Privacy Notice

This Privacy Notice explains how Evistruct Limited ("Evistruct", "we", "our", "us") collects, uses, discloses and otherwise processes your personal data in connection with our website (www.evistruct.co.uk), client portal and our services — including medical writing, manuscript editing, data analysis, statistical support and real-world evidence (collectively, the "Services").

Evistruct is the data controller for personal data processed through the Services. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and are registered with the Information Commissioner's Office (ICO).

1. Information we collect

When you use our Services, we may collect:

• Identifiers: name, email address, telephone number, postal address and country.
• Professional information: job title, role, institution or company, ORCID iD and area of research.
• Account information: authentication details for your Evistruct client portal.
• Manuscript and project content: documents, datasets, references and instructions you upload for editing, writing or analysis.
• Commercial information: records of quotes, orders and invoices for our Services.
• Payment information: handled by our payment processor Stripe — we do not store full card details on our servers.
• Communications: emails, support messages and feedback you send us.
• Technical data: IP address, browser type, device information and pages visited, collected via cookies and similar technologies.

2. How we use your information

• To deliver the Services you have engaged us for (writing, editing, analysis, RWE projects).
• To create and administer your client account and process payments via Stripe.
• To communicate about your projects, send quotes, invoices, delivery notifications and service updates.
• To respond to enquiries, provide customer support and handle refund requests.
• To send our newsletter and occasional marketing emails (only with your consent — you can unsubscribe at any time).
• To improve our website, Services and internal quality processes.
• To comply with our legal, tax, regulatory and accounting obligations in the United Kingdom.

3. Lawful bases for processing

Under the UK GDPR we rely on the following lawful bases:

• Contract: to provide the Services you have requested.
• Legitimate interests: to operate, secure and improve our Services and to communicate with clients and prospects in a B2B context.
• Consent: for marketing emails, optional cookies and any other purpose where consent is required.
• Legal obligation: to comply with UK tax, accounting and regulatory requirements (including HMRC record-keeping).

4. Manuscripts, datasets and confidentiality

We treat all manuscripts, research data and project materials as strictly confidential. Files you upload are used solely to deliver your project, are accessible only to the Evistruct team members assigned to your work, and are not used to train third-party AI models. If your dataset contains personal data of research participants, you remain the data controller and Evistruct acts as your data processor — please contact us to put a Data Processing Agreement (DPA) in place before sharing such data.

5. Who we share your information with

• Stripe — payment processing.
• Hosting and infrastructure providers that operate our website, client portal and secure file storage.
• Email and analytics providers for transactional emails, newsletters and basic site analytics.
• Professional advisers such as our accountants and legal advisers, where necessary.
• Regulators or law enforcement where required by UK law or to protect our rights.

We do not sell your personal data.

6. International transfers

Some of our service providers (such as Stripe and certain hosting providers) may process data outside the UK. Where this happens, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

7. Data retention

We keep your personal data only for as long as needed for the purposes described above. Project files are typically retained for up to 24 months after delivery so we can support revisions and follow-up work; invoices and related records are kept for at least 6 years to meet HMRC requirements. You may ask us to delete your project files earlier — see "Your rights" below.

8. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Request erasure of your personal data, where applicable.
• Restrict or object to certain types of processing, including direct marketing.
• Request portability of data you have provided to us.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at info@evistruct.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, although we'd appreciate the chance to resolve any concerns first.

9. Cookies

We use a small number of cookies to keep you signed in, remember your preferences and understand how our site is used. Non-essential cookies are only set with your consent.

10. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls and least-privilege permissions — to protect personal data and client manuscripts. No system is perfectly secure, but we take our responsibilities seriously and review our controls regularly.

11. Children

Our Services are intended for researchers, clinicians and organisations, and are not directed at children under 18. We do not knowingly collect personal data from children.

12. Changes to this notice

We may update this Privacy Notice from time to time. When we make material changes we will update the date at the top of this page and, where appropriate, notify you by email or through the client portal.

13. Contact us

Questions about this notice or how we handle your data? Email info@evistruct.co.uk or write to Evistruct Limited, United Kingdom. You can also reach us via our contact page.

This Privacy Notice is governed by the laws of England and Wales.