Weva’s Privacy Policy describes how Weva collects, uses, stores, protects and shares personal data when you use Weva websites, apps, services and products, including Weva Read, Auto History, clinical trial matching, practitioner discovery, support, billing and related services.
In addition to this Privacy Policy, we provide product-specific privacy notices and consent screens for features that collect or use sensitive information, health information, biometric information, clinical information, location information, or information used for artificial intelligence and machine learning. You will be given an opportunity to review relevant product-specific information before using those features.
You can contact us about this Privacy Policy, your privacy rights, or a complaint at privacy@weva.ai.
We treat data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable person as “personal data.” This includes direct identifiers such as name and email address, and indirect identifiers such as device identifiers, account identifiers, IP addresses, cookie identifiers, clinical identifiers, voice recordings, images, recordings, biometric templates, and other information that can reasonably be linked to a person.
Health information, biometric information, genetic information, children’s information, government-related identifiers, and information about clinical care or clinical trial participation may be sensitive information or special category data under applicable laws. We apply additional protections to this information.
Aggregated information is information combined from multiple individuals so that it does not identify, and is not reasonably capable of identifying, a person. De-identified, pseudonymised, coded, tokenised, or masked information may still be personal data if Weva or another party can reasonably re-identify or link it to an individual. We do not treat information as anonymous unless re-identification is not reasonably possible using available means.
This Privacy Policy applies to Weva and Weva-affiliated companies (collectively, “Weva,” “we,” “us,” or “our”). It does not apply to independent third parties, healthcare providers, clinical trial sponsors, research organisations, app developers, publishers, or websites that operate under their own privacy notices. Where you use third-party services through Weva, you should review the third party’s privacy notice.
Subject to applicable law, you may have rights to know whether we process your personal data, access it, correct it, delete it, receive a copy of it, transfer it, restrict or object to processing, withdraw consent, opt out of direct marketing, and challenge certain automated decision-making or profiling. Where we process personal data based on your consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before withdrawal, and it may affect our ability to provide features that rely on that data.
To exercise your privacy rights contact privacy@weva.ai. To protect personal data, we may verify your identity and request information reasonably necessary to respond. If a service provider processes personal data on our behalf, we will require it to assist us with lawful rights requests.
We may refuse, limit, or defer a request where permitted or required by law, for example where we must retain information for legal, regulatory, security, fraud prevention, audit, clinical safety, medicolegal, tax, payment, dispute resolution, or records-management reasons; where disclosure would adversely affect the rights and freedoms of others; or where a request is manifestly unfounded or excessive. If we refuse a request, we will provide reasons in writing where required by law.
Where lawful and practicable, you may interact with Weva anonymously or using a pseudonym, such as when browsing general website content or making general enquiries. Some services cannot be provided anonymously because we need information to create an account, verify identity, provide clinical functionality, process payments, match trial criteria, maintain safety records, or comply with law.
We collect personal data that is reasonably necessary for our functions and activities, to provide requested services, to comply with law, and for other purposes described in this Privacy Policy or product-specific notices. Depending on how you interact with Weva, we may collect:
You are not required to provide requested personal data. However, if you do not provide information that is necessary for a particular service, we may not be able to provide that service, respond to your request, or comply with applicable legal or clinical obligations.
We may receive personal data from you, from people acting at your direction, from healthcare providers, practitioners, clinical trial sponsors, research organisations, device providers, identity verification providers, payment providers, analytics providers, fraud prevention partners, service providers, publicly available sources, and other lawful sources.
For research and development, we may acquire or use datasets containing images, voices, documents, clinical information, behavioural signals, or other information. We do so in accordance with applicable law, contracts, ethics approvals where applicable, and privacy safeguards. We do not attempt to re-identify individuals from genuinely anonymised datasets. Where datasets are personal data, we process them under an applicable legal basis and apply appropriate safeguards.
We use personal data to provide, maintain, secure, improve and develop Weva services; process transactions; communicate with you; support clinical, research and trial-related workflows; comply with law; and conduct Weva’s business responsibly. We may also use personal data for other purposes with your consent or as otherwise permitted by law.
Depending on the circumstances and jurisdiction, our legal bases may include performance of a contract, compliance with legal obligations, legitimate interests, vital interests, public interest, explicit consent, consent, and other bases permitted by law. For health information, biometric information, and other sensitive information, we rely on an additional lawful condition where required, such as explicit consent, provision of health or social care, public health, scientific research with safeguards, legal claims, or another permitted basis. We do not rely on legitimate interests alone to process special category health or biometric data where a separate special category condition is required.
Retention. We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, for compatible purposes described in this Privacy Policy or product-specific notices, or as required or permitted by law. Retention periods vary depending on data type, service, legal obligations, clinical or research record requirements, security needs, disputes, and user choices. We will delete, de-identify, aggregate, or archive personal data when it is no longer required, unless retention is required or permitted by law.
We may share personal data with Weva-affiliated companies, service providers, healthcare providers, clinical trial sponsors, research organisations, professional advisers, regulators, partners, developers, publishers, or others at your direction, with your consent, or where permitted by law. We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.
We use administrative, technical and physical safeguards designed to protect personal data, taking into account the nature of the data, risks, technology, cost, and applicable law. Safeguards may include encryption, access controls, logging, monitoring, segmentation, secure development practices, vulnerability management, staff training, confidentiality obligations, vendor assessments, and incident response procedures.
If a data breach occurs, we will assess and respond in accordance with applicable laws. In Australia, where the Notifiable Data Breaches scheme applies, we will assess suspected eligible data breaches as expeditiously as practicable and, where required, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable. In the EEA or UK, where required, we will notify the relevant supervisory authority and affected individuals within applicable statutory timeframes.
