep the platform secure, prevent misuse, and fix faults
• To bill organisations for paid plans, number subscriptions and add-ons
• To produce de-identified statistics and benchmarks (Section 6.4)
• To understand how the platform is used. Searches and clicks by participants and doctors are stored anonymously, and we use them to improve search results and, in aggregate, to show trial teams what kinds of trials attract interest. Our own analysis of platform usage uses aggregate figures only; no person's data is sent to an AI service
• To meet legal and regulatory obligations

We do not sell personal information and do not use it for advertising.

6. Who can see it

6.1 The trial team

Trial staff see participant information only for trials they are authorised to work on. Staff at one site see only their site's participants. Investigators see the participants within the scope of their appointment. Participant information is never shared between unrelated trials or organisations, with two exceptions that protect your safety:

• If you report a symptom, a hospital visit, or a trial team records an event about your health, the teams of the other trials you are enrolled in are told so that each can check it against its own treatment.
• If you are enrolled in more than one trial on the platform, each of those trial teams is told the name of the other trial so they can check the trials are safe to combine.

6.2 Your referring doctor

If a doctor referred you, they can see your progress through that trial (the stage you are at, not your visit-by-visit details) and documents the trial team chooses to share with them.

6.3 You

Participants can see their own record for each trial, including consent documents, visits, what has happened in the trial and every export that included them, and can download a copy. Internal team notes are not shown. Trainees can see their own project record, their notes threads and when their supervisor last viewed their shared progress; internal training-team notes and the team–supervisor thread are not shown to the trainee, though the trainee is told that thread exists.

6.4 Sponsors, directors, training teams and de-identified data

We do not give identifiable participant information to trial sponsors, pharmaceutical companies, directors or training providers.

• Live reporting. A trial team can share a live report of a trial with named people (for example a sponsor, funder or director). Reports contain counts, rates and dates only — never a participant's name, contact details or free text. The trial team controls what is shared, with whom and for how long.
• Training spaces. Where a trainee's project is linked to a trial, the training team sees the trial's stage and progress figures only.
• Directors of research (coming). An institution's research director will see its trials in aggregate only.
• Benchmarks and insights. We use de-identified, aggregated figures across the platform to show trial teams how their trials compare, and to report which kinds of trials attract interest. No benchmark or insight identifies a participant, patient, trainee or individual trial unless that trial's team chooses to be named.

Any reporting of safety events to a sponsor is done by the trial team, as required by their trial.

6.5 Exports

Trial teams can export their trial records. Exports are either coded (participants identified by a study code) or identified. Every export is recorded in the audit trail, and participants can see when an export included them. Once exported, the trial team is responsible for the file.

6.6 Service providers

These providers act on our instructions and may not use your information for their own purposes. Where information goes overseas, we take reasonable steps to ensure it is handled consistently with the APPs, and we limit what is sent (for example, emails to trial staff identify participants by study code rather than by name, and error reports exclude request contents).

6.7 Legal requirements

We may disclose information where required or authorised by law, or where necessary to lessen a serious threat to someone's life, health or safety.

7. How we protect it

• Data is encrypted in transit and stored in Australia
• Database-level access controls, so each person only reaches what their role, trial, site, appointment or space permits
• Files are only accessible through short-lived, signed links; exported files are single-use links that expire
• Passwords must be at least 12 characters and are checked against known breached passwords; one-time codes are single-use and time-limited
• Bot protection on sign-up, sign-in and shared-view code requests
• An append-only audit trail with a daily tamper check
• Identity documents are never stored on our systems

No system is perfectly secure. Please use a strong, unique password and tell us immediately if you suspect unauthorised access.

8. The audit trail

Clinical trials must keep a reliable record of what happened, when, and who did it. The platform keeps an audit trail that cannot be edited or deleted. It records actions such as consent being given, delegations accepted, visits booked, safety events reviewed, data exported, and shared views opened. Participants appear in it by study code. Trial staff and investigators remain named in it.

9. How long we keep it

• Accounts are kept while active.
• Trial records for participants who consented to a trial are kept for at least 15 years, as required for clinical trial records, on behalf of the trial team.
• Screening records for people who did not go on to consent are kept as part of the trial's screening log.
• Audit trail records are kept permanently.
• Export files are deleted from our systems 7 days after they are created.
• Support attachments are deleted 30 days after they are sent.
• Text message content is removed when a participant's account is erased; the record that a message was sent remains.
• Training records are kept for the training provider while its space is active and for 7 years after a trainee's project closes, unless the provider asks for earlier deletion.
• Trial staff and investigator accounts are deactivated rather than deleted when someone leaves, so the trial's record of who did what remains intact.
• Identity check results are kept with the participant's trial record; a verification may be reused by another trial you join, with your knowledge.

10. Deleting your account

Participants and doctors can delete their account at any time from their profile.

When a participant deletes their account, we remove the account: login, preferences, in-app messages, text message content and the link between you and your trial records. The trial records themselves are retained by the trial team as described in Section 9, because research ethics and trial regulations require it. If you are part of an active trial, the trial team and your referring doctor are notified so your care is not interrupted. Deleting your account is not the same as withdrawing from a trial; to withdraw, tell the trial team.

Trainees can close their account; their project record stays with the training provider's space.

Trial staff, investigators and training team members should contact us to close an account.

11. Your rights

You can ask to access or correct your personal information, or complain about how we have handled it. Participants can view and download their own trial record from their account at any time.

Contact privacy@ourtrial.com.au. We respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12. Data breaches

If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will tell affected trial teams and training providers.

13. Cookies

On the platform we use only the cookies needed to keep you signed in and secure, and browser storage for display preferences. On our marketing website we ask before setting analytics cookies; you can decline them. We do not use advertising cookies or cross-site tracking.

14. Children

You must be 18 or over to create an OurTrial account.

15. Changes

We will notify registered users by email of material changes, update the version and date above, and ask you to accept the new version at your next sign-in.

16. Contact

OurTrial Pty Ltd · ABN 58 702 835 854 · Ground Floor, 470 St Kilda Rd, Melbourne VIC 3004

Privacy: privacy@ourtrial.com.au

General: hello@ourtrial.com.au