Privacy policy

Effective Date: September 9, 2026  |  Last Updated: September 9, 2026

Core Clinical Trials (“Core,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, submit information through our website, or otherwise interact with us through the website.

1. Scope

This Privacy Policy applies to the Core Clinical Trials public website and the forms, scheduling tools, and other website features available through it.

This Privacy Policy does not govern personal or health information collected from or about clinical trial participants in connection with a clinical study. Clinical trial data is handled separately under the applicable study protocol, informed consent documents, clinical trial agreements, privacy notices, and applicable laws and regulations.

The forms on this website are intended for sponsors, CROs, physicians, research sites, healthcare professionals, business partners, and other professional users. They are not intended for the submission of patient-level information or protected health information (“PHI”).

Certain Core products, platforms, programs, or services may be governed by additional privacy notices, contracts, informed consent documents, or other terms. Where another notice specifically applies to a particular service or activity, that notice will govern that activity.

2. Information We Collect

We collect information that you provide directly to us and limited information automatically generated when you use the website.

Information you provide

Depending on how you interact with Core, you may provide:

Contact and professional information, such as your name, email address, telephone number, company or organization, job title, role, specialty, and location.

Study and protocol information, such as sponsor or CRO name, protocol number, study phase, therapeutic area, indication, anticipated start date, target site count, operational requirements, or other information about a clinical research opportunity.

Research site and practice information, such as research experience, specialties, therapeutic areas of interest, patient population information, approximate patient volume, site capabilities, and other information relevant to evaluating a potential relationship with Core.

Service inquiry information, including information submitted regarding Core services such as OnSite Nurses®, ReEngage Research®, Phase I capabilities, site-network services, or other clinical trial support.

Scheduling information, including your preferred meeting date and time and information necessary to create and send a meeting invitation.

Documents you upload, such as protocols, protocol synopses, schedules of assessments, or other business or study-related documents.

Communications, including additional information you voluntarily provide in forms, emails, inquiries, or other correspondence.

Consent information, including whether and when you provided consent through a website form or cookie preference mechanism.

Please do not submit patient-identifying information, medical records, PHI, Social Security numbers, financial account information, or other sensitive personal information through our general website forms.

Information collected automatically

When you use the website, our systems may automatically collect limited technical information, including:

• IP address;
• browser type and language;
• device type and operating system;
• pages requested or viewed;
• referring website or campaign;
• date and time of requests;
• screen size and general technical configuration;
• session and security information; and
• information used to identify and prevent automated abuse, fraud, or security threats.

Additional information may be collected through analytics technologies only as described in Section 8.

3. How We Collect Information

We collect personal information:

• directly from you when you submit a form, upload a document, schedule a meeting, communicate with us, or otherwise provide information through the website;
• automatically from your browser or device when you use the website;
• through service providers that support website hosting, email, scheduling, security, and similar business functions; and
• as otherwise permitted by law or authorized by you.

4. How We Use Information

We may use personal information to:

• respond to study, sponsor, CRO, physician, research-site, and service inquiries;
• evaluate and develop potential business and clinical research relationships;
• review study opportunities, protocols, site capabilities, and operational requirements;
• provide information about Core’s services;
• schedule meetings and create calendar invitations;
• communicate with you regarding an inquiry or existing business relationship;
• operate, maintain, secure, troubleshoot, and improve the website;
• understand how visitors use the website and measure website performance where analytics consent has been provided;
• detect automated submissions, fraud, security threats, or misuse;
• maintain records of inquiries, communications, consent, and business interactions;
• comply with applicable laws, regulations, legal processes, contractual obligations, and regulatory requirements;
• establish, exercise, or defend legal claims;
• protect the rights, safety, security, and property of Core, our partners, website users, and others;
• evaluate or complete a potential corporate transaction such as a financing, merger, acquisition, restructuring, or sale of assets; and
• carry out other purposes disclosed to you when information is collected or with your authorization.

Marketing communications

Submitting an inquiry authorizes Core to communicate with you about that inquiry and related business matter.

Where required by law, promotional or broader marketing communications will be sent only with appropriate consent or another lawful basis. You may opt out of marketing communications at any time by using the unsubscribe mechanism in the communication or contacting us.

Opting out of marketing communications will not prevent Core from sending transactional, operational, legal, or relationship-related communications that are reasonably necessary.

5. Legal Bases for Processing

Where applicable data-protection law requires a legal basis for processing personal information, Core may rely on one or more of the following:

Consent. We may process information when you have provided consent, including for optional analytics technologies or certain communications. You may withdraw consent at any time, although withdrawal does not affect processing that occurred before withdrawal.

Legitimate interests. We may process information where reasonably necessary for legitimate business purposes, such as responding to inquiries, evaluating business relationships, operating and securing our website, improving our services, preventing fraud, and managing our business, provided those interests are not overridden by applicable privacy rights.

Contractual or pre-contractual purposes. We may process information when necessary to take steps requested by you before entering into a business relationship or to perform obligations arising from an existing relationship.

