Privacy notice

Information collected

The assessment form collects contact name, email address, country or region, research field, study design, requested service, project stage, a project description, and optional journal, word-count, and desired-date details. If files are selected, it also receives the permitted research files and records their names, formats, sizes, integrity hashes, storage references, and review status. A generated inquiry reference, consent version, and timestamps are also recorded.

Information you must not submit

Do not submit direct or indirect patient or participant identifiers, protected health information, raw clinical records, re-identification keys, credentials, payment details, malware, or material you are not authorized to share. Uploaded datasets must be appropriately de-identified before transfer. Higher-risk material requires separate legal, security, ethics, and data-handling review and must not be sent through this public service.

Purposes

• Assess suitability, scope, expertise, conflicts, timing, and security needs.
• Respond to the inquiry and, where appropriate, prepare a proposed scope or quotation.
• Prevent abuse and maintain the security and reliability of the service.
• Meet legal or professional obligations applicable to a later accepted engagement.

Security and abuse prevention

The inquiry form may use Cloudflare Turnstile to distinguish legitimate visitors from automated abuse. Cloudflare may process technical signals associated with the security check under its own privacy terms. MedRigor also applies server-side validity checks, high-confidence spam signals, and submission-rate limits based on the normalized email address. Messages classified with high confidence as unsolicited promotional abuse are not retained as inquiries or included in administrative notifications.

Storage, access, and hosting

Inquiry details and upload metadata are stored in a restricted Cloudflare D1 database. File contents are stored separately in a private Cloudflare R2 bucket with no public website download route. New files are marked as quarantined pending authorized review. Access must remain limited to personnel administering or assessing the inquiry. Cloudflare may process technical data needed to deliver and secure the service under its own terms and privacy documentation.

Upload controls and limitations

The service enforces file-count, size, extension, and selected file-signature checks and uses short-lived authorization tied to the inquiry. These controls do not amount to antivirus scanning, verify de-identification, or prove that a file is safe or lawfully shared. Uploaded material is treated as untrusted until reviewed. The website does not publish uploaded objects or provide a public download endpoint.

Email notifications, correspondence, and attachments

When an inquiry is submitted, a plain-text administrative notification is sent through Google Gmail to veodeep@gmail.com. It includes the inquiry reference, contact details, requested service, project description, target journal, and file count so the request can be reviewed and answered. Uploaded file contents, file names, storage keys, and download links are not included in the notification; file contents remain in private Cloudflare R2 storage. Customer correspondence and any files later sent directly by email are processed through Gmail and are separate from the website's D1 and R2 storage. The website upload should be used for permitted files. Never email patient or participant identifiers, protected health information, clinical records, credentials, payment details, or other highly sensitive material.

Optional live chat

MedRigor Research uses Crisp IM SAS as a service provider for optional website chat. The chatbox code connects to Crisp to provide the widget. With Total Privacy Mode enabled, Crisp defers creation of the visitor's chat session until the visitor manually opens the chatbox. If you open or use chat, Crisp may process technical connection data such as IP address, browser or device information and the source page, together with any name, email address, or message content you choose to provide. Crisp states that messaging data is stored in the European Union; relay servers outside the European Union may process limited connection logs. Crisp retains conversation history by default, and chat records must be reviewed and removed under MedRigor's approved retention process. Do not send patient or participant identifiers, protected health information, clinical records, credentials, payment details, highly sensitive information, or research files through chat. Use the secure assessment form for permitted de-identified files. See the Crisp privacy statement for provider information.

Retention

New inquiries and uploaded files are assigned a proposed deletion date twelve months after submission. Accepted projects may require a different contractual or legally required retention period. Retention and deletion remain subject to legal review, an approved operating schedule, and coordinated removal of both database records and stored objects.

International access

The service is available internationally. Hosting and service providers may process information in jurisdictions different from yours. Appropriate transfer safeguards and jurisdiction-specific disclosures must be reviewed as the pilot expands.

Your requests

Subject to applicable law, you may ask to access, correct, or delete inquiry information or withdraw consent where consent is the applicable basis. Email veodeep@gmail.com, provide your inquiry reference where available, and state “Privacy request” without adding sensitive information.

Changes

This notice may be updated as the service, legal structure, contact channels, or international scope develops. The consent-version date stored with new inquiries is 20 August 2026.