Privacy Policy
Yendou Privacy Policy
Last Updated: July 25, 2025
This Yendou Privacy Policy (“Privacy Policy”) applies to the collection, use, transfer, and disclosure of personal information for users of the Yendou platform (“Platform”), a website and application of Yendou GmbH (“Yendou”, “we”, “our”, and/or “us”). We value the privacy of individuals (“you”, “your” and/or “users”) who use the Platform.
Your Personal Information
We may collect a variety of information from or about you or your devices from various sources, as described below. If you do not provide your information when requested, you may not be able to use the Platform if that information is necessary to provide you with the Platform or if we are legally required to collect it.
When you use the Platform, you may provide us with personal information, such as your name, telephone number, email address, job title, and organization details. You may also provide profile preferences including your availability, communication channel preferences, and connections with other users.
For site networks/contributors, we collect Contributor Data such as site infrastructure details, patient population availability, operational data, and staff personal information (e.g., names, emails, phone numbers, CVs, GCP certifications) for the global site directory.
We may also collect your IP address, web browser type, operating system version, phone or internet carrier, manufacturer, application installation details of the Platform, and device identifiers.
How We Use Your Information
We may use the information we collect for the following purposes and as otherwise described in this Privacy Policy:
To provide, maintain, improve, and enhance the Platform;
To create and improve profiles about you or your sites within the Platform that we may share with third parties;
To personalize your experience on the Platform, such as by providing tailored content, site recommendations, and visibility to business opportunities providers
To understand and analyze how you use the Platform and to help us improve it to develop new products, features, and functionalities by collecting information about your use of and interactions within the Platform, like the pages or content you view, searches you conduct, connections you make, comments/posts, communications via the Platform, services/transactions requested, and dates/times of interactions;
To communicate with you, provide updates and other information relating to the Platform, provide information that you request, respond to comments and questions, and otherwise provide support;
To facilitate connections with third-party services or applications;
To generate and publish reports, provide analytics or to support Yendou products that we may provide to Yendou customers and for which we may charge a fee;
To understand and analyze site data for business benefits, such as enabling access to clinical trial opportunities;
To find and prevent fraud and respond to trust and safety issues that may arise;
For compliance purposes, including enforcing our Terms or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
For other purposes for which we provide specific notice at the time the information is collected.
Sharing Your Personal Information
We may share personal information about you as described in this Privacy Policy.
Yendou Affiliates, Subsidiaries, Service Providers, and Other Third Parties: We may share personal information about you with our affiliates and subsidiaries and with our service providers, such as Amazon Web Services, for the purpose of providing the Platform. We may also share personal information about you with third parties who access Yendou products, reports, or analytics that include information you have shared through the Platform.
Other Users of the Platform: We display your user profile, posts, and site details (e.g., qualification data) on the Platform for other users to view, subject to Visibility Controls and your consents.
As Required By Law and Similar Disclosures: We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety.
Merger, Sale, or Other Asset Transfers: We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.
Consent: We may also disclose your information with your permission or at your direction, such as granular consents for sharing with all clinical trial provider clients or logo use in marketing.
Information from Cookies and Similar Technologies
We collect information using cookies, pixel tags, and similar technologies. Cookies are small text files containing a string of alphanumeric characters. We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to the Platform.Please review your web browser’s “Help” file to learn the proper way to modify your cookie settings. Please note that if you delete or choose not to accept cookies from the Platform, you may not be able to use its features to their fullest potential.
Third Parties
The Platform may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party sites and services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
Security
The Platform implements security safeguards to protect the personal information it collects and uses. Yendou partners with internationally recognized cloud platform providers, such as Google Cloud Platform (GCP), to provide the Platform. These cloud providers operate data centers that are Tier3+ facilities, certified against established standards such as SSAE 18 and/or ISO27001. The processing of data is performed with a combination of a Yendou-maintained web front-end running on top of GCP. The security of your personal information, the service, and the infrastructure it operates on are protected by a combination of security controls provided by GCP and third-party Internet security software providers, which are monitored by a dedicated Yendou Security Operations team. Additionally, GCP operates its own dedicated Security Operations team that monitors the confidentiality, integrity, and availability of the underlying infrastructure.
Children’s Privacy
We do not knowingly collect, maintain, or use personal information from children under 13 years of age, and no part of the Platform is directed or marketed to children.
