Privacy Policy

The website https://evalusresearch.com/ ("Website") and the Evalus clinical trial technology platforms, including the AI-enabled Electronic Data Capture (EDC) system, Clinical Trial Management System (CTMS), electronic Patient/Clinical Outcome Assessment tools (ePRO/eCOA), electronic Informed Consent (eConsent), Interactive Web Response System (IWRS/RTSM), Trial Master File (TMF) platform, EMR integration and Physician Survey platform, along with any related mobile applications (together, the "Platform"), are operated by Digicare Health Solutions Private Limited under the brand Evalus Research ("Evalus", "we", "us" or "our"). Digicare is a company incorporated under the Companies Act, 2013, with its registered office at 4th Floor, Plot No. 115/5, TP Scheme No. 51, Off Ambli-Bopal Road, Makarba, Ahmedabad, Gujarat 380058, India.

We are committed to protecting the personal data shared with us through the Website, the Platform, and the clinical research services we provide (together, the "Services"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices and rights available to you. It forms part of, and should be read together with, the Terms of Use of the Website and any agreement governing your use of the Platform (together, the "Agreement").

This Privacy Policy is issued in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, as and when their provisions come into force, and the New Drugs and Clinical Trials Rules, 2019. Where applicable, we also comply with the EU and UK General Data Protection Regulation ("GDPR"), the Swiss Federal Act on Data Protection and the US Health Insurance Portability and Accountability Act ("HIPAA"), as described in Section 12.

Please read this Privacy Policy carefully before using the Website or Platform. Where we rely on your consent, we will request it in a clear, specific and informed manner, and you may withdraw it at any time as described below. If you use the Services on behalf of an organisation (such as a sponsor, clinical trial site or hospital), you confirm that you are authorised to accept this Privacy Policy on its behalf. If you do not agree with this Privacy Policy, please do not use the Website or Platform. By submitting Personal Data through the Website, Platform, registration forms, eConsent modules or survey tools, you expressly consent to the collection, use, processing, storage and transfer of such information as described in this Privacy Policy.

If we make changes to this Privacy Policy, we will post the updated version on the Website and, where changes are material, notify you through the Platform or by email. This Privacy Policy is available in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India.

This Privacy Policy applies to you if you are:

Sponsor or Client: a pharmaceutical, biotechnology, diagnostics, medical device or MedTech company, hospital or research organisation that engages Evalus for clinical research services or Platform access, including its authorised personnel ("Sponsor").

Site Personnel: a principal investigator, sub-investigator, study coordinator, clinical research associate, monitor, data manager, pharmacist or other authorised person at a clinical trial site who uses the Platform ("Site Personnel").

Trial Participant: a person enrolled in, or being screened for, a clinical trial, observational study, registry, real-world evidence study or post-marketing surveillance study supported by our Services, and, where applicable, their legally authorised representative, parent or guardian ("Trial Participant").

Physician or Survey Respondent: a healthcare professional who takes part in surveys, market research or insight programs through our Physician Survey Platform ("Survey Respondent").

Visitor or Business Contact: anyone who visits the Website, submits the contact or demo request form, subscribes to our newsletter, registers for webinars or events, downloads resources, or applies for a job with us ("Visitor").

In this Privacy Policy, "you" and "User" refer to any of the above, as the context requires.

Our responsibilities depend on the type of data and the service involved.

When we act on behalf of a Sponsor (Data Processor): for most clinical trial data entered into or generated through the Platform (such as case report forms, ePRO responses, eConsent records, randomisation and drug supply records, and trial master file documents), the Sponsor determines the purpose and means of processing and is the Data Fiduciary (data controller). Evalus processes such data only on the Sponsor's documented instructions, under a written agreement, and for the purposes of that study. If you are a Trial Participant, the informed consent form you signed for the study and the Sponsor's or site's privacy notice describe how your study data is used. Requests about your trial data should ideally be made to the study site or Sponsor, and we will support them in responding.

When we act for ourselves (Data Fiduciary): we determine how data is used for Website visitors, business contacts, Platform user accounts (login, access and audit data), Survey Respondents, job applicants, and for studies where Evalus itself acts as the sponsor or full-service CRO responsible for the data. In these cases, this Privacy Policy governs our processing directly.

