Privacy Policy

USDMPlay respects your privacy and aims to collect and use only the personal information reasonably necessary to operate the Platform.

This Privacy Policy explains how personal data is collected, used, stored and protected when you visit usdmplay.com, create a USDMPlay account or use the USDMPlay application and related services.

USDMPlay is a free, independent, community-oriented educational and demonstration platform for learning and exploring the CDISC Unified Study Definitions Model (“USDM”).

This Privacy Policy should be read together with the USDMPlay Terms & Conditions.

1. Who Is Responsible for Your Personal Data?

USDMPlay is owned and operated by:

Rajesh Saha
Belgium

Rajesh Saha is the data controller for personal data processed in connection with USDMPlay.

This means that Rajesh Saha determines why and how personal information relating to USDMPlay users is processed.

For privacy questions or requests concerning your personal data, contact:

Email: support@usdmplay.com

USDMPlay has not appointed a formal Data Protection Officer (“DPO”). Privacy-related questions and data-subject requests should therefore be directed to the email address above.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• the USDMPlay public website;
• user registration;
• account authentication;
• the USDMPlay application;
• USDM JSON uploads;
• mappings and downstream use cases;
• Ask USDM and other AI-enabled functionality;
• feedback forms;
• support communications;
• optional newsletters or updates;
• cookies and similar technologies;
• application and security logs; and
• other functionality made available through USDMPlay.

This Policy does not govern third-party websites merely because USDMPlay links to them.

3. Our Privacy Principles

USDMPlay aims to process personal data according to the following principles:

• collect only information reasonably necessary for the Platform;
• use information only for clear and legitimate purposes;
• minimise the amount of personal information collected;
• avoid collecting sensitive clinical information;
• retain information only for as long as necessary;
• protect personal information through reasonable technical and organisational safeguards;
• provide users with transparency about how their information is used; and
• respect applicable rights under European and Belgian data-protection law.

4. What Personal Information We Collect

The information collected depends on how you interact with USDMPlay.

The main categories are described below.

4.1 Account Registration Information

When you create a USDMPlay account, we collect the information requested during registration.

This may include:

• your name;
• your email address;
• other registration information voluntarily provided through the registration form;
• account creation date;
• account status; and
• information necessary to administer your account.

Your email address is also used for account authentication.

USDMPlay does not require or store a traditional account password.

5. Passwordless Authentication and OTP Information

USDMPlay uses a One-Time Password (“OTP”) authentication mechanism.

When you sign in, USDMPlay may process:

• your email address;
• an OTP or authentication code;
• the time the authentication code was generated;
• authentication status;
• login timestamps; and
• technical information necessary to verify the login request.

An OTP is temporary authentication information.

USDMPlay does not store a reusable user password for your account.

You are responsible for protecting access to the email account used to receive your login code.

6. Login and Account Activity Information

USDMPlay may retain basic account activity information necessary to administer the Platform.

This may include:

• date and time of account creation;
• date and time of login;
• date of most recent successful login;
• account activity status; and
• information necessary to determine whether the 10-day study-data retention rule has been reached.

The most recent successful login date is particularly important because it is used to determine when study and project information should be removed under USDMPlay’s data-retention policy.

7. Study and Project Information

When you use the interactive application, you may provide or create study-related information.

This may include:

• uploaded USDM JSON files;
• studies created from those files;
• information extracted from USDM JSON;
• relational representations of USDM objects;
• database records derived from uploaded USDM information;
• mapping information;
• mapping results;
• Schedule of Activities information;
• Patient Journey information;
• SDTM Trial Design-related information;
• ICH M11-related information;
• Define.xml-related information;
• use-case outputs;
• generated visualisations;
• transformed information; and
• other study-specific information generated through USDMPlay.

This information should not contain personal data.

USDMPlay permits only publicly available, synthetic, anonymised or otherwise non-production study information that you are authorised to use.

Users must not upload identifiable patient information, participant data, confidential production clinical data or other prohibited information.

