TherAI Referrer Portal — Privacy Policy

Last updated: October 2026

This Privacy Policy explains how Trialtech SL, operating under the brand Un Ensayo para Mí ("UEPM", "we", "us", "our"), collects, uses, shares and protects personal data in connection with TherAI, the physician-referral portal available at https://app.unensayoparami.org and its associated functionalities (the "Portal").

The Portal allows a healthcare professional or other authorised person (the "Referrer") to refer an individual (the "Referred Person") to Un Ensayo para Mí so that we can contact that individual about clinical trial support services. This Policy applies to the personal data of Referrers and of Referred Persons that is processed through the Portal.

Once a Referred Person confirms their interest and interacts directly with Un Ensayo para Mí, any further processing of their data — including any health data they choose to share — is governed by the Un Ensayo para Mí Privacy Policy published at https://unensayoparami.org/es/documentos/privacidad, which supplements this Policy.

UN ENSAYO PARA MÍ IS NOT A MEDICAL PROVIDER AND DOES NOT PROVIDE MEDICAL ADVICE. CLINICAL DECISIONS REMAIN WITH THE TREATING PHYSICIAN. UN ENSAYO PARA MÍ IS NOT A "COVERED ENTITY" UNDER THE U.S. HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 ("HIPAA").

1. WHO IS RESPONSIBLE FOR YOUR DATA

Trialtech SL is the data controller for all personal data processed through the Portal, including the personal data of Referrers and the identification and contact data of Referred Persons.

Where a clinical trial sponsor or CRO engages Un Ensayo para Mí to support patient recruitment for a specific study, Un Ensayo para Mí acts as an independent controller for the recruitment activity. A Referred Person's identifiable data is shared only with the research site conducting the study, and only after the Referred Person has confirmed their interest and given their own consent, as described in Sections 3 and 4. Sponsors and CROs never receive identifiable information about a Referred Person; they receive only aggregate, non-identifiable recruitment metrics.

2. INFORMATION WE COLLECT

2.1 Referrer data

When you register and use the Portal as a Referrer, we collect:

• Identification and contact data: first and last name, e-mail address, telephone number, country.
• Professional data: profession, specialty, professional licence or registration number, institution or practice, professional address.
• Account and activity data: login credentials, referrals submitted, status of each referral, communications with Un Ensayo para Mí, acceptance records for these terms (date, time, version accepted).
• Fee and payment data, only for studies that offer a referral fee (see Section 6): tax identification number, billing details, bank account or payment-service details, invoices and payment records.

2.2 Referred Person data

When a Referrer submits a referral, we collect from the Referrer only the following data about the Referred Person:

• First and last name.
• Telephone number and/or e-mail address.
• Country and, where applicable, city or region.
• The study or therapeutic programme for which the referral is made, as selected by the Referrer from the options available in the Portal.
• The identity of the Referrer who submitted the referral.

At the referral stage, Referrers must not enter medical, diagnostic or other health-related information about the Referred Person, including in free-text fields. Un Ensayo para Mí does not collect or process health data about a Referred Person until the Referred Person has confirmed their interest and given their explicit consent (Section 3). If a Referrer enters health-related information before that point, we will delete it.

2.3 Health data shared by the Referrer after consent

Once the Referred Person has confirmed their interest and given explicit consent to the processing of their health data for the purpose of assessing their potential eligibility for a clinical trial, the Referrer may share with Un Ensayo para Mí, through the Portal, clinical information relevant to that assessment, such as diagnosis, stage or severity, current and prior treatments, relevant test results and clinical notes. The Referrer is responsible for ensuring that any such information is accurate, is limited to what is relevant to the referral, and is shared in accordance with the Referrer's own professional-secrecy and confidentiality obligations. The Referred Person may also provide health information to us directly.

2.4 Technical and usage data

When you use the Portal we automatically collect technical data such as IP address, browser type and version, operating system, device identifiers, date and time of access, pages viewed and actions performed. We use cookies and similar technologies as described in our Cookie Notice. Non-essential cookies are placed only with your consent.

2.5 Information from other sources

We may verify a Referrer's professional credentials against public professional registers. We do not obtain data about Referred Persons from any source other than the Referrer and the Referred Person themselves.