Personal Data: any data about an individual who is identifiable by or in relation to that data, such as name, email address, phone number, employee ID or IP address.

Health Data: personal data about a person's physical or mental health, including medical history, diagnoses, laboratory results, vital signs, adverse events, concomitant medications, outcome assessments and other clinical information.

Pseudonymised Data: data in which direct identifiers are replaced with a code (such as a subject ID or screening number), so that it cannot be linked to an individual without additional information held separately under strict controls. Most clinical trial data on the Platform is pseudonymised.

De-Identified or Anonymised Data: data that cannot reasonably be used to identify an individual, such as aggregated statistics.

Data Fiduciary and Data Processor: have the meanings given in the DPDP Act.

Cookies: small data files placed on your browser or device when you visit the Website or use the Platform.

The information we collect depends on how you interact with us.

Category of User

Information collected

Visitors and business contacts

First and last name, email address, company, phone number, therapeutic area, service interest, project timeline and message submitted through the contact or demo form; newsletter and webinar registrations; resources downloaded; job applications and CVs.

Sponsors and Site Personnel (Platform users)

Name, designation, organisation, site details, professional qualifications, GCP training records, CVs and delegation logs (for TMF and site management), email, phone, username, password (stored in hashed form), role and access permissions, electronic signatures, and audit trail records of actions taken on the Platform.

Trial Participants (usually pseudonymised)

Subject or screening ID, demographics (such as age or year of birth, sex, ethnicity where required by protocol), medical history, diagnoses, vital signs, laboratory and diagnostic results, imaging, adverse events, concomitant medications, patient-reported outcome responses, visit data, randomisation and investigational product dispensing records.

Trial Participants (identifiable, limited cases)

Where required for eConsent, ePRO, reminders or telemedicine features: name, contact number, email, signature, and identity or consent verification records, including audio-video recording of consent where mandated by regulation. This data is kept separate from pseudonymised study data under restricted access.

Data from EMR integration

Clinical data transferred from electronic medical records, only where authorised by the site and permitted by the participant's consent and the study protocol.

Survey Respondents

Name, contact details, specialty, practice location, registration number, survey responses, and bank or payment details for honoraria or incentives.

Payment and billing

Billing contact, invoicing and payment information for Sponsors and clients. Card or bank payments are processed through approved payment gateways; we do not store full card details.

We collect this information directly from you, from Sponsors and clinical trial sites who enter it into the Platform, from integrated systems (such as EMRs, laboratories and devices) authorised by the site or Sponsor, and automatically through your use of the Website and Platform. You may request correction, updating or completion of your Personal Data by contacting the Grievance Officer or submitting a request through designated Platform channels.

Device and log information: IP address, browser type, device type, operating system, time zone, access times, pages viewed and referring URLs.

Platform audit trails: as required by Good Clinical Practice and 21 CFR Part 11 / EU Annex 11 principles, the Platform automatically records who created, modified or deleted data, when, and why. Audit trails cannot be altered and are retained for the period required for the study.

Cookies: the Website uses essential cookies (needed for the site to work and for secure login), and, with your consent where required, analytics cookies that help us understand how the Website is used. You can manage cookies through your browser settings or our cookie banner. Blocking essential cookies may prevent you from logging in to the Platform.

Analytics: we may use tools such as Google Analytics to understand Website traffic in aggregate. We do not use analytics or advertising cookies inside the Platform areas that hold clinical trial data.

Mobile and ePRO apps: where Trial Participants or Site Personnel use a mobile app, we may collect device model, operating system version, app version and crash reports to maintain and fix the app, and may use push notifications for visit reminders and questionnaire alerts. Offline data captured on the device is encrypted and synced to the Platform when a connection is available.

Location: we do not collect precise real-time location. Approximate location derived from IP address may be used for security and fraud prevention.

The Platform uses artificial intelligence, machine learning and, in some features, large language models ("AI") to support activities such as:

real-time data validation and detection of anomalies, missing values and inconsistencies;

automated query generation for data clarification;

predictive analytics on recruitment, dropout risk and trial timelines;

risk-based monitoring, protocol deviation flagging and site performance analysis; and

automated reporting and document management.