Legal obligations. We may process information when necessary to comply with applicable laws, regulations, court orders, legal processes, regulatory requirements, or other legal obligations.

6. Patient Information and Protected Health Information

The public Core Clinical Trials website is not intended to collect patient-level information or PHI.

Do not submit patient names, medical records, dates of birth, subject identification numbers linked to identifiable individuals, diagnoses linked to identifiable individuals, laboratory results, photographs of patients, or other patient-identifying health information through the website’s general business forms.

Clinical trial participant information is collected and managed through appropriate clinical research systems and processes under the applicable protocol, informed consent, contracts, and regulatory requirements—not through these website forms.

If patient-identifying information or PHI is inadvertently submitted through the website, Core will take reasonable steps to securely remove, restrict, or isolate that information as appropriate, subject to applicable legal, regulatory, security, backup, and record-retention requirements.

We may contact the sender and request that the information be resubmitted without patient-identifying information.

7. How We Disclose Information

Core does not sell personal information collected through this website.

We also do not currently disclose personal information collected through this website to advertising networks for cross-context behavioral advertising or targeted advertising.

We may disclose personal information in the following circumstances:

Service providers. We use companies that perform services on our behalf, including website hosting, cloud infrastructure, email, calendar, scheduling, security, and technical support. Current providers include Amazon Web Services for website infrastructure and Google Workspace for email and calendar functionality.

These providers may process information only as necessary to perform services for Core and are subject to applicable contractual and confidentiality obligations.

Professional advisors. We may disclose information to attorneys, accountants, auditors, insurers, consultants, or other professional advisors when reasonably necessary.

Business partners and counterparties. We may disclose information where necessary to evaluate or perform a business relationship, study opportunity, or transaction that you requested or authorized.

Legal and regulatory purposes. We may disclose information when we reasonably believe disclosure is required by law, regulation, subpoena, court order, governmental request, legal process, or regulatory obligation.

Protection of rights and safety. We may disclose information when reasonably necessary to protect Core, our users, our business partners, or others from fraud, misuse, security threats, unlawful activity, or harm.

Corporate transactions. Information may be disclosed or transferred in connection with an actual or proposed financing, investment, merger, acquisition, restructuring, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to appropriate confidentiality protections where applicable.

With your authorization. We may disclose information when you direct or authorize us to do so.

8. Cookies and Website Analytics

Core has designed its website analytics practices to minimize unnecessary collection of personal information.

Essential cookies

The website uses limited cookies and similar technologies that are necessary for website operation, session continuity, security, form processing, and technical functionality.

These technologies are not used for advertising or cross-site behavioral tracking.

First-party analytics

Core currently operates a first-party website analytics system hosted within our own environment.

When you consent to analytics, we may measure information such as:

• pages viewed;
• length of visit;
• scrolling and navigation activity;
• referring website or campaign;
• browser and device type;
• operating system;
• screen size;
• language; and
• time zone.

IP addresses used for analytics are stored only in truncated form, together with a salted one-way hash used to help distinguish visitors without retaining the full IP address.

We do not send website visitor IP addresses to third-party location services for analytics purposes. Country-level information may be recorded where provided by our hosting infrastructure.

First-party analytics data is automatically deleted after approximately 13 months.

Analytics cookies

Analytics cookies are placed only after you choose to accept analytics through the website’s consent mechanism.

Current analytics cookies may include:

cct_vid — a randomly generated identifier used to recognize a returning browser. It expires after approximately two years.

cct_sid — identifies activity associated with a single website session and expires approximately 30 minutes after the last activity.

cct-consent — records your analytics preference so the website does not repeatedly request the same choice. Acceptance may be retained for up to one year and a decline for approximately 30 days.

Before you make an analytics choice, a temporary attribution technology may retain the referring campaign or website for a limited period so attribution is not lost if you later consent. It does not contain a persistent visitor identifier.

Global Privacy Control

If your browser sends a recognized Global Privacy Control (“GPC”) signal, Core treats that signal as a request not to activate optional analytics tracking for that browser and, where applicable, as an opt-out request under relevant U.S. state privacy laws.

Google Analytics and advertising technologies

Core does not currently use Google Analytics or Google Tag Manager on this website.

Core also does not currently use website analytics data for cross-site behavioral advertising.

If our analytics, advertising, or cookie practices materially change, we will update this Privacy Policy and our consent controls as required before or when those technologies are introduced.

Managing your preferences

You may accept or decline optional analytics through the website’s consent controls.

You may change your analytics preference at any time through the Cookie Settings link available on the website.

You may also block or delete cookies through your browser settings. Blocking optional analytics cookies will not prevent you from accessing the general website.

9. Security

Core maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, use, alteration, disclosure, loss, or destruction.

Website forms and uploaded documents are transmitted using encrypted HTTPS connections. Access to submitted information is restricted to personnel and service providers who have a legitimate business need for access.

Our safeguards are designed to support the confidentiality, integrity, and availability of information appropriate to the nature of the information and the services involved.

