Introduction
Thank you for visiting the website operated by ResFlow. ResFlow (“ResFlow”, “we”, “us”, or “our”) provides a clinical research site operations platform designed to help research sites manage participants, studies, visit schedules, operational logs, bookings, and study-related administrative workflows.
We are committed to protecting your privacy and ensuring that personal information is handled responsibly. This Privacy Policy is governed by and prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), where applicable.
By accessing or using ResFlow, you acknowledge that you have read and understood this Privacy Policy and that your personal data will be processed in accordance with it and applicable UK data protection laws. We may update this Privacy Policy from time to time to reflect changes in our business practices, legal obligations, or regulatory requirements. The updated version will be posted on our website and take effect on the date stated in the revised policy.
Roles and responsibilities
For participant and study-related information entered into ResFlow by a customer organisation:
The relevant customer organisation, research site, sponsor, or other responsible entity acts as the Data Controller, as determined by the applicable study arrangements and data protection documentation.
ResFlow acts as the Data Processor and processes such information only on documented instructions from the customer organisation, unless required by law.
For information submitted directly to ResFlow through our website, contact forms, demo requests, support requests, account registration, or similar activities:
ResFlow acts as the Data Controller.
Information we collect
The personal information we collect depends on how you interact with our services and the features you use.
Site user information
This includes authorised personnel at research sites and, where applicable, clinical monitors invited by a customer organisation to access assigned studies on a read-only basis.
- Name
- Email address
- Organisation name (where applicable)
- Role within the organisation
- Monitor study assignments (where applicable)
- Onboarding and account setup status
- Login and authentication activity
- Account preferences and training completion status
Research site operational data
Research sites may enter or generate data including:
- Participant identifiers and initials
- Contact information
- Demographic information
- Study participation and screening information
- Visit scheduling and booking records
- Operational study logs and workflow records
- Protocol configuration and study management information
- Study scheduling and visit operational status
- Sponsor-connected study and study connection workflow records
- Monitor assignment records relating to authorised studies
- Audit and activity records relating to platform use
- Files uploaded in connection with support or worksheet requests
Research sites are responsible for ensuring they have an appropriate legal basis for entering and processing participant information within ResFlow.
Special category data
Participant and study-related information entered into ResFlow by authorised research sites may include health information or other special category data under UK GDPR.
Where ResFlow acts as Processor, the customer organisation is responsible for ensuring that an appropriate lawful basis and special category condition apply before entering such data into the platform. ResFlow processes this information only to provide the services and in accordance with the customer's instructions.
Website and technical information
- Contact form, demo, and support request submissions
- Device, browser, and session information needed to operate the platform
- Security, audit, and error logs
We do not use third-party marketing or analytics tools such as Google Analytics on the platform.
How we use information
We process personal information to:
- Provide, operate, and administer the ResFlow platform
- Create, authenticate, and manage user accounts
- Deliver customer support and respond to enquiries
- Send service-related emails, including appointment reminders, booking confirmations, visit-due alerts, randomization approaching and randomization-ready notifications, monitor assignment notifications, sponsor study connection notifications, and other study workflow notifications to authorised personnel
- Manage monitor assignments and monitor workspace access
- Support sponsor-connected studies and related connection workflows
- Enforce organisation, study, and role-based permissions within the platform
- Protect participant privacy through role-based access restrictions, including automatic redaction of participant personally identifiable information before it is presented to monitor users
- Process subscriptions and billing where applicable
- Improve platform performance, reliability, and usability
- Monitor security, prevent fraud, and maintain audit records
- Send administrative notices about terms, policies, or service changes
- Comply with legal and regulatory obligations
We send transactional emails only where necessary to operate the platform or fulfil customer instructions. We do not send marketing emails from the platform.
Lawful basis for processing
Where ResFlow acts as Controller, we rely on:
- Performance of a contract
- Legitimate interests (where balanced against your rights)
- Legal obligations
- Consent, where required
Where ResFlow acts as Processor, processing is carried out on the instructions of the customer research site.
When we share personal information
We do not share your personal information with third parties except where necessary to provide our services, comply with the law, or protect our legal rights. We may share information in the following situations:
- Subprocessors — trusted providers that host or support the platform (see Subprocessors below)
- Business transfers — in connection with a merger, acquisition, financing, or sale of assets
- Affiliates — where we require them to honour this Privacy Policy
- Legal requirements — where required by law, court order, or regulatory authority
Cookies and similar technologies
We use cookies and similar technologies that are necessary for authentication, security, session management, and core platform functionality. We do not use advertising or third-party tracking cookies. You can control cookies through your browser settings; disabling essential cookies may affect your ability to use the platform.