We apply the following safeguards to AI processing:

Human oversight: AI outputs are decision-support tools. Queries, data changes, medical and safety assessments and regulatory decisions are reviewed and confirmed by qualified people. No decision about a Trial Participant's eligibility, treatment or safety is made solely by automated means.

Data minimisation: AI features process pseudonymised study data wherever possible and only the data needed for the feature.

No training on Sponsor data without permission: we do not use a Sponsor's identifiable or study-specific data to train general-purpose AI models unless the Sponsor has agreed in writing. We may use De-Identified or aggregated data to improve the accuracy and safety of our AI features, as permitted by law and our agreements.

Third-party AI providers: where we use external AI or LLM service providers, they act as our sub-processors, are bound by confidentiality and data protection terms, and are not permitted to use the data for their own purposes.

Validation: AI-enabled functions used in regulated trial activities are validated in line with applicable computerised system validation requirements.

We use personal data only for specified, lawful purposes, including to:

provide, operate and maintain the Platform and our clinical research services (protocol development, data management, monitoring, regulatory affairs, medical affairs and trial management) in line with the study protocol and Sponsor instructions;

create and manage user accounts, authenticate users, apply role-based access and maintain audit trails;

conduct data validation, query management, database lock and statistical reporting for studies;

support pharmacovigilance, safety reporting and adverse event management as required by law and the protocol;

send ePRO reminders, visit notifications and study-related communications to Trial Participants and Site Personnel;

respond to enquiries, demo requests and consultation requests, and provide training, onboarding and technical support;

send newsletters, webinar invitations and information about our services to business contacts, where you have opted in (you can unsubscribe at any time);

administer physician surveys and pay honoraria or incentives;

evaluate job applications;

improve, test, validate and secure the Website and Platform, including our AI features, using De-Identified or aggregated data where possible;

detect, prevent and investigate fraud, security incidents and misuse; and

comply with legal and regulatory obligations, including inspections and audits by regulators, ethics committees and Sponsors.

We do not use Trial Participant data for marketing or advertising, and we do not sell personal data.

We share personal data only as described below, and only to the extent necessary:

With the Sponsor of a study: study data is shared with the Sponsor and its authorised representatives in pseudonymised form, as set out in the protocol and informed consent. Identifiable participant data is not shared with the Sponsor except where the law or the participant's consent permits (for example, for safety reporting or source data verification by authorised monitors).

With clinical trial sites and investigators: to conduct the study, including access to their own site's data.

With regulators and ethics committees: including the Central Drugs Standard Control Organisation (CDSCO) / Drugs Controller General of India (DCGI), Ethics Committees, the US FDA, EMA and other health authorities, for inspections, audits, submissions and safety reporting.

With service providers and sub-processors: such as cloud hosting, data backup, email and SMS delivery, eConsent and video tools, payment gateways, central laboratories, translation services and AI service providers. They are bound by written contracts to keep data confidential, protect it and use it only for our instructions. A current list of key sub-processors is available upon request or through the Website.

Across Digicare brands: Evalus Research, TatvaCare and GoodFlip are brands of the same legal entity, Digicare Health Solutions Private Limited. Evalus clinical trial data is kept logically separate from TatvaCare and GoodFlip products, with separate access controls, and is not used for those products or their users. Personnel working across brands access Evalus data only where needed to provide the Services. We may share data with any subsidiaries or affiliates of Digicare only where needed to provide the Services and subject to this Privacy Policy.

Business transfers: in connection with a merger, acquisition, restructuring or sale of assets, to a successor bound by confidentiality and data protection obligations, with notice to affected users where required.

Legal requirements: when required by law, court order or a lawful government request, or to protect the rights, safety or property of Evalus, our users or others.

De-Identified or aggregated data: we may share or publish De-Identified or aggregated data (for example, platform performance statistics or scientific publications) where it cannot reasonably identify any person, and subject to Sponsor agreements for study data.

With your consent: in any other case where you have given consent.

No-Automated Decision making: Evalus does not make solely automated decisions producing legal or similarly significant effects on individuals.

Because clinical trial data is highly sensitive and closely regulated, we apply additional protections:

Informed consent first: participant data is collected only after informed consent has been obtained by the site under the approved protocol, the New Drugs and Clinical Trials Rules, 2019, ICMR National Ethical Guidelines and ICH-GCP. Where eConsent is used, the Platform records the consent version, date, time and signatures, and supports audio-video consent recording where required.