HIPAA
The Platform is not designed to store Protected Health Information (PHI) or be HIPAA-compliant. If PHI is involved (e.g., in patient population data), a separate Business Associate Agreement (BAA) must be executed.
Changes to this Privacy Policy
We will post adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through the Platform, we will notify you through the Platform, by email, or other form of communication.
Right to Access, Change, or Delete Your Personal Data
If you wish to access, amend, or delete any personal information you have provided to us, you may contact us via email at zina@yendou.com. For withdrawal of consents (e.g., data sharing or logo use), use platform settings or the same email—revocation triggers immediate cessation and deletion where feasible.
Region-Specific Policies
CCPA
This section supplements the information contained in the rest of our Privacy Policy and applies to all Consumers residing in the state of California according to “The California Consumer Privacy Act of 2018” (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”). Consumers are referred to below as “you”, “your”, “yours”, and, for such Consumers, these provisions supersede any other possibly divergent or conflicting provisions contained in the Privacy Policy. This part of the Privacy Policy uses the terms “Consumer”, “Personal Information”, “Sale” and “Business Purpose” as they are defined in the CCPA. All other capitalized terms in this section of the Privacy Policy are intended to have the same meaning as in the CCPA.
GDPR
This section provides specific information about how the Platform complies with the EU General Data Protection Regulation (“GDPR”). It supplements the information contained in the rest of our Privacy Policy and applies to all data subjects residing in the European Union, the United Kingdom, or Switzerland.
Our EU Data Protection Officer and Information Security Officer have assessed our obligations as a data controller for the Platform. Operating in a way that fosters trust and transparency, we appreciate the GDPR benefits of improving our business, becoming more efficient, and creating better relationships with our users and those whose data they collect.
In compliance with the EU General Data Protection Regulation, Yendou processes your personal data in the ways described in this Privacy Policy:
as necessary we seek your consent to process your personal data as provided below;
as necessary for our or third-parties' legitimate interests, including our interests in providing an innovative, safe, personalized and profitable service to our users and partners, unless those interests are overridden by your interests or fundamental rights and freedoms that require protection of personal data.
as necessary to fulfill our Terms;
as necessary to comply with our legal obligations;
Yendou respects your privacy and assures that your personal data will be kept securely according to GDPR. By accepting, you give your acknowledgement and consent to Yendou to use your personal data for the purposes stated in this Privacy Policy. You agree that your consent will remain in place until your withdrawal. You may withdraw by contacting Yendou via email at zina@yendou.com.
Transfer of Your Personal Data Outside of the EU?
Yendou collects and processes your data in the European Economic Area (EEA). Transfer or access by Yendou personnel, datacenter providers, and as provided above, outside of the EEA will only be made using legal mechanisms approved by the EU (e.g., the European Standard Contractual Clauses, intergroup agreements).
Your Data Privacy Rights Under the GDPR?
You can exercise your data protection rights to access, rectify, restrict, or erase your data, to object to the processing, and to data portability/transfer by contacting Yendou at zina@yendou.com. You may also contact your relevant Data Protection Authority with any privacy concerns that you may have.
How Long Your Personal Data Is Kept?
We will retain this information until it is no longer necessary to provide our services and products or until you request its deletion by contacting Yendou at zina@yendou.com, whichever comes first (or as otherwise required by law).
Yendou’s Data Protection Officer?
Yendou’s Data Protection Officer can be contacted at felix@yendou.com.
LGPD
Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (“LGPD”), entered into effect on August 16, 2020. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with the following rights regarding their data:
confirmation of the existence of treatment;
access to data;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or elimination of unnecessary, excessive or treated data in discrepancy with the provisions of the law;
data portability to another service provider or product, upon express request and observance of commercial and industrial secrets, in accordance with the regulations of the controlling body;
data portability to another service or product provider, upon express request, in accordance with the national authority regulations, observing the commercial and industrial secrets;
elimination of personal data processed with the consent of the holder, except in the cases provided for in Article 16 of the law;
information of any public and private entities with which the controller has made shared use of data;
information on the possibility of not providing consent and on the consequences of refusal;
revocation of consent, pursuant to paragraph 5 of Article 8 of the law.
A Brazilian Data Protection Authority, Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados or “ANPD”) has been established to provide forthcoming rules and guidance on how to interpret and implement the LGPD’s requirements. Pending such developments, Yendou’s LGPD approach may be subject to further change.