Privacy Policy

Effective date: [DATE] · Last updated: [DATE]

Draft pending attorney review. A working draft for counsel to finalize against your actual data practices and applicable law. It is not legal advice and is not yet in force. TODO: the operating entity (Philadelphia Pharmaceutical Research, LLC) is an interim placeholder to be replaced by the final CRA Union entity; if you accept EU/UK users, counsel should confirm the GDPR/UK-GDPR section, appoint any required Art. 27 representative, and finalize your legal bases and transfer mechanism.

This Privacy Policy explains how Philadelphia Pharmaceutical Research, LLC (“CRA Union,” “we”) collects, uses, and shares information when you use The CRA Union (the “Service”). By using the Service you agree to this Policy.

1. Information we collect.

Account & profile: name, email, password (hashed), role, organization, and — for CRAs — headline, experience, credentials, certifications, therapeutic/phase/system expertise, languages, home city/state, availability, and rate expectations.
Engagement data: applications, invitations, offers and negotiation history, messages, timesheets, expenses, site assignments, and feedback.
Payment data: we do not store tax IDs (EIN/SSN), full bank account numbers, or card numbers. Our payment processor (Stripe) collects and holds payment, payout, tax-ID, bank, and identity-verification details; we retain only limited, non-sensitive references (e.g. payout status, a Stripe account reference, and transaction records).
Documents you upload: CVs, protocol synopses, or scopes of work you provide for parsing/auto-fill.
Usage & device: server log data and IP address needed to operate and secure the Service (e.g. authentication, rate-limiting, and abuse prevention). We do not run third-party analytics or advertising trackers.

2. How we use information.

To provide and improve the Service — including matching CRAs and Sponsors, computing distance/travel and savings estimates, facilitating communication and contracting, processing payments and payouts, verifying accounts, preventing fraud and abuse, sending transactional and (with your consent where required) marketing messages, and complying with law.

3. Service providers (processors) we share with.

We share information with vendors that process it on our behalf under contract, including: Stripe(payments/payouts), our email provider (transactional and notification email), our hosting/database provider, a geocoding provider (to convert a city or address into coordinates for distance matching), and an AI provider (to parse documents you submit for auto-fill). We do not sell your personal information.

4. Sharing between users.

Your profile and engagement information is shared with the counterparties you interact with (e.g. a Sponsor you make an offer to, or a CRA you invite). Confidential protocol information is gated behind the NDA. Sponsor identity can be hidden on confidential listings.

5. Legal & safety disclosures.

We may disclose information to comply with law or valid legal process, to enforce our Terms, or to protect the rights, safety, and property of users or the public.

6. Cookies.

We use only strictly necessary cookies: a session cookie that keeps you signed in, a security token cookie that prevents cross-site request forgery, and a short-lived functional cookie that remembers the account type you chose during signup. We do not use advertising cookies or third-party analytics/tracking cookies, and we do not track you across other websites. Because these cookies are essential to provide the Service, they do not require consent under EU/UK ePrivacy rules; if we later add non-essential cookies (e.g. analytics), we will present a consent mechanism first.

7. Data retention.

We retain information for as long as your account is active and as needed to provide the Service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce agreements. Payment and payout records may be retained longer to meet financial-recordkeeping requirements.

8. Security.

We use administrative and technical safeguards (including password hashing, access controls, and encrypted transport) to protect information. No method of transmission or storage is perfectly secure.

9. Your choices & rights (US).

You may review and update your profile at any time and manage marketing preferences at your email preferences or via the unsubscribe link in any marketing email. Depending on your US state of residence (e.g. California, Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws), you may have the right to request access to, correction of, a copy of, or deletion of your personal information, and to opt out of the “sale” or “sharing” of personal information or targeted advertising. We do not sell or share personal information and do not conduct targeted advertising. To exercise a right, contact us using the details below; we will verify your request and respond within the timeframe required by law, subject to legal retention limits. We will not discriminate against you for exercising these rights.

10. Health information.

The Service is not intended to store protected health information (PHI) or patient data, and users are prohibited from posting it. We are not a HIPAA covered entity or business associate with respect to the matching/marketplace functions.

11. Children.

The Service is not directed to anyone under 18, and we do not knowingly collect information from children.

12. EU/UK users — GDPR & UK GDPR.

The Service is currently operated for a United States audience. If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland and you use the Service, the following applies and Philadelphia Pharmaceutical Research, LLC is the controller of your personal data.

Legal bases. We process personal data to (i) perform our contract with you (providing the Service, matching, contracting, payments); (ii) pursue our legitimate interests(securing the Service, preventing fraud/abuse, and improving the product) where not overridden by your rights; (iii) with your consent where required (e.g. non-essential marketing); and (iv) to comply with legal obligations (e.g. tax and financial-recordkeeping).
Your rights. Subject to law, you may request access, rectification, erasure, restriction, and portability of your personal data, and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
International transfers. Your data is processed in the United States. Where we transfer EEA/UK/Swiss personal data internationally, we rely on an appropriate safeguard such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), together with supplementary measures as needed.
Retention. We keep personal data only as long as necessary for the purposes above and to meet legal obligations, then delete or anonymize it.
Complaints. You have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office).
[TODO for counsel: appoint and name an EU/UK Article 27 representative if/when the Service is offered to EU/UK data subjects, and confirm the legal bases and transfer mechanism.]

13. Changes & contact.

We may update this Policy; material changes will be notified through the Service or by email. Contact: Philadelphia Pharmaceutical Research, LLC, 7067 Corning Road, Zionsville, PA 18092, contact us.