Pseudonymisation: participants are identified in study data by a subject ID. The key linking the ID to identity is held by the site, not in the study database.

Access controls: role-based access means users see only the studies, sites and data their role requires. Unblinded data (such as randomisation codes in IWRS) is restricted to authorised unblinded personnel.

Data integrity: the Platform is designed to support ALCOA+ principles, electronic records and signatures requirements under 21 CFR Part 11 and EU Annex 11, and computerised system validation.

Data standards: study data can be structured to CDISC standards for regulatory submission.

Withdrawal from a study: if a Trial Participant withdraws consent, no new data will be collected, but data already collected may be retained and used as permitted by the informed consent, the protocol and applicable regulations, to protect the scientific integrity of the study and participant safety.

Storage and cross-border transfer. Personal data is stored on secure cloud infrastructure located in India. Where a study, Sponsor or service provider is located outside India, data may be transferred outside India. Any such transfer is made only to countries not restricted by the Government of India under the DPDP Act, under contractual safeguards, and in line with the study's informed consent and applicable law.

Retention. We keep personal data only for as long as needed for the purpose it was collected for, or as required by law:

Type of data

Retention period

Clinical trial data, essential documents and audit trails

As required by the Sponsor agreement and applicable law, for example at least 5 years after completion or discontinuation of the trial under the New Drugs and Clinical Trials Rules, 2019, or longer where other regulators require it (for example, 25 years for the trial master file under Article 58 of the EU Clinical Trials Regulation (EU) No 536/2014). At the end of the retention period, data is returned to the Sponsor or securely deleted, as instructed.

Platform user account data

For the duration of the account and the related study retention period, because audit trails must identify who performed each action.

Contact form, newsletter and business contact data

Until you unsubscribe or ask for deletion, or for 3 years after our last interaction.

Survey Respondent data

For the duration of the survey program and as required for financial and tax records.

Job applications

For 12 months after the recruitment process ends, unless you agree to a longer period.

Security. We use reasonable security practices designed to protect personal data, aligned with ISO/IEC 27001 practices, including encryption in transit and at rest, role-based access control, multi-factor authentication for privileged access, audit logging, network security monitoring, automated backups and disaster recovery, vendor security assessments, and staff training on data protection and GCP. No system is completely secure, but we work continuously to protect your data.

Data breaches. If a personal data breach occurs, we will act promptly to contain it. We will report cyber security incidents to CERT-In within 6 hours of becoming aware of them, as required by the CERT-In Directions of 28 April 2022, and will notify affected Sponsors under our agreements. Once the relevant provisions of the DPDP Act are in force, we will also notify the Data Protection Board of India and affected individuals as required.

Evalus supports Sponsors and studies across APAC and globally. The following additional terms apply where relevant.

Individuals in the European Economic Area, the United Kingdom or Switzerland (EU GDPR, UK GDPR and Swiss FADP). In this section, "GDPR" includes the UK GDPR and, for Switzerland, the revised Federal Act on Data Protection ("FADP").

Roles: for clinical trial data, the Sponsor is usually the controller and Evalus is a processor acting under a Data Processing Agreement that meets Article 28 GDPR. For Website, business contact and account data, Evalus is the controller.

Legal bases: we process personal data on the basis of your consent (for example, marketing emails and non-essential cookies), performance of a contract (providing Platform access and Services), legal obligations (clinical trial, safety reporting and record-keeping laws), and our legitimate interests (securing and improving our Services and responding to business enquiries), balanced against your rights. Health data in clinical research is processed under Article 9(2) GDPR, including for reasons of public interest in the area of public health, scientific research, and compliance with clinical trial regulations, or with explicit consent where required.

Your GDPR rights: in addition to the rights in Section 13, you have the right to data portability, to object to processing based on legitimate interests, to restrict processing, and to lodge a complaint with your local data protection supervisory authority. Some rights may be limited for clinical trial data to protect the reliability of the research, as permitted by GDPR and the EU Clinical Trials Regulation (EU) No 536/2014.

International transfers: where personal data is transferred from the EEA, UK or Switzerland to India or other countries, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with the adaptations required under the Swiss FADP, together with supplementary security measures.

