Platform Account Privacy Policy

1. Scope: platform accounts only

This Privacy Policy explains how Zavo collects, uses, stores and shares personal information about people who are invited to, register for or use a user account on the Zavo platform. It covers account registration, sign-in, workspace membership, account-related activity, communications and support (together, “Account Services”).

This is an account privacy policy, not a dataset privacy policy. Zavo’s anonymised clinical, healthcare, research, training and evaluation datasets have their own policies and contractual arrangements. Data sourcing, preparation, anonymisation, licensing and any handling of source information are addressed in those separate arrangements, including applicable data processing agreements. This policy does not authorise the collection, disclosure or use of patient information.

Your name, email address and records of your account activity remain personal information even when you use your account to access anonymised datasets. Those account records are covered here. Please do not include patient information or other sensitive health information in account profiles or account support messages.

2. Who we are

Zavo is a research lab building clinical data, expert networks, training environments and evaluations for frontier medical AI. In this policy, “Zavo”, “we”, “us” and “our” refer to the entity responsible for your account personal information:

• Zavo Ltd is the controller for users in the United Kingdom, the European Economic Area (EEA) and Switzerland.
• Zavo Inc. is the controller for users elsewhere.

The two companies are affiliates. If your employer or another organisation provides your account, it may also be responsible for how it uses your membership and activity information. Its own privacy notices apply to that use.

3. Privacy contact

For questions about account privacy or to exercise your rights, email partnerships@zavo.ai with the subject “Account privacy”, or write to the relevant Zavo entity above, marked “FAO: Privacy”. You can also use our Contact us form. These contact routes handle account privacy enquiries and requests.

4. Information we collect

We collect information you provide, information your organisation or workspace administrator supplies, and technical information generated when you use your account. Depending on your interaction with us, this includes:

• Identity and contact details: your name, email address and any employer, job title or work contact details you provide for account administration or support.
• Account and access details: your user identifier, password hash, session records, invitations, workspace membership, role, permissions and account status.
• Technical and activity information: IP address, browser or device information, sign-in times, account actions and security or diagnostic logs associated with your use of the Account Services.
• Communications: account support enquiries, privacy requests and other account-related correspondence you send us.

For an invited account, your administrator may provide your email address and assigned workspace role before you register. We receive further account information directly from you when you accept the invitation and use the platform.

We need basic identity, authentication and access information to create and secure an account. If you do not provide required information, we may be unable to provide account access. Other profile or support details should be limited to what is relevant to your request.

5. How and why we use information

We use account personal information for the following purposes. Where UK or EEA data protection law applies, the corresponding legal bases are:

• Providing your account: registering users, handling invitations, authenticating sign-ins and administering access. We rely on performing our contract with you, or our legitimate interest in providing the platform to your organisation where it is the contracting party.
• Supporting and communicating with you: resolving account issues and sending necessary account, security and service notices. We rely on performing our contract or our legitimate interest in supporting users and keeping them informed about their accounts.
• Protecting and maintaining the platform: preventing unauthorised access and misuse, investigating incidents, troubleshooting and improving account functionality. We rely on our legitimate interests in operating a secure, reliable service.
• Meeting legal responsibilities: responding to valid legal requests, handling privacy rights requests and retaining records required by law. We rely on compliance with legal obligations. Establishing, exercising or defending legal claims may also be necessary for our legitimate interests.
• Optional uses that require permission: where we ask for consent, we use the information only for the purpose explained at that time. You can withdraw that consent without affecting earlier lawful processing.

When we rely on legitimate interests, we consider the impact on your rights and interests. We do not sell your account personal information. This policy does not grant permission to use account details as clinical or research datasets.

6. Cookies and similar technologies

The Account Services use essential authentication and security cookies to maintain your signed-in session and protect account access. The current platform’s authentication session has a 12-hour lifetime and may be renewed while you remain active. Signing out ends the current session, and account settings let you revoke other sessions.

These essential technologies support the account service you request. You can block or delete cookies using your browser settings, but doing so may prevent sign-in or end your session. If we introduce optional analytics or tracking technologies that require consent, we will explain their purpose and provide the required choice before using them.

This section is the cookie information for the Account Services. For questions about cookies associated with your account, contact partnerships@zavo.ai.