Weva’s services are not intended for children unless the service expressly permits child use with appropriate parental, guardian, clinical, or legal authorisation. The age at which a person may consent to digital services varies by country. In the European Economic Area, the default age is 16 unless a Member State has set a lower age permitted by law. In Australia, we will seek parental or guardian involvement where appropriate, particularly for health information or where the individual lacks capacity to provide informed consent.
If a child account or child-related service is offered, the parent or legal guardian must review the applicable child or family privacy disclosure and provide verifiable consent where required. If we learn that a child’s account was created without required authorisation, we may deactivate, restrict, or transfer management of the account in accordance with law and safety considerations.
To exercise privacy rights for a child’s information, contact privacy@weva.ai.
Weva websites, apps, emails and online services may use cookies, pixels, software development kits, local storage, web beacons and similar technologies. These technologies may collect personal data, including IP addresses, device identifiers, cookie identifiers, usage information, and interaction data.
Where required by law, we will not set non-essential cookies, pixels, email tracking, analytics, or marketing technologies unless you have given prior consent through our cookie or consent tools. You can change cookie preferences using our cookie settings where available. Browser settings may also allow you to block or delete cookies, but some features may not work if cookies are disabled.
We may use click-through links or pixels in emails to measure delivery, engagement, and effectiveness. Where consent is required, we will seek it before using non-essential email tracking. You can unsubscribe from marketing emails using the link in the email or by contacting us.
Weva operates internationally. Personal data may be processed in the country where you live and in other countries where Weva, its affiliates, service providers, or partners operate. These countries may include Australia, Singapore, the United States, the United Kingdom, countries in the European Economic Area, and other countries identified in product-specific notices or vendor disclosures.
When we disclose personal data outside your country, we take steps designed to protect it in accordance with applicable law. For Australian personal information, we take reasonable steps under APP 8 to ensure overseas recipients handle the information consistently with the Australian Privacy Principles, unless an exception applies. For EEA, UK or Swiss personal data transferred to a country that has not been found adequate, we use appropriate safeguards such as Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, transfer risk assessments, supplementary measures, or another lawful transfer mechanism.
The Weva entity that controls or is responsible for personal data may differ depending on where you live, the service you use, and applicable terms. Product-specific notices and terms may identify the relevant controller or responsible entity. Where Weva Australia Pty Ltd collects health information in Australia, that information may be stored in Australia and may be used or accessed by Weva affiliates and service providers only where lawful, protected by appropriate safeguards, and consistent with this Privacy Policy, product notices, consents, and contracts.
If the Privacy Act 1988 (Cth) applies, Weva handles personal information in accordance with the Australian Privacy Principles (APPs). Sensitive information, including health information and biometric information used for automated biometric verification or identification, will be collected with consent where required and only where reasonably necessary for Weva’s functions or activities, or where another legal basis applies.
We will use and disclose personal information only for the primary purpose for which it was collected, for related secondary purposes reasonably expected by you where permitted, with your consent, or where otherwise permitted by law. We will seek express consent where required for secondary uses of health information, including AI training or model improvement that is not reasonably necessary to provide a requested service or otherwise permitted under a health, research, safety, or legal exception.
We do not adopt government-related identifiers as our own identifiers. We use or disclose government-related identifiers only where required or authorised by law, reasonably necessary to verify identity or provide a lawful health, payment, fraud prevention, safety, or regulatory function, or otherwise permitted under APP 9.
You may complain about an alleged breach of the APPs by contacting privacy@weva.ai. We will acknowledge and respond to complaints within a reasonable period. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints.
If the EU GDPR or UK GDPR applies, Weva will identify the relevant controller in the applicable terms, product notice, or contact response. Where required, Weva will appoint an EU and/or UK representative and a Data Protection Officer or privacy contact.
Where we process special category data such as health information, biometric data for uniquely identifying a person, genetic data, or data concerning sex life or sexual orientation, we will rely on a lawful Article 6 basis and an Article 9 condition, such as explicit consent, health or social care, public health, scientific research with safeguards, legal claims, vital interests, or another lawful condition. We will provide more specific legal basis information in product-specific notices where required.
You may have rights under Articles 15 to 22 of the GDPR, including access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making and profiling. You also have the right to lodge a complaint with a supervisory authority in the country where you live, work, or where you believe an infringement occurred. For UK users, this may be the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.
This section explains how Weva may use data for AI development, model evaluation, model improvement, training, validation, safety testing, and related activities while preserving Weva’s ability to provide and improve its business services.
We communicate privacy and security requirements to Weva personnel and require personnel and service providers to follow appropriate privacy, confidentiality, and security obligations.
If you have questions about this Privacy Policy, Weva’s privacy practices, a data subject request, a complaint, or our Data Protection Officer or privacy contact, contact privacy@weva.ai.
We take privacy enquiries seriously. We will review your enquiry, may request additional information, and will respond within a reasonable period or within the period required by law. Where a complaint indicates that improvement is needed, we will take reasonable steps to address the issue.
You may refer a complaint to the relevant regulator if you are not satisfied with our response. In Australia, you may contact the OAIC at https://www.oaic.gov.au/privacy/privacy-complaints. In the EEA, you may contact a supervisory authority in your Member State. In the UK, you may contact the ICO at https://ico.org.uk/make-a-complaint/.
When there is a material change to this Privacy Policy, we will post a notice on our website in advance where practicable and contact you directly where required by law or where we have appropriate contact details.
.svg)
.svg)