3. HOW THE REFERRAL PROCESS WORKS

The referral process is designed so that the Referred Person decides whether their data is used:

• Step 1 — Referral. The Referrer enters the Referred Person's identification and contact data and confirms, by means of a mandatory declaration, that they have obtained the Referred Person's express and voluntary agreement to share their contact details with Un Ensayo para Mí and that the Referred Person knows they may be contacted by us.
• Step 2 — Confirmation by the Referred Person. Un Ensayo para Mí sends the Referred Person a message by WhatsApp and/or e-mail that identifies who referred them, explains who we are and what we offer, links to this Policy and to the Un Ensayo para Mí Privacy Policy, and asks them to confirm whether they wish to proceed.
• Step 3 — Outcome. If the Referred Person confirms, they are asked for explicit consent to the processing of their health data for the purpose of assessing their potential eligibility for a clinical trial, and their data is processed under the Un Ensayo para Mí Privacy Policy. If the Referred Person declines, or does not respond within 30 days of the last contact attempt, we delete their identification and contact data, keeping only a minimal record that a referral was declined or not confirmed, so that we do not contact them again about the same referral.
• Step 4 — Clinical information from the Referrer. Only after the Referred Person has given the explicit consent described in Step 3 is the Referrer able to share clinical information about the Referred Person through the Portal (Section 2.3). The Portal does not allow health data to be entered before that consent is recorded.

4. INFORMATION FOR REFERRED PERSONS (DATA NOT OBTAINED FROM YOU DIRECTLY)

If you have been referred to Un Ensayo para Mí, this section is for you.

• Source of your data: your name and contact details were provided to us by the Referrer identified in the message you received, who declared that you agreed to be contacted by us.
• Categories of data received: name, telephone number and/or e-mail address, country, and the study or programme you were referred for. At this stage we have not received any health information about you. If you confirm your interest and give your explicit consent, the Referrer may then share with us clinical information relevant to assessing your potential eligibility (Section 2.3); you will be told which categories of information this involves when you are asked for that consent.
• Purpose: to contact you once to confirm whether you wish to learn about clinical trial support services related to the referral, and to record your answer.
• Legal basis: our legitimate interest in following up a referral made with your agreement (GDPR Art. 6(1)(f)), balanced by the fact that you are contacted only once, can decline at any time, and your data is deleted if you do not confirm. Any further processing, including the processing of health data shared by the Referrer or by you, is based on your own explicit consent (GDPR Art. 6(1)(a) and 9(2)(a)), which you can withdraw at any time.
• Your rights: you may object to this processing, ask us to delete your data or exercise any of the rights in Section 10 at any time, including by replying "STOP" to the message you received or writing to privacy@trialtech.es.

We provide this information at the time of our first contact with you, and in any event within one month of receiving your data, in accordance with GDPR Article 14.

5. PURPOSES AND LEGAL BASES

Referrer identification, contact and professional data

Purpose: to create and manage your Portal account; to verify your professional status; to communicate with you about your referrals and the Portal; to keep records of your acceptance of the terms and declarations.
Legal basis: performance of the contract between you and Un Ensayo para Mí (GDPR Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)); our legitimate interest in verifying that Referrers are who they say they are and in demonstrating compliance (Art. 6(1)(f)).

Referred Person identification and contact data

Purpose: to contact the Referred Person once to confirm their interest; to record the outcome; to attribute the referral to the Referrer.
Legal basis: our legitimate interest in following up a referral made with the Referred Person's agreement, as declared by the Referrer (Art. 6(1)(f)). Any subsequent processing is based on the Referred Person's consent (Art. 6(1)(a)).

Referred Person health data shared by the Referrer after consent

Purpose: to assess the Referred Person's potential eligibility for the clinical trial or programme for which they were referred, and to refer them to the research site where appropriate.
Legal basis: the Referred Person's explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), recorded before the Referrer is able to share any clinical information. The Referred Person may withdraw consent at any time, after which no further health data is accepted from the Referrer and the data already received is deleted unless another legal ground requires its retention.

Referral fee and payment data

Purpose: to calculate, document, pay and account for referral fees for the studies that offer them; to issue and keep invoices; to comply with tax and accounting obligations.
Legal basis: performance of the contract (Art. 6(1)(b)); compliance with legal obligations (Art. 6(1)(c)).