7. Sharing account information

We share account personal information only where needed for the purposes in this policy, including with:

• Service providers: providers supporting account hosting, authentication, database storage, backups, security and account communications. Our current platform uses Convex for its account database and authentication records, Railway for application hosting, and Cloudflare for backup storage. Account-related enquiries submitted through our website contact form also use Cloudflare for form security and Resend for email delivery.
• Your organisation and workspace administrators: account identity, membership, role, status and relevant activity information needed to manage workspace access and collaboration.
• Zavo affiliates and advisers: where necessary for account operations, support, legal advice or protecting our rights, subject to appropriate confidentiality obligations.
• Authorities or other parties: where disclosure is required by law, necessary to address fraud or security incidents, or needed to establish, exercise or defend legal claims.
• Parties to a business transaction: where reasonably necessary for a proposed merger, acquisition or reorganisation, subject to appropriate confidentiality and data protection safeguards.

Providers processing account information on our behalf must act on our instructions and protect that information under applicable contractual and legal requirements. We may also share information where you specifically ask us to do so. To ask about the providers relevant to your account, use the privacy contact details.

8. Storage and international transfers

Our current hosted platform uses an account database in Ireland and application hosting in the Netherlands, with backup storage configured for the European Union. Zavo operates through entities in the UK and the United States. Account information may also be accessed or processed in those countries or other countries where relevant service providers operate, including for support.

Where a transfer outside the UK, EEA or Switzerland requires legal safeguards, we use a transfer mechanism recognised by the applicable law. Depending on the transfer, this may be an applicable adequacy decision or contractual safeguards, such as the European Commission’s standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with supplementary measures where required.

You can ask where information about your account is processed and request details or a copy of the applicable transfer safeguards by contacting partnerships@zavo.ai.

9. Your privacy rights

Depending on your location, the legal basis for processing and applicable exceptions, you may have the right to:

• be informed about how we use your personal information and request access to it;
• correct inaccurate or incomplete information;
• request deletion of your information or restriction of its use;
• receive information you provided in a portable format, where the right to data portability applies;
• withdraw consent at any time where processing relies on consent; and
• challenge a decision based solely on automated processing that has legal or similarly significant effects, where applicable.

Your right to object: you may object to processing based on our legitimate interests for reasons relating to your situation. You may object to direct marketing at any time. Opting out of marketing does not stop essential account or security messages.

Send requests to partnerships@zavo.ai. We may need proportionate information to verify your identity or an authorised representative’s authority. Please do not send passwords or patient information. We will respond within the time required by applicable law, normally within one month for UK and EEA requests, and explain any lawful extension or refusal. Requests are normally free of charge.

You may also complain to a relevant supervisory authority, as explained in section 15. These account privacy rights are separate from any rights or obligations addressed by the policies governing datasets.

10. Security

We use technical and organisational measures designed to protect account information against unauthorised access, loss, misuse or disclosure. Account protections include hashed passwords, protected session cookies, role-based access controls and checks that users have active workspace membership.

No system or transmission method is completely secure. Keep your credentials confidential, use a unique password and contact us promptly if you suspect unauthorised access to your account.

11. Retention and deletion

We retain account information for as long as needed to provide and administer your account. The period depends on whether your account and workspace membership remain active, the purpose of each record, security needs, outstanding support requests, applicable legal requirements and the time needed to resolve disputes or legal claims.

After an account closes, we delete or anonymise information that is no longer needed. Limited records may be retained where necessary for legal obligations, security investigations or legal claims. Backup copies are removed or overwritten through the applicable backup retention cycle and protected while retained.

Disabling workspace access is not the same as deleting an account. To request deletion or ask about the retention period applicable to a particular account record, contact partnerships@zavo.ai. Deleting an account does not itself delete anonymised datasets, which remain subject to their separate policies and agreements.

12. Children’s information

Platform accounts are intended for professionals aged 18 or over. We do not knowingly collect account personal information from children. If you believe a child has provided account information, contact us so we can investigate and take appropriate action.

13. Third-party services

If you follow a link to an independent third-party service, that service’s privacy notice governs the information it collects directly from you. This policy governs Zavo’s handling of account information and does not replace those third parties’ notices.

14. Changes to this policy

We may update this policy as the Account Services or legal requirements change. We will update the effective date above and bring material changes to your attention through the platform or appropriate account communications. Where required, we will give notice before a new use begins and obtain any necessary consent.

15. Questions and complaints

For account privacy questions, concerns, complaints or rights requests, email partnerships@zavo.ai, use our Contact us form, or write to Zavo Ltd or Zavo Inc. at the applicable address in section 2, marked “FAO: Privacy”.

If you are in the UK, you can complain to the Information Commissioner’s Office. If you are in the EEA, you can contact the data protection authority where you live or work, or where an alleged infringement occurred. Users elsewhere may contact their relevant data protection authority. You do not need to contact us before exercising that right.

For the policies or agreements governing anonymised datasets, contact us with the relevant dataset or service name, without including patient information. Use of our website is also governed by our Terms of Service.