8. Prohibited Personal and Clinical Data

USDMPlay is not designed or intended to process patient-level or regulated clinical personal data.

You must not upload or enter:

• identifiable patient information;
• clinical trial participant identifiers;
• personal health information;
• medical records;
• special-category health data relating to identifiable individuals;
• production clinical trial data containing personal data;
• sponsor-confidential information you are not authorised to disclose;
• employee or third-party confidential information;
• passwords;
• API secrets;
• private authentication credentials; or
• other restricted personal information.

If you believe that personal or confidential information has accidentally been uploaded, contact:

support@usdmplay.com

as soon as possible.

Where inappropriate personal information is identified, USDMPlay may remove it.

9. Ask USDM and AI Processing

USDMPlay provides AI-enabled functionality, including Ask USDM.

When you deliberately open and interact with Ask USDM, you are interacting with an artificial intelligence-enabled feature.

Ask USDM may process:

• the question or prompt you submit;
• contextual information required to interpret your question;
• information associated with your selected study;
• structured study information stored in USDMPlay;
• database queries generated from your question;
• results retrieved from the database; and
• the response generated for you.

USDMPlay may use text-to-SQL and related AI techniques to convert natural-language questions into structured database queries.

The purpose of this processing is to allow you to ask conversational questions about the study design represented within your USDMPlay environment.

10. Personal Data and AI Prompts

You must not enter:

• patient information;
• confidential personal information;
• protected health information;
• production clinical data;
• personal identifiers; or
• information you are not authorised to disclose

into Ask USDM or any other AI-enabled feature.

The restrictions applicable to uploaded USDM files apply equally to AI prompts.

11. AI Conversation and Generated Information

AI questions, generated database queries, responses or other AI-related information may be processed to provide the requested functionality.

Where AI interaction information is stored as part of your study or project environment, it is treated as study/use-case information and is subject to the same study-data retention policy described below.

AI-generated answers are educational outputs and should be independently reviewed as described in the USDMPlay Terms & Conditions.

12. Feedback and Support Information

If you use the USDMPlay Feedback Form or contact USDMPlay for support, we may receive information such as:

• your name;
• your email address;
• the content of your message;
• feedback;
• bug reports;
• enhancement requests;
• technical information you voluntarily provide;
• screenshots or attachments you choose to provide; and
• correspondence relating to the request.

This information is used to:

• answer your request;
• investigate technical issues;
• improve USDMPlay;
• resolve bugs; and
• understand user needs.

Do not include confidential, patient-level or sensitive information in feedback or support communications.

13. Newsletter and Educational Updates

USDMPlay may provide users with the option to subscribe to educational updates, tutorials, USDM examples, Platform news or similar communications.

If you voluntarily subscribe, we may process:

• your email address;
• your subscription status;
• communication preferences; and
• information necessary to manage your subscription.

Subscription to such communications is optional.

You may unsubscribe at any time through the unsubscribe option provided in the communication or by contacting:

support@usdmplay.com

We do not require users to subscribe to marketing or educational emails in order to use USDMPlay.

14. Technical and Security Information

Like most internet services, USDMPlay may automatically receive technical information when you access the website or application.

This may include:

• IP address;
• browser type;
• device type;
• operating system;
• approximate technical location derived from network information;
• date and time of access;
• pages or Platform features accessed;
• authentication events;
• error information;
• application logs;
• server logs;
• security events; and
• similar technical information.

This information may be processed to:

• deliver the website;
• maintain application security;
• detect abuse;
• investigate technical problems;
• prevent unauthorised access;
• monitor Platform reliability; and
• improve the operation of USDMPlay.

USDMPlay does not use this information to make decisions about your clinical, employment, financial or personal circumstances.

15. Cookies and Similar Technologies

USDMPlay uses cookies and similar technologies.

Cookies are small pieces of information stored by your browser or device that enable certain website functions.

USDMPlay distinguishes between strictly necessary cookies and optional cookies.