Technical and usage data

Purpose: to operate and secure the Portal; to detect and prevent fraud, abuse and duplicate or fictitious referrals; to produce aggregate usage statistics.
Legal basis: our legitimate interest in the security and proper operation of the Portal (Art. 6(1)(f)); consent for non-essential cookies (Art. 6(1)(a) and applicable e-privacy rules).

Communications with Referrers about the Portal and the referral programme

Purpose: to inform Referrers about new studies open for referral, changes to the programme and the status of their referrals.
Legal basis: performance of the contract (Art. 6(1)(b)) for service messages; legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)), as required by local law, for messages about new studies. You can opt out of non-essential messages at any time.

Where the laws of Brazil, Mexico, Argentina, Chile, Peru or Colombia apply, the equivalent legal bases are those provided in the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018, Art. 7 and Art. 11), the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP), the Argentine Personal Data Protection Law (Law No. 25,326, Arts. 5 and 6), the Chilean Law No. 19,628 as amended by Law No. 21,719, the Peruvian Law No. 29733 and its Regulation (Supreme Decree No. 016-2024-JUS), and the Colombian Statutory Law 1581 of 2012 and its regulatory decrees.

6. REFERRAL FEES

For some studies, Un Ensayo para Mí offers Referrers a fee for referrals that meet the conditions published for that study in the Portal. Fees are not offered for all studies, and the availability and conditions of any fee are shown in the Portal before a referral is submitted.

Where a fee applies, we process the Referrer's tax and payment data as described in Section 2.1 and Section 5. Where a referral fee applies, the Referred Person is informed of this in the confirmation message described in Section 3.

Fees are never conditional on the Referred Person enrolling in a clinical trial, and do not entitle the Referrer to receive any information about the Referred Person's subsequent participation in any study.

7. WHEN WE SHARE INFORMATION

• Referred Persons. We tell the Referred Person who referred them. We do not share with the Referrer any information about the Referred Person's response, eligibility or participation, beyond the status needed to administer the referral and, where applicable, the fee (for example, "contacted", "confirmed", "declined").
• Research sites. Identifiable data about a Referred Person is shared only with the research site conducting the study for which they were referred, and only after the Referred Person has confirmed their interest and given the consents described in the Un Ensayo para Mí Privacy Policy.
• Sponsors and CROs. Sponsors and CROs do not receive identifiable data about Referred Persons. They receive only aggregate, non-identifiable recruitment and referral metrics.
• Service providers (processors). We use third-party providers for cloud hosting, messaging (e-mail, SMS, WhatsApp), customer relationship management, identity verification, payments and analytics. They process data only on our documented instructions under data processing agreements. The current list of sub-processors is available on request at privacy@trialtech.es.
• Legal requirements. We may disclose data where required by law, regulation, court order or a request from a competent authority, or where necessary to establish, exercise or defend legal claims.
• Business transfers. If Un Ensayo para Mí is involved in a merger, acquisition, reorganisation or sale of assets, personal data may be transferred as part of that transaction, subject to the same protections. We will inform you where required by law.
• Protection of Un Ensayo para Mí and others. We may disclose data where necessary to protect the rights, property or safety of Un Ensayo para Mí, our users or the public, including to prevent fraud and security incidents.

We do not sell personal data, and we do not share telephone numbers or contact details of Referrers or Referred Persons with third parties for their own marketing purposes.

8. INTERNATIONAL TRANSFERS

Un Ensayo para Mí is established in Spain and operates in Spain, Latin America and the United States. Personal data may be processed by us or our service providers in countries outside your own, including outside the European Economic Area. Where we transfer personal data from the EEA to a country that has not been recognised by the European Commission as providing adequate protection, we rely on the Standard Contractual Clauses adopted by the European Commission (GDPR Art. 46(2)(c)), supplemented where necessary by additional safeguards. Transfers from Brazil, Mexico, Argentina, Chile, Peru and Colombia are made in accordance with the transfer mechanisms permitted by the LGPD, the LFPDPPP, Law No. 25,326, Law No. 19,628 (as amended by Law No. 21,719), Law No. 29733 and Law 1581 of 2012 respectively. You may request a copy of the applicable safeguards at privacy@trialtech.es.