Breach notification: where we act as controller, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying personal data breach; where we act as processor, we will notify the Sponsor without undue delay.

EU/UK representative: Data Protection Officer: as our core activities involve large-scale processing of health data, we have appointed a Data Protection Officer under Article 37 GDPR, who can be contacted at support.evalus@tatvacare.in

Protected health information in the United States (HIPAA).

Where Evalus creates, receives, maintains or transmits protected health information ("PHI") on behalf of a HIPAA covered entity or business associate, we do so as a business associate under a Business Associate Agreement.

We use and disclose PHI only as permitted by that agreement and HIPAA, including research uses authorised by the individual or approved by an Institutional Review Board or Privacy Board, or using de-identified data or limited data sets under a data use agreement.

We maintain administrative, physical and technical safeguards in line with the HIPAA Security Rule, and will report breaches of unsecured PHI to the covered entity as required by the HIPAA Breach Notification Rule.

Individuals should direct requests to access or amend their PHI to the covered entity (for example, the study site or healthcare provider), and we will support the covered entity in responding.

Other jurisdictions. Where a study involves participants in other countries (for example, Singapore under the Personal Data Protection Act 2012), we process personal data in line with the local law and the study agreements.

Subject to applicable law, you have the right to:

access a summary of the personal data we process about you, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, along with a description of the data shared;

request correction, completion or updating of inaccurate or incomplete data;

request erasure of personal data that is no longer needed, unless we must keep it by law (including clinical trial record retention rules);

withdraw consent at any time, with the same ease with which it was given (withdrawal does not affect processing already carried out, and may limit some Services);

nominate another person to exercise your rights in the event of death or incapacity; and

raise a grievance with us and, if not satisfied, with the Data Protection Board of India.

To exercise these rights, write to the Grievance Officer below. For clinical trial data processed on behalf of a Sponsor, we may direct your request to, or coordinate it with, the study site or Sponsor. Corrections to trial data are made through the site so that the audit trail is preserved. We may need to verify your identity before acting on a request.

Exercising Your Privacy Rights

You may exercise your privacy rights, including requests to access, correct, update, erase, withdraw consent, or otherwise manage your Personal Data, by contacting our Privacy Team or Grievance Officer using the contact details provided in this Privacy Policy.

To protect your information, Evalus may verify your identity before processing a request. Where Evalus processes Personal Data on behalf of a Sponsor, customer, healthcare institution, or other third party, we may direct your request to the relevant organization responsible for determining the purposes of processing.

The Website is not intended for children. Some clinical trials may involve participants under 18 years of age. In such cases, personal data is processed only with verifiable consent of the parent or legal guardian (and the child's assent where appropriate), as required by the DPDP Act, the New Drugs and Clinical Trials Rules, 2019 and ethics committee approval. We do not track, behaviourally monitor or target advertising at children. Where a person with a disability has a lawful guardian, we process their personal data only with the verifiable consent of that guardian, as required by the DPDP Act.

The Website may link to third-party sites, such as event pages or social media. We are not responsible for their privacy practices and encourage you to read their privacy policies.

We may update this Privacy Policy from time to time. The updated version will be posted on the Website with a revised "last updated" date. Where changes are material, we will notify you by email or through the Platform, and seek fresh consent where the law requires.

This Privacy Policy is governed by the laws of India. Subject to any mandatory rights you have under the laws of your country of residence (including under GDPR), the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction over any dispute arising from or relating to this Privacy Policy.

In accordance with the DPDP Act and the Information Technology Act, 2000, the details of our Grievance Officer are:

Name: Nutan Kumari Mishra

Designation: Sr. HR Director

Email: nutan.mishra@tatvacare.in

Phone: +91 98457 66699

Address: Digicare Health Solutions Private Limited (Evalus Research), 4th Floor, Plot No. 115/5, TP Scheme No. 51, Off Ambli-Bopal Road, Makarba, Ahmedabad, Gujarat 380058, India

We will acknowledge your grievance promptly and resolve it within one month of receipt, as required by the SPDI Rules. Requests under GDPR will be answered within one month, extendable by up to two further months for complex requests, in which case we will inform you. Where the DPDP Rules prescribe a different period, we will follow that period.