15.1 Strictly Necessary Cookies

Certain cookies or similar technologies are necessary for USDMPlay to function properly.

They may be used for purposes such as:

• maintaining your authenticated session;
• keeping you signed in;
• recognising authentication state;
• maintaining Platform security;
• protecting against unauthorised requests;
• remembering essential technical settings; and
• maintaining cookie-consent preferences.

These technologies are required for functions specifically requested by the user and may be used without asking for consent where permitted by applicable law.

Disabling them through browser settings may prevent parts of USDMPlay from working correctly.

15.2 Analytics and Usage Cookies

USDMPlay may use optional analytics or measurement technologies to understand how the Platform is used and how it can be improved.

These may help us understand information such as:

• which pages are commonly visited;
• which Platform features are used;
• general navigation patterns;
• general website performance; and
• technical errors or usability issues.

Where such technologies require consent, they will not be activated until you choose to consent.

You may reject optional cookies and still use the core USDMPlay service.

16. Cookie Choices

Where optional cookies are used, USDMPlay provides a cookie-consent mechanism.

You should be able to choose between options such as:

• Accept optional cookies; or
• Reject optional cookies / continue with necessary cookies only.

You may also change or withdraw your cookie consent later.

Withdrawing consent does not affect processing that lawfully occurred before consent was withdrawn.

Strictly necessary cookies may continue to operate because they are required to provide essential Platform functionality.

17. Why We Process Personal Data

USDMPlay processes personal data only where there is an appropriate legal basis.

Depending on the processing activity, the applicable basis may include the following.

17.1 Providing the USDMPlay Service

We process account and authentication information where necessary to:

• create your account;
• authenticate you;
• provide access to Platform functionality;
• process study information;
• provide Ask USDM;
• administer your account; and
• provide the service you requested.

Legal basis: Article 6(1)(b) GDPR — processing necessary for the performance of our agreement with you, including the USDMPlay Terms & Conditions.

17.2 Security and Platform Protection

We may process technical and security information to:

• prevent unauthorised access;
• detect abuse;
• protect accounts;
• investigate security incidents;
• prevent fraud or misuse;
• maintain Platform availability; and
• protect USDMPlay and its users.

Legal basis: Article 6(1)(f) GDPR — our legitimate interests in maintaining a secure and reliable Platform.

We aim to limit this processing to what is reasonably necessary for those purposes.

17.3 Support, Feedback and Platform Improvement

We may process information you provide through support or feedback functionality to respond to your request and improve USDMPlay.

Depending upon the circumstances, the legal basis may be:

Article 6(1)(b) GDPR where processing is necessary to provide user support relating to the service; or

Article 6(1)(f) GDPR based upon our legitimate interest in maintaining and improving USDMPlay.

17.4 Optional Analytics

Where non-essential cookies or similar technologies are used for analytics and consent is required:

Legal basis: Article 6(1)(a) GDPR — your consent.

You may withdraw consent at any time.

17.5 Optional Newsletters and Communications

Where you actively subscribe to optional educational or Platform communications:

Legal basis: Article 6(1)(a) GDPR — your consent.

You may unsubscribe or withdraw your consent at any time.

17.6 Compliance With Legal Obligations

We may process or retain personal information where necessary to comply with an applicable legal obligation.

Legal basis: Article 6(1)(c) GDPR.

18. Summary of Processing Activities

19. Study and Project Data Retention

USDMPlay is designed as an educational and demonstration environment and not as a permanent study-data repository.

If you do not successfully log in to your USDMPlay account for 10 consecutive days, study and project information associated with your account may be automatically deleted.

This includes, where applicable:

• uploaded USDM JSON files;
• all studies created by the user;
• information extracted from the uploaded JSON;
• database information created from the uploaded JSON;
• relational representations;
• mapping information;
• mapping outputs;
• generated use-case information;
• USDM downstream-automation information;
• study-specific Ask USDM information where stored with the project;
• generated study outputs; and
• other study-specific or project-specific information.