9. RETENTION

Referrer account and professional data

Deleted upon closure of the account, except for the records listed below that we must keep to comply with legal obligations, to demonstrate the lawful origin of a referral, or to establish, exercise or defend legal claims.

Referral records (Referrer declarations, Referred Person consent log, referral status)

Ten (10) years from the date of the referral. These are our own records evidencing the origin of the referral and the consents obtained, and are retained to demonstrate compliance with this Policy.

Personal data processed for a sponsor study

Where a referral relates to a study for which Un Ensayo para Mí acts under a services agreement with a sponsor or CRO, the personal data processed for that study is retained or deleted in accordance with that agreement, and study-related records are archived for the period required by ICH GCP and the agreement.

Referred Person identification and contact data — referral not confirmed

Deleted within 30 days of the last contact attempt; a minimal suppression record (hashed contact identifier, date and outcome) is kept so that the person is not contacted again about the same referral.

Referred Person data — referral confirmed (including health data shared by the Referrer)

Retained in accordance with the Un Ensayo para Mí Privacy Policy.

Fee, invoicing and payment records

For the period required by applicable tax, accounting and commercial law.

Technical and usage data

Security and access logs: ten (10) years, in accordance with our IT operating procedure. Cookies: as set out in the Cookie Notice.

At the end of the applicable period, data is deleted or irreversibly anonymised. Data that has been deleted may persist in encrypted backup copies until those backups expire under our backup procedure; backup copies are not used for active processing and are protected by the same security measures as live data.

10. YOUR RIGHTS

Subject to applicable law, Referrers and Referred Persons have the right to:

• Access the personal data we hold about you and obtain information about how it is processed.
• Rectify inaccurate or incomplete data.
• Request erasure of your data.
• Restrict processing in the circumstances provided by law.
• Object to processing based on our legitimate interests, including the follow-up of a referral, and to direct marketing at any time.
• Receive the data you provided to us in a structured, commonly used and machine-readable format (portability).
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
• Lodge a complaint with the competent supervisory authority (Section 14).

You can exercise these rights by writing to privacy@trialtech.es or to the postal address in Section 16. We will respond within one month, extendable where permitted by law, and will not charge a fee unless the law allows it. We may ask you to verify your identity before acting on a request.

11. AUTOMATED PROCESSING

The Portal may use automated tools, including artificial-intelligence-based tools, to route referrals to the appropriate programme and to detect duplicate or fraudulent referrals. No decision producing legal or similarly significant effects on a Referrer or a Referred Person is taken solely by automated means; eligibility for any study is always assessed by qualified staff and, ultimately, by the research site.

12. SECURITY

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit and at rest, role-based access control and multi-factor authentication, pseudonymisation where feasible, logging and monitoring, vulnerability and incident management, and staff training and confidentiality undertakings. Our information security management system is aligned with ISO/IEC 27001. No system is completely secure; if we become aware of a personal data breach affecting you, we will notify you and the competent authority where required by law.

13. CHILDREN

The Portal is intended for use by adult Referrers. A Referrer may refer a minor only with the agreement of the person holding parental responsibility, and the confirmation message described in Section 3 is sent to that person. We do not knowingly contact a minor directly. If you believe a minor's data has been submitted without proper authority, contact us at privacy@trialtech.es and we will delete it.

14. SUPERVISORY AUTHORITIES

You may contact the supervisory authority of your country of residence at any time to ask questions or lodge a complaint about the processing of your personal data.

Spain
The Agencia Española de Protección de Datos (AEPD) is the competent supervisory authority and oversees compliance with data protection law in Spain.
Agencia Española de Protección de Datos
C/ Jorge Juan, 6 — 28001 Madrid
Tel.: +34 900 293 183
Complaints: https://sedeagpd.gob.es/sede-electronica-web/vistas/infoSede/tramitesCiudadano.jsf