International data transfers
Your information may be transferred to, stored in, and processed in countries other than your own, including countries that may not provide the same level of data protection as the United Kingdom or European Economic Area.
Our infrastructure providers may process data in the United States and other jurisdictions. Where information is transferred outside the UK or EEA, ResFlow implements appropriate safeguards as required by applicable data protection law, including standard contractual clauses where relevant.
Data storage and security
ResFlow uses a combination of technical and organisational measures designed to protect personal information, including:
- Secure authentication
- Encrypted connections (HTTPS/TLS)
- Role-based access control
- Organisation-level permissions
- Study-level permissions
- Monitor-specific privacy controls, including automatic redaction of participant personally identifiable information for monitor users
- Row-level security at the database layer
- Audit logging
- Secure cloud infrastructure
Access to information within the platform is limited according to the user's role, organisation, and authorised study assignments. These measures are designed to support confidentiality, integrity, and appropriate access, but no system can guarantee absolute security. We take reasonable steps to protect information from unauthorised access, disclosure, alteration, or destruction.
Monitor access
Clinical monitors may be granted read-only access to one or more authorised studies by the relevant customer organisation. Monitor access is limited to studies explicitly assigned to that user.
ResFlow is intentionally designed so that monitors cannot access participant personally identifiable information. Personally identifiable information — including names, initials, dates of birth, contact details, email addresses, telephone numbers, free-text notes, reasons, comments, and other identifying information — is automatically redacted before information is presented to monitor users.
Monitors are provided only with the minimum operational information necessary to perform monitoring activities, such as participant numbers, screening numbers, visit schedules, and study operational status. This supports privacy-by-design principles and data minimisation under UK GDPR.
Sponsor-connected studies
Some studies on ResFlow may operate under sponsor-managed protocols and sponsor-connected workflows. In those cases, protocol configuration and related study management information may be established or controlled in accordance with the sponsor programme and the arrangements between the sponsor and the participating research site.
ResFlow processes information relating to sponsor-connected studies according to the instructions of the relevant customer organisation and applicable contractual arrangements, including any data processing agreement in place between the parties.
Subprocessors
ResFlow engages trusted service providers to operate the platform. Current subprocessors include:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication, and secure file storage |
| Vercel | Application and website hosting |
| Resend | Transactional email delivery |
| Stripe | Subscription payment processing (where billing is enabled) |
Additional subprocessors may be added from time to time.
How long we keep information
We retain personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, including:
- Providing the platform and related support
- Meeting contractual obligations with customer sites
- Security monitoring and audit requirements
- Legal, tax, and regulatory compliance
Retention periods may vary depending on customer requirements and applicable regulations. When we no longer have a legitimate need to process personal information, we will delete or anonymise it, or securely isolate it until deletion is possible.
Information from minors
ResFlow accounts are intended for authorised research organisations and site personnel aged 18 and over. We do not knowingly create accounts for, market to, or solicit information directly from children through our public website.
Some authorised organisations may use ResFlow to manage clinical research studies involving participants under 18. In those cases, any personal data relating to a child is entered and managed by authorised study personnel in accordance with the applicable study protocol, ethics approval, informed consent/assent process, and applicable data protection laws.
ResFlow processes such participant data only for the purpose of providing the services to the relevant organisation and does not use children's data for marketing.
If we become aware that a child has created a ResFlow account or submitted personal information directly through our public website without appropriate authority, we will take reasonable steps to delete that information. Please contact us if you believe this has occurred.
Your privacy rights
Under UK GDPR, where applicable, you may have the right to:
- Access your personal information
- Correct inaccurate information
- Request deletion
- Restrict or object to processing
- Data portability
- Withdraw consent (where processing is based on consent)
Where ResFlow processes participant data on behalf of a research site, requests should normally be directed to that site. Where ResFlow acts as Controller, you may contact us using the details below.
You may review or update account information through your profile settings. You may request account closure by contacting us; we may retain limited information where required for security, legal compliance, or dispute resolution.
Withdrawing consent does not affect the lawfulness of processing before withdrawal, nor processing based on other lawful grounds.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you are concerned about how your personal data has been handled.
ICO website: https://ico.org.uk
ICO telephone: 0303 123 1113
Breach notification
ResFlow maintains incident response procedures and will notify affected customers of confirmed security incidents in accordance with applicable legal and contractual obligations.
Changes to this policy
We may update this Privacy Policy periodically. Updated versions will be published on our website and become effective on the date stated in the revised policy.
Contact us
For privacy-related enquiries, please contact:
ResFlow
Email: info@resflowbookings.co.uk