Once deleted, this information may not be recoverable.

20. What Remains After the 10-Day Study Deletion?

Deleting study and project information does not automatically delete your USDMPlay user account.

After study/project information has been deleted, the minimum account information necessary to maintain your account may continue to be retained.

This may include:

• registration information;
• your email address;
• account identifier;
• account status;
• account creation information; and
• authentication/account-administration information.

This allows you to return to USDMPlay without creating a new account.

If you later return, you can upload or create new study information.

21. Account Data Retention

Your account information is generally retained while your USDMPlay account remains available.

You may request deletion of your account and associated personal information by contacting:

support@usdmplay.com

When an account-deletion request is completed, personal data associated with the account will be deleted or anonymised unless continued retention is necessary for:

• compliance with a legal obligation;
• security or fraud prevention;
• resolving an existing dispute;
• establishing, exercising or defending legal claims; or
• another lawful purpose permitted by applicable law.

Information will not be retained indefinitely merely because it might be useful in the future.

22. Support and Feedback Retention

Support requests and feedback may be retained for as long as reasonably necessary to:

• respond to the request;
• investigate the underlying issue;
• track resolution;
• identify recurring bugs;
• improve USDMPlay; or
• maintain evidence where reasonably required.

Information that is no longer necessary should be deleted or anonymised.

23. Cookie and Analytics Retention

Retention periods for cookies depend on the particular technology and its purpose.

Some cookies may exist only during a browser session, while others may remain for a limited period so that a user preference or consent choice can be remembered.

Where optional analytics tools are used, USDMPlay aims to configure retention in a privacy-conscious manner and avoid keeping identifiable analytics information longer than necessary.

Users may remove cookies through their browser settings.

24. Technical and Security Log Retention

Technical and security logs are retained only for as long as reasonably necessary for purposes such as:

• security monitoring;
• identifying malicious activity;
• troubleshooting;
• investigating technical incidents; and
• protecting users and the Platform.

Logs may be retained for longer where necessary to investigate a specific security incident, prevent abuse or comply with a legal requirement.

25. Who Can Access Personal Data?

Access to personal information is limited to persons who need it for legitimate purposes related to the operation of USDMPlay.

This may include:

• Rajesh Saha as owner, operator and data controller;
• persons authorised to assist with technical administration or maintenance; and
• third-party technical service providers acting as processors or independent controllers where necessary to provide specific services.

Access should be limited according to the purpose for which the information is required.

26. Third-Party Service Providers

USDMPlay may use third-party technical providers to operate the Platform.

Depending upon the Platform architecture, these may include providers of:

• web hosting;
• cloud infrastructure;
• databases;
• application hosting;
• email and OTP delivery;
• security services;
• analytics;
• AI services;
• error monitoring;
• domain or content-delivery infrastructure; and
• related technical services.

Such providers may process personal data only to the extent necessary to provide their services.

Where a third party processes personal information on behalf of USDMPlay, appropriate contractual and data-protection arrangements will be used where required.

USDMPlay does not sell users’ personal information to advertisers or data brokers.

27. AI Service Providers

Ask USDM and other AI-enabled functionality may rely upon external AI infrastructure or technical services.

Where an AI service provider processes information on behalf of USDMPlay, the information transmitted should be limited to what is reasonably necessary to provide the requested AI functionality.

Users must nevertheless comply with the prohibition against entering sensitive, patient-level, production or confidential information into Ask USDM.

Where required by law, AI providers acting as processors will be subject to appropriate data-processing arrangements.

28. International Data Transfers

Some technical service providers may operate infrastructure outside Belgium or the European Economic Area (“EEA”).

If personal data is transferred to a country outside the EEA, USDMPlay will seek to use an appropriate transfer mechanism where required by applicable law.

Depending on the destination and provider, such mechanisms may include:

• an adequacy decision adopted by the European Commission;
• European Commission Standard Contractual Clauses (“SCCs”);
• another legally recognised transfer mechanism; or
• another lawful derogation applicable to the particular transfer.

