ReconFile

Privacy Policy

Effective November 14, 2026

This Privacy Policy explains how [COMPANY LEGAL NAME] ("we", "us") collects, uses, and shares information when you use ReconFile at https://reconfile.app (the "Service"). The Service is a business tool used by clinical research sites. It should be read together with our Terms of Service.

1. Information we collect

  • Account information: your email address, the organization, trial, and site names and numbers you enter, and your role.
  • Sign-in codes: one-time 6-digit codes we email you. Codes expire after 10 minutes.
  • Uploaded documents: regulatory documents you upload, such as FDA Form 1572, delegation logs, CVs, medical licenses, training certificates, and financial disclosure forms.
  • Extracted data: information we extract from those documents about site personnel, such as names, study roles, delegation dates, license numbers and status, issue and expiration dates, training records, CV contents, and financial disclosure answers.
  • Audit and security records: for each change you make, your user ID, the action, the time, your IP address, and your browser user agent.

We do not knowingly collect protected health information (PHI). Customers must de-identify documents before upload and must not upload patient information.

2. How we use information

  • To provide the Service: store your documents, extract and reconcile credential data, and show your dashboard.
  • To sign you in and keep your account secure.
  • To maintain an audit trail supporting FDA 21 CFR Part 11 recordkeeping.
  • To communicate with you about your account and the Service.
  • To troubleshoot, secure, and improve the Service.

We do not sell personal information, do not use it for advertising, and do not use your data to train AI models.

3. Service providers

We use the following providers to run the Service. They process data on our behalf and only to provide their service to us:

  • Amazon Web Services (AWS): AI-based extraction via Amazon Bedrock (Anthropic Claude models) and text recognition via Amazon Textract, in the US (us-east-1). AWS does not use this data to train models.
  • Neon: database hosting and object storage for uploaded documents, on AWS infrastructure in the US (us-east-1).
  • Resend: sending sign-in code emails.
  • Cloudflare: DNS and network edge for reconfile.app.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition, subject to this policy.

4. Cookies and local storage

We use one cookie, rf_session, which keeps you signed in. It is HTTP-only and expires after 30 days. We also store a flag in your browser's local storage so the first-visit tour is not shown again. We do not use analytics, advertising, or third-party tracking cookies.

5. Security

Data is encrypted in transit with TLS and at rest with AES-256. Access to customer data is limited to personnel who need it to operate the Service. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Retention and deletion

To support FDA 21 CFR Part 11 recordkeeping, audit records are append-only and are kept for as long as your account exists and for any longer period required by law or your regulatory obligations. Deleting a record in the Service marks it deleted rather than erasing it, so the history remains available for inspection.

You may request an export of your data or deletion of your account at any time by emailing [PRIVACY EMAIL]. We will confirm the request and respond within 30 days. Where records must be kept to meet regulatory or legal requirements, we will tell you what we retain and why, and delete it when that obligation ends.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to certain processing. Site personnel whose information appears in documents uploaded by a customer should contact that customer first; we will assist the customer in responding. To make a request, email [PRIVACY EMAIL].

8. Data location

The Service stores and processes data in the United States.

9. Children

The Service is for business use and is not directed to children under 16. We do not knowingly collect their information.

10. Changes

We may update this policy. We will post the new version here with a new effective date and notify account holders by email of material changes.

11. Contact

[COMPANY LEGAL NAME], [COMPANY MAILING ADDRESS]. Privacy questions: [PRIVACY EMAIL].

Terms of Service - Privacy Policy