Signalment privacy notice

Updated September 29, 2026. This notice explains how Signalment handles information about the people who use it: members of a research workspace, and owners who take part in a study with their animal. Where a workspace belongs to an organization, that organization decides why and how information in it is used, and this notice describes what Signalment does on its behalf; see the data processing addendum.

What we collect, and why

• Your account: email address, password hash (never the password), a display name, and the sign-in provider if you use Google or Apple. To sign you in and keep the account yours.
• Workspace membership: your name, title and role as entered by you or the workspace owner. To show who did what in a study.
• Actions in a workspace: every write is recorded in the audit trail with your account, your name at the time, the time, what changed and the reason you gave, plus a hashed form of your IP address and your browser’s description. To meet record-keeping rules for research data (including 21 CFR Part 11) and to detect misuse.
• Electronic signatures: your name, email address, the time, the meaning of the signature, and the fingerprint of what you signed.
• Participating owners: your name, email address and phone number are held in an “owner key” that only the study team’s owners, investigators and coordinators can see; monitors, viewers and exports never include them. Your consent signature is recorded with the version of the consent text you signed. What you record about your animal is stored under a subject code, not your name.
• Documents: files uploaded to a study (for example scanned veterinary records) are stored encrypted. If a team member chooses to have a document read, it is sent to Anthropic for processing; owner names and contact details found in it are dropped before anything is proposed for the record.
• Billing: handled by Stripe, which receives the workspace’s billing contact and payment details. Signalment sees the plan, the status and the customer reference, never card numbers.
• Email: invitations, consent confirmations, adverse-event alerts, query notices and account messages are sent through Resend. We do not send marketing email to study participants.

What we do not do

We do not sell personal information, share it for advertising, use it to train artificial intelligence models, or use study data for any purpose other than providing the Service to the workspace it belongs to. We do not collect information about people’s health.

Retention

Study data and audit trails are kept as long as the workspace exists and for 90 days after it closes, then deleted (backups within a further 35 days). Because an audit trail is a record of what happened, entries in it are not edited or deleted individually. Owner keys can be deleted separately from a study’s pseudonymous data at the workspace’s request, and an owner who withdraws consent stops future collection immediately.

Your rights

Depending on where you live you may have rights to access, correct, delete or export personal information about you, to object to or restrict some processing, and to complain to a supervisory authority. For information in a workspace, we act on the instructions of the organization that runs it and will pass your request to it or help it respond; some records cannot be changed or deleted while a study’s audit trail must be kept. For your account itself, write to hello@signalment.app. We do not discriminate against anyone for exercising a privacy right.

Cookies and security

The Service uses one strictly necessary session cookie and no advertising or analytics cookies. To understand how the site is used we keep a first-party, cookieless log of page views: the page, the referring site, the country, the network name your connection belongs to as reported by our hosting provider, the device type, any code carried by a link in an email we sent you, and a visitor key that changes every day and cannot be reversed to an address; we do not store IP addresses in it, and it is kept for 90 days. Cloudflare Web Analytics, which uses no cookies and no fingerprinting, reports aggregate traffic. Data are encrypted in transit and at rest; access is by role; signatures require re-authentication; workspaces can set an idle sign-out and a password-age policy. If we confirm a breach affecting you, we tell the workspace and, where the law requires, you, without undue delay.

Children and international users

The Service is for adults acting for an organization or as the owner of an animal. Data are hosted in the United States; for users in the EU or UK, transfers are covered by standard contractual clauses signed with the workspace’s organization.

The Signalment plugin for ChatGPT

Signalment offers a plugin that ChatGPT can use to plan a study, say which rules apply, draft an owner consent form or estimate a sample size. It runs at signalment.app/mcp without an account. It receives only the study facts the conversation sends it (species, design, the product or therapy, the outcome), answers from the same templates and rules as the product, and stores none of it; our server keeps the usual request logs (address, time, size) for up to 30 days for security. It never asks for an owner’s, animal’s or person’s details, and it is not a way to enter study data. The link it returns opens the plan in the app, where the terms and this notice apply as for anyone else.

Changes and contact

We will post changes here and, for material ones, tell workspace owners by email. Contact: hello@signalment.app.