USDMPlay aims to minimise unnecessary international transfers of personal information.

You may contact support@usdmplay.com for further information concerning applicable safeguards.

29. No Sale of Personal Data

USDMPlay is a free educational and community initiative.

USDMPlay does not sell personal data.

Personal data is not provided to third parties in exchange for payment for advertising or data-broker purposes.

30. No Behavioural Advertising

USDMPlay does not intend to create behavioural advertising profiles from users’ clinical-study or USDM activity.

Study information uploaded to USDMPlay is not intended to be used to target users with advertising.

31. Automated Decision-Making and Profiling

Ask USDM uses automated AI processing to answer questions about structured study information.

However, USDMPlay does not use Ask USDM to make decisions about individuals that produce legal effects or similarly significant effects.

USDMPlay does not use the AI chatbot to determine matters such as:

• employment;
• creditworthiness;
• insurance;
• medical treatment;
• clinical trial eligibility;
• patient care;
• regulatory approval; or
• other significant personal decisions.

Ask USDM is an educational study-design exploration tool.

32. Security

USDMPlay takes reasonable technical and organisational measures intended to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• accidental loss;
• alteration;
• misuse; and
• destruction.

Measures may include, where appropriate:

• passwordless OTP authentication;
• access controls;
• application security controls;
• secure communications;
• database access restrictions;
• infrastructure security measures;
• logging and monitoring; and
• limited administrative access.

No online service can guarantee absolute security.

Users must therefore continue to follow the data restrictions in the Terms & Conditions and must not upload sensitive or regulated information merely because security measures are in place.

33. Data Breaches

If USDMPlay becomes aware of a personal-data breach, the incident will be assessed in accordance with applicable data-protection requirements.

Where legally required, USDMPlay will notify the competent supervisory authority.

Where a breach is likely to result in a high risk to affected individuals, those individuals may also be informed where required by law.

34. Your GDPR Rights

Depending upon the circumstances and applicable legal basis, you may have the following rights concerning your personal data:

Right to information

You have the right to understand how your personal information is processed.

Right of access

You may request confirmation of whether USDMPlay processes personal data concerning you and request a copy of that information.

Right to rectification

You may request correction of inaccurate or incomplete personal information.

Right to erasure

You may request deletion of personal information where the applicable legal requirements are met.

Right to restriction

You may request that processing be restricted in certain circumstances.

Right to data portability

Where applicable, you may request personal information you provided in a structured, commonly used and machine-readable format.

Right to object

Where processing is based upon legitimate interests, you may object to the processing based upon circumstances relating to your particular situation.

Right to withdraw consent

Where processing is based upon consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing performed before withdrawal.

Rights concerning automated decision-making

You have rights regarding certain decisions made solely through automated processing that produce legal or similarly significant effects.

USDMPlay does not currently use automated processing for such significant individual decision-making.

35. How to Exercise Your Rights

To exercise a privacy right, contact:

support@usdmplay.com

Please clearly describe:

• the right you wish to exercise;
• the account/email address concerned; and
• any information reasonably necessary to identify the relevant account.

We may need to verify your identity before providing, changing or deleting account information to prevent unauthorised access to another person’s information.

Requests will be handled without undue delay and within the period required by applicable law.

In many cases under the GDPR, this means responding within one month, subject to legally permitted extensions for particularly complex requests.

36. Right to Complain to a Supervisory Authority

If you believe that your personal data has been processed in violation of applicable data-protection law, you have the right to lodge a complaint with a competent supervisory authority.

Because USDMPlay is operated from Belgium, the relevant Belgian supervisory authority is:

Belgian Data Protection Authority
Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD)

You may also have the right to contact the data-protection authority in the EU or EEA country where you normally live or work.

We encourage users to contact support@usdmplay.com first where appropriate so that we have an opportunity to address the concern.

This does not limit your right to contact a supervisory authority.