However, no website, Internet transmission, electronic storage system, or security measure can be guaranteed to be completely secure. Accordingly, we cannot guarantee absolute security of information transmitted to or maintained by us.

10. Data Retention

Core retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• respond to and maintain records of inquiries;
• manage current or prospective business relationships;
• provide requested services;
• maintain appropriate business and consent records;
• comply with legal, regulatory, accounting, contractual, or reporting obligations;
• resolve disputes;
• enforce agreements; and
• protect the security and integrity of our systems.

Retention periods vary depending on the type of information, purpose of processing, applicable legal requirements, and nature of our relationship with you.

First-party website analytics information is automatically deleted after approximately 13 months.

When information is no longer reasonably required, Core will delete, anonymize, or otherwise dispose of it in accordance with applicable requirements and our information-management practices.

11. Your Privacy Rights

Depending on where you reside and whether the applicable privacy law covers the relevant processing, you may have rights regarding your personal information.

These may include the right to:

• request access to personal information we maintain about you;
• request correction of inaccurate personal information;
• request deletion of certain personal information;
• request a portable copy of certain information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent;
• opt out of the sale or sharing of personal information where applicable;
• opt out of targeted advertising where applicable;
• limit certain uses of sensitive personal information where applicable; and
• appeal a decision concerning a privacy request where applicable law provides that right.

Core does not currently sell personal information collected through this website or use it for targeted advertising as those terms are defined under applicable comprehensive U.S. state privacy laws.

We will not discriminate against you for exercising a privacy right provided by applicable law.

Submitting a request

To submit a privacy request, contact:

privacy@coreclinicaltrials.co

or write to the mailing address in Section 16.

We may need to request reasonable information to verify your identity and confirm that a request relates to you. We will use information provided for verification only as reasonably necessary to process the request.

Where permitted by law, an authorized agent may submit a request on your behalf. We may require evidence of the agent’s authority and may contact you directly to verify the request.

We will respond to verified privacy requests within the timeframe required by applicable law.

Some rights are subject to exceptions. For example, we may be permitted or required to retain certain information for legal, security, regulatory, contractual, fraud-prevention, or recordkeeping purposes.

12. Additional Information for California and Other U.S. State Residents

Certain U.S. state privacy laws provide qualifying residents with additional rights regarding personal information.

Depending on the law and its applicability to Core, categories of personal information collected through this website may include:

• identifiers, such as name, email address, telephone number, IP address, or similar identifiers;
• professional or employment-related information, such as company, title, role, specialty, and professional experience;
• commercial or business information relating to an inquiry or prospective relationship;
• Internet or electronic network activity information relating to use of the website; and
• information voluntarily submitted through forms, communications, or uploaded documents.

Core collects these categories for the business purposes described in this Privacy Policy.

Core does not currently sell personal information collected through this website, share it for cross-context behavioral advertising, or use it for targeted advertising.

Core does not offer financial incentives in exchange for personal information collected through this website.

Residents may exercise applicable state privacy rights by contacting us as described in Section 11.

13. International Visitors and Data Transfers

Core Clinical Trials is based in the United States, and information submitted through this website may be processed and stored in the United States.

If you access the website from outside the United States, your information may therefore be transferred to a jurisdiction whose data-protection laws differ from those in your home jurisdiction.

Where required by applicable law, Core will use appropriate safeguards or legally recognized transfer mechanisms for international transfers of personal information.

Visitors located in the European Economic Area, United Kingdom, Switzerland, and certain other jurisdictions may have rights including access, correction, deletion, restriction, objection, portability, withdrawal of consent, and the right to lodge a complaint with an appropriate data-protection authority.

The availability of a particular right depends on applicable law and the circumstances of the processing.

14. Children

The Core Clinical Trials public website is directed to professional and business audiences and is not intended for children.

We do not knowingly collect personal information through this website from children under 13.

If we learn that personal information from a child under 13 has been submitted through this website in a manner subject to the Children’s Online Privacy Protection Act or other applicable law, we will take appropriate steps to address the information.

This section does not apply to clinical trial participation involving minors. Information relating to clinical trial participants is governed separately by the applicable study protocol, informed consent or assent process, clinical research systems, and regulatory requirements.

15. Third-Party Websites

The Core website may contain links to websites, applications, or services operated by third parties.

Core does not control the privacy, security, or information practices of independent third parties. When you leave our website, the privacy policy and terms of the third-party service apply.

We encourage you to review the privacy practices of any external website or service before providing personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our website, services, technology, business practices, or legal requirements.

When we make changes, we will update the “Last Updated” date at the top of this page.

If a change materially affects how we process personal information, we may provide additional notice where required by applicable law.

17. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or personal information associated with you, or if you wish to exercise a privacy right, contact:

Core Clinical Trials
Privacy: privacy@coreclinicaltrials.co
General: info@coreclinicaltrials.co
Phone: 561-765-7673

Mail:
Core Clinical Trials
455 NE 5th Avenue, Suite D343
Delray Beach, FL 33483
United States