HudlHealth Privacy Policy
Effective date: September 16, 2026
HudlHealth takes privacy and information security seriously. This Privacy Policy explains how personal data is handled when you visit hudlhealth.ai, request a demonstration, or use the application available at app.hudlhealth.com (together, the “Services”).
It applies to:
- website visitors and prospective customers;
- authorized professional users of HudlHealth, including clinical research teams, investigator sites, sponsors, and their partners; and
- individuals whose professional contact details are provided to administer or use the Services.
Important: clinical-research content
Customers must minimize the clinical-research information submitted to the Services and remove direct patient identifiers before submission. Coded or pseudonymized information may remain personal data and may constitute health data under applicable law. Users must not submit direct patient identifiers.
1. Who is responsible for your personal data?
When HudlHealth determines why and how data is processed
For the website, demonstration requests, user accounts, security, service administration, and customer relationships, the data controller is HudlHealth, the publisher of the HudlHealth service.
Privacy contact: nicolas@hudlhealth.com.
When HudlHealth processes customer and clinical-research data for a customer
When a research site, sponsor, or other organization uses HudlHealth to manage its teams, research operations, or coded patient information, that organization determines the purposes and essential means of the processing. In that situation, the organization acts as the data controller and HudlHealth acts as its processor, according to the organization’s documented instructions and the applicable data-processing agreement.
The customer is responsible for establishing an applicable legal basis under data-protection law and, where health data is involved, an applicable condition for processing special-category data; providing required information to participants; respecting research, confidentiality, and professional-secrecy requirements; and ensuring that only necessary data is submitted. HudlHealth does not determine whether a patient is eligible for a study and does not replace the judgment of an authorized healthcare or research professional.
2. Personal data we process
Depending on how you use the Services, we may process the following categories.
Website visitors and prospective customers
- first and last name;
- business email address and telephone number;
- job title, organization or institution, and country;
- information included in a demonstration, information, or contact request;
- communications with HudlHealth; and
- technical data required to operate and secure the website.
Authorized professional users
- account and professional profile data;
- organization membership, roles, permissions, and sharing settings;
- professional content created, imported, or submitted through the Services;
- usage and activity data; and
- technical, security, and audit data.
Clinical-research content
Customers may submit research protocols, study-operational information, and minimized, de-identified, coded, or pseudonymized clinical-research content. Because such content can sometimes permit indirect identification, HudlHealth handles it as potentially personal and sensitive unless it has been irreversibly anonymized.
3. Where personal data comes from
Personal data may be obtained:
- directly from you when you contact us, create or update an account, submit content, or use the Services;
- from your employer, institution, or an authorized administrator who invites you or assigns permissions;
- from an authorized customer or research team;
- from third-party services that a user or customer chooses to connect; and
- automatically when the Services are used.
4. Why we process personal data and our legal bases
| Purpose | Main legal basis when HudlHealth is the controller |
|---|---|
| Respond to demonstration, information, or access requests | Steps taken at your request before entering into a contract; legitimate interests in developing our business for general professional enquiries |
| Create, authenticate, and administer accounts | Performance of a contract or steps taken before entering into a contract |
| Provide the Services, host customer content, and provide support | Performance of a contract |
| Administer customer organizations and access rights | Performance of a contract; legitimate interests in administering and securing the Services |
| Prevent abuse, secure the Services, investigate incidents, and maintain continuity | Legitimate interests in protecting users, data, and the Services; applicable legal obligations |
| Maintain appropriate records and audit information | Legal or regulatory obligations; legitimate interests in integrity, traceability, and evidence |
| Process coded or pseudonymized clinical-research content for a customer | The customer determines the legal basis and applicable condition for health data; HudlHealth processes the data under the customer’s documented instructions and data-processing agreement |
| Measure feature usage and improve the Services | Legitimate interests in understanding and improving the Services, subject to users’ rights and applicable rules on browser storage and trackers |
| Comply with lawful authority requests and establish, exercise, or defend legal claims | Legal obligations; legitimate interests in establishing, exercising, or defending legal rights |
HudlHealth does not itself supply the customer's legal basis for processing patient information. A customer must not submit clinical data unless it is authorized to do so and the use complies with its agreement with HudlHealth.
Account and authentication data required to create and secure an account must be provided for the Services to function. If required information is not provided, HudlHealth may be unable to create an account or provide the requested feature. Optional profile fields may be left blank unless an organization requires them for its own lawful purposes.
5. Use of artificial intelligence
Some features use third-party artificial-intelligence service providers to process submitted content and generate requested outputs. Only the information reasonably necessary to provide the selected feature is shared with those providers, subject to applicable contractual and security safeguards.