37. Children

USDMPlay is intended primarily for professionals, researchers, students and adults interested in clinical study design and data standards.

USDMPlay accounts are intended for users aged 18 years or older.

USDMPlay does not knowingly seek to collect personal data from children through account registration.

If you believe that a child has created an account or provided personal information, please contact:

support@usdmplay.com

38. Information Provided by Employers or Organisations

If you use USDMPlay in connection with your work, information associated with your professional activities may still constitute personal information.

For example:

firstname.lastname@company.com

may identify you even though it is a professional email address.

You are responsible for ensuring that your employer or organisation permits you to use USDMPlay and permits you to upload the information you provide.

39. Publicly Available and Anonymised Study Information

USDMPlay encourages the use of:

• publicly available study data;
• synthetic examples;
• educational USDM files; and
• properly anonymised non-production information.

Information that has been genuinely and irreversibly anonymised so that no individual can reasonably be identified is generally outside the scope of personal-data protection requirements.

Pseudonymised data that could still be linked back to an individual remains personal data and should not be uploaded to USDMPlay as participant-level clinical information.

40. Data Minimisation

USDMPlay’s design is based on the principle that a USDM educational platform should not require patient-level personal information.

Users should provide only information necessary for:

• account administration;
• learning USDM;
• exploring study-design structures;
• testing educational mappings;
• using USDM demonstrations; and
• requesting Platform support.

Do not provide additional personal information merely because an input field or free-text area allows it.

41. Links to External Websites

USDMPlay contains references and links to external resources, including standards organisations, educational material and other third-party websites.

When you leave USDMPlay and access a third-party website, that website’s privacy policy and terms apply.

USDMPlay is not responsible for the privacy practices of unrelated third-party websites.

42. Changes to This Privacy Policy

USDMPlay may update this Privacy Policy from time to time to reflect:

• changes to Platform functionality;
• new technical service providers;
• changes to AI functionality;
• changes to cookie usage;
• changes to data-retention practices;
• security developments; or
• legal and regulatory requirements.

The most recent version will be made available on the USDMPlay website together with the Last Updated date.

Where a change materially affects how registered users’ personal information is processed, reasonable efforts may be made to provide additional notice where appropriate.

43. Relationship With the Terms & Conditions

This Privacy Policy explains how USDMPlay handles personal information.

The USDMPlay Terms & Conditions separately govern acceptable use of the Platform, study-data restrictions, educational-use requirements, AI disclaimers and user responsibilities.

Both documents should be read together.

In particular, users should remember:

• USDMPlay is an educational and demonstration platform;
• only public or non-production study information should be uploaded;
• identifiable patient information must never be uploaded;
• USDMPlay does not store traditional user passwords;
• OTP authentication is used for account access;
• study/project information may be removed after 10 consecutive days without successful login;
• account registration information may remain until the account is deleted;
• Ask USDM is an AI-enabled feature;
• AI outputs must be independently verified; and
• USDMPlay must not be used as a repository for regulated clinical data.

44. Contact Us

For privacy questions, data-subject requests, account deletion requests or concerns about information accidentally uploaded to USDMPlay, contact:

USDMPlay
Data Controller: Rajesh Saha
Location: Belgium
Email: support@usdmplay.com

Privacy in Simple Terms

USDMPlay aims to keep its privacy approach straightforward:

We need some basic information to create and operate your account.

We use OTP login and do not store a traditional USDMPlay password.

Upload only public or non-production USDM study information.

Never upload patient-level, confidential or regulated clinical information.

Your study and project information is removed after 10 consecutive days without login.

Your account information remains so that you can return to USDMPlay, unless you ask us to delete your account.

Ask USDM is an AI-enabled feature. Do not enter sensitive information into it.

Strictly necessary cookies support functions such as authentication. Optional analytics cookies should be used only with your consent where required.

USDMPlay does not sell your personal information.

If you have a privacy question or would like your account deleted, contact:

support@usdmplay.com