Privacy Policy

Who we are. This website is operated by NexTrial AI Corporation, a Delaware corporation, together with its affiliate NexTrial AI Brasil LTDA (CNPJ 62.156.626/0001-49). "NexTrial", "we" and "us" refer to both.

What this policy covers. This policy covers nextrial.ai and its subpages. Use of the Celina platform is governed by the agreement between NexTrial and each customer.

Information we collect. When you submit a form or book a session we collect the details you give us, such as your name, work email, organization, role and message. We also collect standard technical data such as IP address, browser type and pages visited.

How we use it. We use this information to respond to your request, schedule sessions, send updates you have asked for, and keep the site secure and working. We do not sell personal information.

Who we share it with. We share information with service providers that host the site, deliver email and run scheduling, under contracts that limit their use of it. We may disclose information where the law requires it.

Patient and study data. This website does not collect patient data. Please do not send protected health information or study documents through website forms.

How we use your information, and how we do not. We use the information you send through this website only for the purposes listed above. We do not sell it, we do not use it to train AI models, and we do not use it to make automated decisions about you.

Data and model sovereignty on the Celina platform. This section describes the Celina platform, which customers use under their own agreement with NexTrial. Celina works on trial documents such as protocols. It is not a patient record system and does not need patient-identifiable data to do its work. The platform is architected so that each jurisdiction's data is stored and processed in its own region, in a separate environment, under that jurisdiction's law. Celina serves the United States, Brazil and India today. In Brazil, the platform runs on infrastructure located in Brazil, and Portuguese-language work runs on a model operated in Brazil. We are extending in-region model processing to our other jurisdictions.

Security and compliance program. NexTrial runs a documented information security program built on the ISO/IEC 27001 and SOC 2 control frameworks. The audit observation period for ISO/IEC 27001 certification and a SOC 2 Type II report begins in December 2026. We will say that we hold either one only after an independent auditor has issued it. Where a customer engagement involves protected health information, we sign a Business Associate Agreement and handle that information under written HIPAA procedures. Data is encrypted in transit and at rest, access is limited to named people who need it, and our systems are logged and scanned for vulnerabilities. Customers can request our current security summary at privacy@nextrial.ai.

International transfers. NexTrial operates in the United States and Brazil. Your information may be processed in either country with appropriate safeguards.

Your rights. Depending on where you live, you may have the right to access, correct, delete or port your information, or to object to its use. Residents of US states with privacy laws, and people protected by laws such as Brazil's LGPD or the EU's GDPR, can exercise those rights by writing to privacy@nextrial.ai. We respond within the period the applicable law sets.

Retention. We keep contact information for as long as needed to handle your request and our relationship with you, then delete or anonymize it.

Contact. privacy@nextrial.ai