AI-generated output may be inaccurate or incomplete and must be reviewed by an authorized professional. HudlHealth does not use solely automated processing to make clinical decisions or decisions producing legal or similarly significant effects on individuals. Customers must not submit direct patient identifiers to AI features.
6. Recipients and service providers
Personal data may be accessible, only as necessary and subject to appropriate authorization, to:
- users and administrators authorized by the relevant customer;
- people with whom a user chooses to share content or resources;
- authorized HudlHealth personnel responsible for support, security, service operation, or legal compliance;
- technical service providers needed to provide the Services; and
- professional advisers subject to confidentiality obligations where their assistance is necessary.
These recipients may include hosting and infrastructure providers, authentication providers, communications providers, artificial-intelligence service providers, customer-selected integrations, and professional advisers. They may process data only as necessary for their role and subject to appropriate obligations.
HudlHealth does not sell personal data or disclose it to third parties for their independent advertising purposes without an appropriate legal basis.
7. Sharing initiated by users
The Services may allow authorized users to share content with other recipients. Users and customers are responsible for selecting appropriate recipients and permissions, protecting access links, and revoking access when it is no longer required.
8. International data transfers
Some service providers may process personal data in countries other than the country in which it was collected. Where required by applicable law, HudlHealth uses recognized safeguards or other lawful transfer mechanisms.
To request information about the processing locations selected for your service and the safeguards that apply, contact nicolas@hudlhealth.com.
When HudlHealth acts as a processor, permitted hosting regions and transfers may also be specified in the customer agreement and data-processing agreement.
9. Data retention
Personal data is retained only for as long as necessary for the relevant purpose, and is then deleted or anonymized, unless longer retention is required by law, a regulatory obligation, the establishment or defense of legal claims, or documented customer instructions.
| Category | Retention period or criterion |
|---|---|
| Demonstration requests and prospective-customer data | While the request is handled and for a reasonable follow-up period, unless the individual objects or a different period is required |
| Account and professional profile data | For the contractual relationship or while the account remains active, then for the period needed to close the account, maintain evidence, and meet applicable obligations |
| Professional, study-operational, and coded or de-identified clinical content | For the period specified by the customer’s agreement or documented instructions; returned or deleted at the end of the service subject to applicable obligations |
| Security and audit records | For a period proportionate to security, traceability, evidentiary, contractual, and legal requirements |
| Backups and temporary archives | For the documented backup and restoration cycle, after which they are securely deleted or overwritten |
Closing an account may not result in the immediate deletion of every record. Some information may need to remain in restricted archives to comply with a legal obligation, preserve an audit trail, or defend legal rights.
10. Security
HudlHealth uses technical and organizational measures appropriate to the risk, including measures designed to protect confidentiality, integrity, availability, and authorized access. These measures are reviewed as the Services and relevant risks evolve.
No system can be guaranteed completely secure. Users must protect their credentials, avoid sharing access links, and promptly report suspicious activity to nicolas@hudlhealth.com.
Customers remain responsible for de-identifying and minimizing clinical content before submission. HudlHealth and the customer must document their respective security and data-protection responsibilities in the applicable agreement.
11. Cookies and browser storage
The Services use cookies or similar browser-storage mechanisms that are necessary for authentication, security, user preferences, and service operation. Where non-essential technologies require consent under applicable law, HudlHealth will request that consent before using them.
Users may configure their browsers to delete or block browser storage, but some features, including authentication, may then stop working.
12. Your rights
Subject to the conditions and exceptions in applicable data-protection law, you may have the right to:
- access your personal data;
- correct inaccurate or incomplete personal data;
- request deletion of your personal data;
- restrict the processing of your personal data;
- receive personal data you provided in a portable format where the right to portability applies;
- object to processing based on legitimate interests;
- withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal; and
- obtain information about safeguards used for an international transfer.
When HudlHealth is the controller, you may exercise these rights by contacting nicolas@hudlhealth.com. To avoid disclosing personal data to the wrong person, HudlHealth may request additional information to verify your identity where there are reasonable doubts about it.
When professional data is processed on behalf of a customer, you may also submit your request to that organization. HudlHealth will provide the assistance required under the applicable agreement and law.
You may also have the right to lodge a complaint with the competent data protection or supervisory authority in your country or region.
13. Children and patient accounts
HudlHealth accounts are intended for authorized professional users and not for use by patients or children. Clinical-research content concerning a minor may be processed only under the instructions and responsibility of an authorized customer with an applicable legal basis and safeguards. Direct patient identifiers are prohibited.
14. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes to the Services, service providers, or applicable law. The effective date appears at the top of the Policy. Where required by law, individuals will be informed through an appropriate channel before a material change takes effect.
15. Contact
For questions about this Privacy Policy or HudlHealth’s processing of personal data:
HudlHealth