Brazil
The Autoridade Nacional de Proteção de Dados (ANPD) is the competent supervisory authority in Brazil and oversees compliance with the Lei Geral de Proteção de Dados (LGPD).
Autoridade Nacional de Proteção de Dados (ANPD)
SCS, Quadra 09, Lote C, Torre C — Ed. Parque Cidade Corporate
Brasília, DF — Brasil, CEP 70308-200
Website: https://www.gov.br/anpd
Complaints: https://www.gov.br/anpd/pt-br/canais_atendimento/cidadao-titular-de-dados/denuncia-peticao-de-titular

Mexico
The Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) is the competent supervisory authority in Mexico and oversees compliance with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).
Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI)
Insurgentes Sur 3211, Col. Insurgentes Cuicuilco, Alcaldía Coyoacán
C.P. 04530, Ciudad de México, México
Tel.: +52 (55) 5004 2400
Website: https://home.inai.org.mx
Complaints: https://www.plataformadetransparencia.org.mx

Argentina
The Agencia de Acceso a la Información Pública (AAIP) is the competent supervisory authority in Argentina and oversees compliance with the Personal Data Protection Law (Ley N° 25.326).
Agencia de Acceso a la Información Pública (AAIP)
Av. Pte. Gral. Julio A. Roca 710, Piso 3
C1067ABP, Ciudad Autónoma de Buenos Aires, Argentina
Tel.: +54 (11) 3988-3968
Website: https://www.argentina.gob.ar/aaip
Complaints: https://www.argentina.gob.ar/servicio/denunciar-incumplimientos-de-la-ley-de-proteccion-de-datos-personales

Chile
The Agencia de Protección de Datos Personales (APDP) is the competent supervisory authority in Chile, created by Ley N° 21.719, which enters into full force on 1 December 2026 and amends Ley N° 19.628. It oversees compliance with personal data protection rules and has inspection and sanctioning powers.
Agencia de Protección de Datos Personales (APDP)
Santiago de Chile
Website and complaint channels: to be confirmed in accordance with the official details published by the Agency.

Peru
The Autoridad Nacional de Protección de Datos Personales (ANPDP), under the Ministerio de Justicia y Derechos Humanos, is the competent supervisory authority in Peru and oversees compliance with Ley N° 29733 (Personal Data Protection Law) and its Regulation (Decreto Supremo N° 016-2024-JUS).
Autoridad Nacional de Protección de Datos Personales (ANPDP)
Ministerio de Justicia y Derechos Humanos
Calle Scipión Llona N° 350, Miraflores, Lima, Perú
Website: https://www.gob.pe/anpd
Complaints: through the Peruvian State platform (https://www.gob.pe/anpd)

Colombia
The Superintendencia de Industria y Comercio (SIC), through its Delegatura para la Protección de Datos Personales, is the competent supervisory authority in Colombia and oversees compliance with Ley 1581 de 2012 and its regulatory decrees, with investigative and sanctioning powers. You may contact the authority once the consultation or complaint procedure before Un Ensayo para Mí has been exhausted.
Superintendencia de Industria y Comercio (SIC)
Carrera 13 N° 27-00, Bogotá D.C., Colombia
Tel.: +57 (601) 592 0400 — National toll-free line: 018000 910165
Website: https://www.sic.gov.co
Complaints: https://www.sic.gov.co/tema/proteccion-de-datos-personales

United States (California)
California residents have the rights set out in the California Consumer Privacy Act, including the right to know, delete and correct, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information within the meaning of the CCPA. Requests may be submitted to privacy@trialtech.es.

15. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in the Portal, in the law or in our practices. The date of the latest version is shown at the top. Where a change materially affects the way we use your data, we will notify registered Referrers through the Portal or by e-mail before it takes effect. Continued use of the Portal after the effective date constitutes acceptance of the updated Policy, without prejudice to your rights under Section 10.

16. SERVICE PROVIDER AND CONTROLLER CONTACT DETAILS

Controller
Trialtech SL
Avda. De los Charcos 19
28860 Madrid, Spain
Tax Identification Number: ES B01808039
E-mail: info@trialtech.es
User support e-mail: support@trialtech.es

Data Protection Officer
European Union & Americas
Data Privacy Office
Espanya Industrial 7, 3° 1
08014 Barcelona, Spain
E-mail: privacy@trialtech.es

Using the contact details above you may exercise the rights described in Section 10 before the controller and before its Data Protection Officer, and you may submit questions or suggestions relating to data protection.

Last revised: October 2026